i have a spring security implementation for the existing spring based application, it always returns anonymous user regardless of what i supply at login page.
@Configuration
@EnableWebSecurity
@EnableGlobalAuthentication
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
@Autowired
public void configureGlobalSecurity(AuthenticationManagerBuilder auth) throws Exception {
auth.inMemoryAuthentication().withUser("bill").password("abc123").roles("ROLE_USER");
auth.inMemoryAuthentication().withUser("admin").password("root123").roles("ADMIN");
auth.inMemoryAuthentication().withUser("dba").password("root123").roles("ADMIN","DBA");
}
@Override
protected void configure(HttpSecurity http) throws Exception {
System.out.println("configure called");
http.authorizeRequests()
.antMatchers("/*").access("hasRole('ROLE_USER')")
//.antMatchers("/*").access("IS_AUTHENTICATED")
.and().formLogin().loginPage("/login")
.usernameParameter("user").passwordParameter("passWord")
.and().csrf()
.and().exceptionHandling().accessDeniedPage("/Access_Denied");
}
}
form from login.jsp:
<form action="/Patching/Authen" name="form1" method="POST" onsubmit="return validateForm();"><br><br>
<h1>User Login</h1>
<table>
<tr>
<th>Username</th>
<td><input type="text" name="username" id="user" required/></td>
</tr>
<tr>
<th>Password</th>
<td><input type="password" name="password" required/></td>
</tr>
</table><br><input type="hidden" name="${_csrf.parameterName}" value="${_csrf.token}" />
<input type="submit"><br><br><br>
</form>
While i do at my controller post the form submit :
Object principal = SecurityContextHolder.getContext().getAuthentication().getPrincipal();
anonymous authentication is returned.
P.S. I already have a login.jsp where I have the configured user and password parameter. Help appreciated.
I tried whatever you suggest above...what worked for me is changing the form action on the login.jsp to "login" and modifying configure to
http.authorizeRequests()
.antMatchers("/", "/home").access("hasRole('USER')")
.antMatchers("/resources/**").permitAll()
//.antMatchers("/*").access("IS_AUTHENTICATED")
.anyRequest().authenticated()
.and().csrf().disable().formLogin().loginPage("/login").permitAll()
//.loginProcessingUrl("/Authen")
.usernameParameter("user").passwordParameter("passWord")
.defaultSuccessUrl("/Authen")
.failureUrl("/failedLogin")
.and().exceptionHandling().accessDeniedPage("/Access_Denied");
further I need to work on the flow of the existing implementation along with spring security.