Spring Security not mapping requests to controllers - Java Config

Question

I am creating a spring security application using Spring 4.0.2.RELEASE and Spring Security 3.2.3.RELEASE using entirely java configuration, no xml. The configuration for security seems to be working correctly and is generating the login page correctly and authenticating. However I get 404 errors for all of my pages.

I have controllers and jsp pages set up for each page. When I run the application, I see log messages showing that the controllers were mapped

Mapped "{[/ || /welcome] ... onto ... WelcomeController.welcome()

However, when I try to hit one of those URLs, I get the login page, then on sucessfull login get a 404 and I see nothing in the log.

Below you will find my controller, my 2 configuration classes, and my 2 initializes.

WelcomeController.java

@Controller
public class WelcomeController {
    @RequestMapping(value = {"/", "/welcome"})
    public ModelAndView welcome() {
        System.out.println("welcome invoked");
        ModelAndView modelAndView = new ModelAndView();
        modelAndView.setViewName("welcome");
        return modelAndView;
    }
}

Below You will find my configuration files

WebConfig.java

@EnableWebMvc
@Configuration
@ComponentScan({ "com.myproject.pagegen.controller" })
public class WebConfig extends WebMvcConfigurerAdapter {

    @Bean
    public ViewResolver viewResolver() {
        InternalResourceViewResolver resolver 
                = new InternalResourceViewResolver();
        resolver .setViewClass(JstlView.class);
        resolver.setPrefix("/WEB-INF/jsp/");
        resolver.setSuffix(".jsp");
        return resolver;
    }

SecurityConfig.java

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(AuthenticationManagerBuilder auth)
        throws Exception {
            auth.inMemoryAuthentication()
            .withUser("user").password("password").roles("USER");
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
            .antMatchers("/").hasRole("USER")
            .antMatchers("/welcome").hasRole("USER")
            .anyRequest().anonymous()
            .and().formLogin();
    }

    @Bean
    @Override
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }

WebAppInitializer.java

public class WebAppInitializer 
    extends AbstractAnnotationConfigDispatcherServletInitializer {

    @Override
    protected Class<?>[] getRootConfigClasses() {
        return new Class<?>[] { WebConfig.class, SecurityConfig.class };
    }

    @Override
    protected Class<?>[] getServletConfigClasses() {
        return null;
    }

    @Override
    protected String[] getServletMappings() {
        return new String[] { "/" };
    }

SecurityWebAppInitializer.java

public class SecurityWebAppInitializer 
    extends AbstractSecurityWebApplicationInitializer { }

UPDATE:

I did find something interesting. If I changed my servletMapping to /* instead of /, I would then get a log message showing that the controller was invoked, but it would have no mapping for the jsp. It seems like it is trying to map the jsp url to the controllers.

welcome invoked
org.springframework.web.servlet.PageNotFound noHandlerFound
WARNING: No mapping found for HTTP request with URI [/ROOT/WEB-INF/jsp/welcome.jsp] in DispatcherServlet with name 'dispatcher'

Answer 1

I had a similar issue when running a project using Eclipse and Tomcat. Try running the application using Spring Tool Suite and use the VMware vFabric tc server.

I also got it to work in Eclipse and Tomcat by manually updating the version of Tomcat installed. Try the latest version 7.0.54 https://tomcat.apache.org/download-70.cgi

Answer 2

It seems to me that all troubles in your authentication mechanism and not in controller mapping for URL-s.

It is a good tutorial about Security Java config LINK

When you try go to your pages without authentifications you are redirected to 'login page'. If I've understand right - your authentification process is fail all the time. In your configuration you can't go to '/welcome' and '/' pages without being authorized.

Try to add and change next things:

protected void configure(HttpSecurity http) throws Exception {

        // Here you can define your custom redirections 

         .loginPage("[some url]")
                .failureUrl("[some url]")
                .loginProcessingUrl("[some url]")
                .defaultSuccessUrl("[some url]")

// Here the credentials, sended to the authentification mechanizm (If you use clasic 'UsernamePasswordAuthenticationFilter')
                .usernameParameter("j_username")
                .passwordParameter("j_password")
                .permitAll()

// Permitions for access pages
        http.authorizeRequests()
            .antMatchers("/welcome", "/").permitAll()

// Access restriction without using roles         
            .antMatchers([some other URL-s]]).authenticated()

           // or using ROLES

            .antMatchers([some other URL-s]]).hasRole("USER")


 // Here you can define your custom redirections  for logout
       .and()
                .logout()
                .logoutUrl("/logOut")
                .logoutSuccessUrl("/welcome");           
    }

If you use clasic 'UsernamePasswordAuthenticationFilter' you must define it as bean (If you use another fllter, of course you must define it):

@Bean
    public UsernamePasswordAuthenticationFilter filter() {
        UsernamePasswordAuthenticationFilter filter = new UsernamePasswordAuthenticationFilter();
        filter.setAuthenticationManager(providerManager());
        return filter;
    }

And then in JSP page use form like this ('j_username' and 'j_password' parameters required in default authentication with 'UsernamePasswordAuthenticationFilter')

<form name="signIn" action="[your SignIn URL]" method="POST">

  <input type="text" name="j_username"></label>
  <input type="password" name="j_password"></label>

  <input type="submit" value="Log In">

</form>

You must try the remote debugging to find what fail in your authentication process.