How to work with spring security using cookie to authenticate: Spring, Struts2, Acegi

How to work with spring security using cookie to authenticate

Asked by: intlgd

Hello all,

I have a basic understanding of how spring security works from the Spring in Action 2 book, but my situation is a little unique. So let me explain:

We have apache sitting in front of port 80 (on a secured intranet) and authenticate through a proprietary apache module there. This generates an encrypted cookie and stores it so that I can access it from my application. My current authentication method uses a Struts2 action and calls the database to see if the user exists. If he doesn't we automatically create a user in our system with ROLE_BASIC privileges.

What I want to do is tie in spring security so I can secure certain parts of my web application from users typing in the URL. We have roles set up so we're trying to make it roles based access. I was hoping to do this through a configuration instead of littering my JSPs with this stuff.

From what I can tell everything in the Spring In Action 2 example would work except that I am not asking the user to log into a page and I'm also not expecting them to necessarily already have an account.

Any thoughts on how I could use what Spring (Acegi) has, but role in my own unique requirements.

Thanks,

Jared

Instant Access to this Solution

Plus...

30 Day FREE access, no risk, no obligation

Collaborate with the world's top tech experts

Unlimited access to our exclusive solution database

Never be left without tech help again

Trusted by hundreds of thousands everyday for fast, accurate and reliable tech support.

"The time we save is the biggest benefit of Experts Exchange to Warner Bros. What could take multiple guys 2 hours or more each to find is accessed in around 15 minutes on Experts Exchange." Mike Kapnisakis, Warner Bros.

"Our team likes having a resource that is more secure than just using Google and most experts using this service really know their stuff. It's nice to look here first versus using Google." Dayna Sellner, Lockheed Martin

"Anytime that I've been stumped with a problem, 9 out of 10 times Experts Exchange has either the accepted solution or an open discussion of the potential solution to the problem." Kenny Red, eBay Inc.

See what Experts Exchange can do for you.

Got a question?

We've got the answer.

Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.

Screenshot of Experts Exchange Knowledgebase

Need individual assistance?

Our experts are ready to help.

If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.

Want to learn from the best?

Read articles from industry experts.

Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.

Working on a long term project?

Store your work and research.

Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.

Join the Community

Give a Little. Get a Lot.

Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.

Boonleng,

Great pointer. I spent a full 8 hours working on trying to figure this out. I couldn't seem to get it to do what I want using this approach. Now here is what I've come up with, that works, but feels like an ugly hack that I wouldn't want any other developers looking at :-| .

I'm using form based authentication where a servlet is the login page that unencrypts the page and then uses a post to login the users using a form based approach.

See my config below. This seems to be doing the trick, but doesn't seem very elegant. Any thoughts would be appreciated.

FYI - I will be doing another post to ask why my filters and tags in page are not working. If you could post an answer on that question that'd be awesome.

Thanks again,

Jared

web.xml
 
<!-- Spring security -->
    <filter>
      <filter-name>springSecurityFilterChain</filter-name>
      <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    </filter>
 
    <filter-mapping>
      <filter-name>springSecurityFilterChain</filter-name>
      <url-pattern>/*</url-pattern>
    </filter-mapping>   
 
security-config.xml
 
<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security"
  xmlns:beans="http://www.springframework.org/schema/beans"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.0.xsd
              http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-2.0.4.xsd">
 
    <http>
        <intercept-url pattern='/dacsLogin.htm' filters='none'/>
        <intercept-url pattern='/**' access='ROLE_BASIC' />
        <intercept-url pattern='/admin/**' access='ROLE_ADMIN' />
        <intercept-url pattern='/system/**' access='ROLE_SUPER' />
        <form-login login-page='/dacsLogin.htm' default-target-url='/index.jsp' always-use-default-target='true' />
    </http>
 
    <authentication-provider user-service-ref='userDetailsService'/>
 
    <beans:bean id="userDetailsService" class="com.cisco.btd.security.BtdUserDetailsService">
        <beans:property name="userService" ref="userService"/>
    </beans:bean>
 
</beans:beans>

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:

Select all Open in new window

Question

How to work with spring security using cookie to authenticate

Subscribe now for full access to Experts Exchange and get

Instant Access to this Solution

Spring

Struts2

Acegi

Spring

J2EE

Java Server Pages (JSP)

Trusted by hundreds of thousands everyday for fast, accurate and reliable tech support.

See what Experts Exchange can do for you.

Got a question?

We've got the answer.

Need individual assistance?

Our experts are ready to help.

Want to learn from the best?

Read articles from industry experts.

Working on a long term project?

Store your work and research.

What Makes Experts Exchange Unique?

Trusted by the world's most respected brands.

Faithfully serving IT professionals since 1996.

Related Solutions

Free Tech Articles

Cloud Class Webinars

Join the Community

Give a Little. Get a Lot.

Answers

3 Ways to Join

The Experts

The Experts

Testimonials

Testimonials

Testimonials

Business Clients

Business Clients

In the Press

In the Press

In the Press