springspring-security

Spring custom filters one after each other in the filter chain

I am adding a new filter to our application. The filter itself works, but the problem is it needs to come right before another custom filter in the filter chain and spring complains about this.

Here is an example from our permissions.xml:

<security:http-basic/>
        <custom-filter before="path.to.our.filter.OldFilter" ref="newFilter" />
        <custom-filter before="FORM_LOGIN_FILTER" ref="oldFilter" />
    </security:http>
    <beans:bean id="newFilter" class="path.to.our.other.filter.NewFilter"/>
    <beans:bean id="oldFilter" class="path.to.our.filter.OldFilter"/>

This complains with the following error:

Caused by: org.xml.sax.SAXParseException: cvc-enumeration-valid: Value 'com.iai.argus.common.jetty_spring.util.BasicAuthUsernameExtractorFilter' is not facet-valid with respect to enumeration '[FIRST, CHANNEL_FILTER, SECURITY_CONTEXT_FILTER, CONCURRENT_SESSION_FILTER, WEB_ASYNC_MANAGER_FILTER, HEADERS_FILTER, CORS_FILTER, CSRF_FILTER, LOGOUT_FILTER, X509_FILTER, PRE_AUTH_FILTER, CAS_FILTER, FORM_LOGIN_FILTER, OPENID_FILTER, LOGIN_PAGE_FILTER, DIGEST_AUTH_FILTER, BASIC_AUTH_FILTER, REQUEST_CACHE_FILTER, SERVLET_API_SUPPORT_FILTER, JAAS_API_SUPPORT_FILTER, REMEMBER_ME_FILTER, ANONYMOUS_FILTER, SESSION_MANAGEMENT_FILTER, EXCEPTION_TRANSLATION_FILTER, FILTER_SECURITY_INTERCEPTOR, SWITCH_USER_FILTER, LAST]'. It must be a value from the enumeration.

I need a way to insert the new filter before the old filter and the FORM_LOGIN_FILTER. How can I do this?

Solution

  • (With the help of Comments)
    Putting the new filter before CAS_FILTER worked in my case.

    You can't configure custom filter with referencing to another custom filter order. You should say before/after/position pre-defined filters. So If you want to add newFilter before oldFilter, you can try adding newFilter before CAS_FILTER and debug the order for ensuring