	[x] Posted via EE Mobile
	Search, ask, and monitor your questions on the go with EE Mobile. Visit Experts Exchange from your mobile device and never be out of touch again.

Question

	[x] Attachment Details

[x]

The Solution Rating System

With so many solutions, how can you tell which solutions are most likely to help you and which ones are not? To provide you with a tool to use, we rate our solutions based on various elements that most accurately determine if a solution is a quality solution. To explain what factors affect the solution rating, here are the elements we take into consideration when formulating our solution rating.

The Grade of the Solution
The Zone Rank of the Expert Providing the Solution
The Number of Author and Expert Comments
The Number of Experts Contributing
The Feedback of the Community

Your Input Matters
Because of the way the system is set up, the most important variable in this equation is you. As a member of Experts Exchange, you are able to cast your vote on the quality of the solutions in regard to how complete, accurate, helpful and easy to understand each solution is. When you provide your feedback, each rating is adjusted accordingly. So, if you see a solution that has a poor rating that you think is a good solution, let us know by rating it. As you do, the rating will be adjusted and will become more accurate for other members of our site.

If you have any suggestions that you would like to make for our rating system, please ask a question in the Suggestions Zone of Community Support.

Thank you!

9.1

Using spring security to handle pre-authenticated user.

Asked by intlgd in Spring, Java Server Pages (JSP), Jakarta Struts

Tags: Spring Security, JSP

Hello,

This is my second post relating to this question. I got a pointer to the pre-authenticated section of the spring security in the answer of my last request for help and felt kind of silly when I realized that I hadn't read the documentation. I can now say that I've read through the security documentation multiple times, read 2 books on spring security, and downloaded the spring security sample source files and am still stuck!

I can get authentication to work perfectly for form based authentication, but cannot seem to get my custom authentication. I've put my security-config.xml below for the basic authentication. I'm using Dacs for authentication which handles single sign on for a number of our apps that sit in the same server space. Dacs creates an encrypted cookie, which we then gets decrypted when it hits our entry point servlet. The challenge is that I need an HttpServletRequest to get Dacs to decrypt the cookie and need to do so without using form based authentication.

As you can see below I've created a custom authentication provider to handle authentication against our userProfile database. The actual authentication is happening in the dacsLogin.htm, which is a servlet. The servlet redirects to a jsp which automatically posts to spring security with the extracted details captured in the servlet. This is a real hack and is causing problems for me in ajax based requests when the session times out. If I could either replace the servlet with the pre-auth stuff without causing anything to be output to the client that would be the perfect solution.

The problem is I've tried 20 different configurations and can't seem to get the pre-auth to work. Does someone have a stipped down example of pre-auth working. Your help would be greatly appreciated.

Please don't refer me to spring documentation, as I've read it over and over and can't come to a solution from there. I need an example of using pre-auth with all the required pieces.

Thanks,

Jared

View the Solution FREE for 30 Days

         
           
             1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:
55:
56:
57:
58:
59:
60:
61:
62:
63:
64:
65:
66:
67:
68:
69:
70:
71:
72:
73:
74:
75:
76:
77:
78:
79:
80:
81:
82:
83:
84:
85:
86:
87:
88:
89:
90:
91:
92:
93:
94:
95:
96:
97:
98:
99:
100:
101:
102:
103:
104:
105:
106:
107:
108:
109:
110:
111:
112:

           
           
             -----security-config.xml--------
 
<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security"
    xmlns:beans="http://www.springframework.org/schema/beans"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.0.xsd
                        http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-2.0.1.xsd">
 
   <!-- Put '@Secured( {"ROLE_SUPER"} )' over service methods ~ Not working causes error -->
    <!--<global-method-security secured-annotations="enabled" /> -->
 
    <http>
        <intercept-url pattern='/dacsLogin.htm' filters='none'/>
        <intercept-url pattern='/system/**' access='ROLE_SUPER' />
        <intercept-url pattern='/admin/**' access='ROLE_ADMIN' />
        <intercept-url pattern='/**' access='ROLE_BASIC' />
        <form-login login-page='/dacsLogin.htm' default-target-url='/index.jsp' always-use-default-target='false' />
    </http>
 
    <authentication-provider user-service-ref='userDetailsService'/>
 
    <beans:bean id="userDetailsService" class="com.cisco.btd.security.BtdUserDetailsService">
        <beans:property name="userService" ref="userService"/>
    </beans:bean>
 
</beans:beans>
 
------web.xml---------
..................
 <!-- Spring security -->
    <filter>
      <filter-name>springSecurityFilterChain</filter-name>
      <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    </filter>
 
    <filter-mapping>
      <filter-name>springSecurityFilterChain</filter-name>
      <url-pattern>/*</url-pattern>
    </filter-mapping>
.........................
 
---------dacs authentication servlet -----------
 
protected void processRequest(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
 
        String dacsUsername;
        try {
            dacsUsername = DacsUtil.resolveUsername(DACS_BASE_URI, DACS_AUTH_JURIS, request);
            if (dacsUsername == null) {
                dacsUsername = "dacsuser";
                logger.error("Authentication problem. Couldn't find dacsUsername");
            }
            // Set session info.
            request.getSession(true).setAttribute(SESSION_USER_NAME, dacsUsername);
 
            logger.info("DACS credentials set for : " + dacsUsername);
        } catch (DacsException de) {
            dacsUsername = "dacsuser";
            logger.error("Failed authenticating with DACS: " + de.getMessage());
        }
 
        request.setAttribute("btdUser", dacsUsername);
        request.setAttribute("btdPassword", "");
        RequestDispatcher dispatcher;
        dispatcher = request.getRequestDispatcher("localLogin.jsp");
        dispatcher.forward(request, response);
 
}
 
--------------my hacked login jsp with auto-submit --------------
 
<%@page contentType="text/html" pageEncoding="UTF-8"%>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd">
 
<html>
    <head>
        <title>Login Page</title>
    </head>
    <body>
        <form name='loginForm' action='<%= request.getContextPath() %>/j_spring_security_check' method='POST'>
            <input type='hidden' name='j_username' value='${btdUser}'>
            <input type='hidden' name='j_password' value='${btdPassword}' />
        </form>
        <SCRIPT language="JavaScript">
            document.loginForm.submit();
        </SCRIPT>
    </body>
</html>
 
------------my custom user authentication class - which works perfectly at this point -------------
 
public class BtdUserDetailsService implements UserDetailsService {
........................
 
@Override
    public UserDetails loadUserByUsername(String userName) throws UsernameNotFoundException, DataAccessException {
 
        //find user - do the regular stuff.
        checkDefaultRoles();
 
        User user = userService.findByUserId(userName);
 
        user = checkUser(user, userName);
 
        return new BtdUserDetails(user);
    }
 
............................
 
}

           
         

20091021-EE-VQP-81 - Hierarchy / EE_QW_3_20080625

Hall of Fame

1. dravidnsr81,525
2. objects80,550
3. mrjoltcola7,500
4. mahome6,750
5. a_b5,900
6. karanw5,700
7. boonleng4,500
8. crossdev4,375
9. jamoville4,100
10. MuraliKanth4,080
11. ksivananth4,000
12. jwenting3,678
13. CEHJ3,360
14. ozlevanon3,200
15. anilallewar2,800
16. Kuldeepc...2,150
17. spprivate2,050
18. rrz@87...2,000
18. snoyes_jw2,000
18. garycase2,000
18. mwvisa12,000
18. mrcoffee...2,000
18. cxr2,000
18. lord_hes...2,000
18. jocafi2,000
18. bmunge2,000

1. objects85,925
2. dravidnsr81,525
3. mrjoltcola7,500
4. mahome6,750
5. PrasathA...6,000
6. jamoville5,975
7. a_b5,900
8. karanw5,700
9. boonleng4,500
10. Venabili4,475
11. crossdev4,375
12. MuraliKanth4,080
13. ksivananth4,000
14. jwenting3,678
15. mwvisa13,500
16. CEHJ3,360
17. ozlevanon3,200
18. anilallewar2,800
19. rrz@87...2,500
19. darkapple2,500
21. Kuldeepc...2,150
22. spprivate2,050
23. snoyes_jw2,000
23. garycase2,000
23. mrcoffee...2,000
23. sweetfa22,000
23. cxr2,000
23. MrMarshall2,000
23. lord_hes...2,000
23. jocafi2,000
23. bmunge2,000

Using spring security to handle pre-authenticated user.

Asked by intlgd in Spring, Java Server Pages (JSP), Jakarta Struts

Tags: Spring Security, JSP

About this solution