CODEWITHSUNDEEP
javaspringjakarta-eespring-security
monty
monty

Reputation: 8755

Spring Security Interceptor-URL not working

I am using Spring Security 3.0.3 for a project.

This project has 3 areas which should be accessible for different people

Therefore I create the following structure - WEB-INF/ (for everybody = unprotected) - WEB-INF/app (for users = ROLE_USER) - WEB-INF/app/admin.jsf (for admins = ROLE_ADMIN)

That admin.jsf is in the same directory I can't change unfortunatly.

My user info is loaded from the database.

They are defined like:

<bean id="preAuthenticatedProcessingFilterEntryPoint" class="org.springframework.security.web.authentication.Http403ForbiddenEntryPoint"/> <security:http entry-point-ref="preAuthenticatedProcessingFilterEntryPoint" >
   <security:custom-filter position="PRE_AUTH_FILTER" ref="MyFilter"/>
   <security:intercept-url pattern="/app/admin.jsf" access="ROLE_ADMIN" />         
   <security:intercept-url pattern="/app/**" access="ROLE_USER" />
   <security:intercept-url pattern="/**" access="" />
</security:http>

Now, everything works great. Userdata is loaded, roles are set according to the DB but unfortunatly

Does anyone have a hint what I did wrong? I am testing it locally and the browser url is: http://localhost:8080/my_app/app/admin.jsf

So far I was able to identify source of the problem that spring security ignores my roles. The patterns of the intercept urls are working, unfortunatly my defined roles don't.

I finally was able to identify the problem: a colleague checked in a second config file and I modiefied the wrong one. grml

Upvotes: 1

Views: 2103

Answers (1)

Ralph
Ralph

Reputation: 120861

The problem is that the patterns in the configuration are URL patterns, this is NOT the location of your jsf files or within the application.

So if you are not accessing this jsf via: http://<server>:<port>/<ApplicationName>/app/admin.jsf then you just need to correct the URL pattern to the url you really use.

Upvotes: 2

Related Questions