Spring Security - how can I define intercept-url dynamically using Database?

Question

I've been working on a spring security recently and I need to know how I can define intercept-url (in Spring Security) dynamically using a Database.

I've already dug deep the whole internet and I could not find any unique (and of course useful) tutorial in this area.

So here is what I did:

First I implemented FilterInvocationSecurityMetadataSource Abstract class:



public class MyFilterSecurityMetadataSource implements FilterInvocationSecurityMetadataSource {


    public List getAttributes(Object object) {
        FilterInvocation fi = (FilterInvocation) object;
        String url = fi.getRequestUrl();
        List attributes = new ArrayList();

        attributes = getAttributesByURL(url);

        return attributes;
    }

    public Collection getAllConfigAttributes() {
        return null;
    }

    public boolean supports(Class clazz) {
        return FilterInvocation.class.isAssignableFrom(clazz);
    }

    public List getAttributesByURL(String inputUrl)
    {
        List attributes = new ArrayList();

        Connection connection = null;
        String url = "jdbc:mysql://173.0.0.22:3306/";
        String dbName = "kheirkhahandb";
        String driverName = "com.mysql.jdbc.Driver";
        String userName = "kheirkhahan";
        String password = "kheirkhahan";
        try{
            Class.forName(driverName).newInstance();
            connection = DriverManager.getConnection(url+dbName, userName, password);
            try{
                Statement stmt = connection.createStatement();
                String selectquery = "select * from URL_ACCESS where URL = '" + inputUrl +"'";
                ResultSet rs = stmt.executeQuery(selectquery);
                while(rs.next()){
                    MyConfigAttribute temp = new MyConfigAttribute();
                    String attr = rs.getString("ACCESS").toString();
                    temp.setAttr(attr);
                    attributes.add(temp);
                }
            }
            catch(SQLException s){
                System.out.println(s);
            }
            connection.close();
        }
        catch (Exception e){
            e.printStackTrace();
        }
        return attributes;
    }

and I set my security.xml as:

There are some problems that I cannot find out:
1. I've inserted some pairs like <"URL" , "ROLE"> into URL_ACCESS database. But I'm not sure whether getAttributes method is working fine or not
2. Do I have to implement all those filters that I used in

3. I'm receiving exception when a user uses a wrong username/password or tries to access not-permitted-pages, instead of being redirected to login.jsp. Why is that?

Thanks in advance

Matin Kh · Accepted Answer

Thank you both Tom and Rob for your quick replies.

First of all, I'm totally aware of "storing url-patterns in database is not a good idea". However we are trying to manage everything dynamically. So there are no other choices.

As it turned out, there were some minor problems with my code. Here I answer each of my questions one by one.

My getAttributes method is working just fine. But there is an alternative to load url-patterns. I could load all url-patterns and their corresponding roles first into a HashedMap seperately. And in getAttributes method I could just look up the HasehdMap instead. In brief, it'd be like this:
- HashedMap url-access = myDBManager.getAllUrlAccess();
  And in my getAttributes method I use this url-access thing.

The question is somehow trimmed! I was trying to ask about those filters used in springSecurityFilterChain bean.

I was receiving exceptions because in authenticationProcessingFilter bean there were no such properties. So I re-write it like this:
```
    
    
    
    
       
```

and of course I had to introduce authenticationFailureHandler bean this as well:

Now I'm not receiving any exceptions.

But here arises another question: I cannot understand whether username/password is incorrect or the username does not have access to the requested page. In both cases, the user is redirected according to this bean:

Why is it controlling both cases?

Spring Security - how can I define intercept-url dynamically using Database?

Answers (2)

Related Questions