struts2single-sign-onactionspring-saml

How to secure Struts actions with Spring single-sign-on


Currently I am using Struts 2 framework in my web application, now I have integrated single-sign-on with the help of Spring SAML extension and ADFS server, now every thing is working fine except Struts 2 actions,

when I am going to call/hit any Struts action like example.com/myapplication/myactionname.action URL then Spring SSO never ask for authentication.

But when I hit any .jsp OR .js OR .css OR .html file

Ex. example.com/myapplication/test.jsp file in application it will prompt for authentication.

Screenshot image

Any ideas how to secure Struts actions with Spring single-sign-on, so that anybody can't access action URL directly without any authentication ?


Solution

  • Finally i got the solution, I have both Spring and Struts filter in my web.xml , I just changed filter order as below and its working for me.

    <filter>
        <filter-name>springSecurityFilterChain</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    </filter>
    <filter-mapping>
        <filter-name>springSecurityFilterChain</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>
    
    <filter>
        <filter-name>struts2</filter-name>
        <filter-class>org.apache.struts2.dispatcher.ng.filter.StrutsPrepareAndExecuteFilter</filter-class>
    </filter>
    
    <filter-mapping>
        <filter-name>struts2</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>