How do I use GridGain's web session clustering with spring security? - spring-security

Question

I'd like to introduce the GridGain's web session clustering to our spring web project. The thing is I can successfully start a GridGain node but can not get the login function works.
Here is my web.xml
<?xml version="1.0" encoding="UTF-8"?>
<web-app version="2.5" xmlns="http://java.sun.com/xml/ns/javaee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd">
<welcome-file-list>
<welcome-file>home.do</welcome-file>
</welcome-file-list>
<context-param>
<param-name>contextConfigLocation</param-name>
<param-value>
/WEB-INF/spring/root-context.xml,
/WEB-INF/spring/spring-security.xml
</param-value>
</context-param>
<listener>
<listener-class>org.gridgain.grid.startup.servlet.GridServletContextListenerStartup</listener-class>
</listener>
<filter>
<filter-name>GridGainWebSessionsFilter</filter-name>
<filter-class>org.gridgain.grid.cache.websession.GridWebSessionFilter</filter-class>
</filter>
<filter-mapping>
<filter-name>GridGainWebSessionsFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<context-param>
<param-name>GridGainConfigurationFilePath</param-name>
<param-value>default-config.xml</param-value>
</context-param>
<context-param>
<param-name>GridGainWebSessionsCacheName</param-name>
<param-value>partitioned</param-value>
</context-param>
<!-- Creates the Spring Container shared by all Servlets and Filters -->
<listener>
<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>
<!-- Processes application requests -->
<servlet>
<servlet-name>appServlet</servlet-name>
<servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
<init-param>
<param-name>contextConfigLocation</param-name>
<param-value>/WEB-INF/spring/appServlet/servlet-context.xml</param-value>
</init-param>
<load-on-startup>1</load-on-startup>
</servlet>
<filter>
<filter-name>springSecurityFilterChain</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
<filter-name>springSecurityFilterChain</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<servlet-mapping>
<servlet-name>appServlet</servlet-name>
<url-pattern>/</url-pattern>
</servlet-mapping>
<filter>
<filter-name>encodingFilter</filter-name>
<filter-class>org.springframework.web.filter.CharacterEncodingFilter</filter-class>
<init-param>
<param-name>encoding</param-name>
<param-value>UTF-8</param-value>
</init-param>
<init-param>
<param-name>forceEncoding</param-name>
<param-value>true</param-value>
</init-param>
</filter>
<filter-mapping>
<filter-name>encodingFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<session-config>
<session-timeout>30</session-timeout>
</session-config>
And here is my spring-security.xml
<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:beans="http://www.springframework.org/schema/beans"
xmlns:sec="http://www.springframework.org/schema/security"
xmlns:context="http://www.springframework.org/schema/context"
xmlns:c="http://www.springframework.org/schema/c"
xmlns:hz="http://www.hazelcast.com/schema/spring"
xsi:schemaLocation="http://www.springframework.org/schema/security
http://www.springframework.org/schema/security/spring-security-3.2.xsd
http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans-3.2.xsd
http://www.springframework.org/schema/context
http://www.springframework.org/schema/context/spring-context-3.2.xsd
http://www.hazelcast.com/schema/spring http://www.hazelcast.com/schema/spring/hazelcast-spring-3.2.xsd">
<beans:bean id="myAuthenticationSuccessHandler" class="com.litv.litvweb.web.security.MyAuthenticationSuccessHandler">
<beans:property name="alwaysUseDefaultTargetUrl" value="false" />
</beans:bean>
<beans:bean id="customLogoutSuccessHandler" class="com.litv.litvweb.web.security.CustomLogoutSuccessHandler"/>
<beans:bean id="litvWebTemplateDataSource" class="org.apache.commons.dbcp.BasicDataSource" destroy-method="close">
<beans:property name="driverClassName">
<beans:value>${jdbc.driverClassName}</beans:value>
</beans:property>
<beans:property name="url">
<beans:value>${jdbc.database.litvpc.url}</beans:value>
</beans:property>
<beans:property name="username">
<beans:value>${jdbc.database.litvpc.username}</beans:value>
</beans:property>
<beans:property name="password">
<beans:value>${jdbc.database.litvpc.password}</beans:value>
</beans:property>
</beans:bean>
<beans:bean id="litvWebNamedParameterJdbcTemplate" class="org.springframework.jdbc.core.namedparam.NamedParameterJdbcTemplate"
c:dataSource-ref="litvWebTemplateDataSource" />
<beans:bean id="securityContextMariaDao" class="com.litv.litvweb.domain.dao.SecurityContextMariaDao">
<beans:property name="litvWebNamedParameterJdbcTemplate">
<beans:ref bean="litvWebNamedParameterJdbcTemplate"/>
</beans:property>
</beans:bean>
<beans:bean id="customSecurityContextRepository" class="com.litv.litvweb.web.security.CustomSecurityContextRepository">
<beans:property name="securityContextDao">
<beans:ref bean="securityContextMariaDao"/>
</beans:property>
</beans:bean>
<!--<http use-expressions="true" auto-config="true" security-context-repository-ref="customSecurityContextRepository">-->
<http use-expressions="true" auto-config="true">
<intercept-url pattern="/protected.do" access="isAuthenticated()"/>
<intercept-url pattern="/member/memberInfo.do" access="isAuthenticated()"/>
<intercept-url pattern="/member/updateMemberInfo.do" access="isAuthenticated()"/>
<intercept-url pattern="/member/changePassword.do" access="isAuthenticated()"/>
<intercept-url pattern="/member/watchRecord.do" access="isAuthenticated()"/>
<intercept-url pattern="/member/useService.do" access="isAuthenticated()"/>
<intercept-url pattern="/member/consumptionRecord.do" access="isAuthenticated()"/>
<intercept-url pattern="/purchase/selectPayment.do" access="isAuthenticated()"/>
<intercept-url pattern="/purchase/cardInfo.do" access="isAuthenticated()"/>
<intercept-url pattern="/purchase/completeCard.do" access="isAuthenticated()"/>
<intercept-url pattern="/purchase/completeATM.do" access="isAuthenticated()"/>
<intercept-url pattern="/purchase/completeSupermarket.do" access="isAuthenticated()"/>
<intercept-url pattern="/login.do" access="permitAll"/>
<intercept-url pattern="/**" access="permitAll"/>
<intercept-url pattern="/home.do" requires-channel="http"/>
<form-login login-processing-url="/j_spring_security_check"
login-page="/login.do"
always-use-default-target="false"
authentication-success-handler-ref="myAuthenticationSuccessHandler"
authentication-failure-url="/login.do?error=1"/>
<logout logout-url="/j_spring_security_logout"
success-handler-ref="customLogoutSuccessHandler"/>
<port-mappings>
<port-mapping http="8080" https="8443"/>
</port-mappings>
<session-management session-fixation-protection="migrateSession" />
</http>
<beans:bean id="encoder" class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder"/>
<beans:bean class="org.springframework.beans.factory.config.PropertyPlaceholderConfigurer">
<beans:property name="locations">
<beans:value>classpath:system.properties</beans:value>
</beans:property>
</beans:bean>
<beans:bean id="litvJsonRpcPartnerAuthProxy" class="com.googlecode.jsonrpc4j.JsonRpcHttpClient">
<beans:constructor-arg>
<beans:bean class="java.net.URL">
<beans:constructor-arg>
<beans:value>${json.rpc.partnerauthproxy}</beans:value>
</beans:constructor-arg>
</beans:bean>
</beans:constructor-arg>
</beans:bean>
<beans:bean id="systemProperties" class="org.springframework.beans.factory.config.PropertiesFactoryBean">
<beans:property name="locations">
<beans:list>
<beans:value>classpath:system.properties</beans:value>
</beans:list>
</beans:property>
</beans:bean>
<beans:bean id="systemService" class="com.litv.litvweb.domain.service.SystemService">
<beans:property name="systemProperties">
<beans:ref bean="systemProperties"/>
</beans:property>
</beans:bean>
<sec:authentication-manager>
<sec:authentication-provider ref="limitLoginAuthenticationProvider"/>
</sec:authentication-manager>
<!--
<beans:bean id="userCacheService" class="com.litv.litvweb.domain.service.UserCacheService"/>
-->
<beans:bean id="securityManagerService" class="com.litv.litvweb.domain.service.SecurityManagerService">
<!--
<beans:property name="userCacheService">
<beans:ref bean="userCacheService"/>
</beans:property>
-->
</beans:bean>
<beans:bean id="cdiPartnerService" class="com.litv.litvweb.domain.service.CdiPartnerService">
<beans:property name="litvJsonRpcPartnerAuthProxy">
<beans:ref bean="litvJsonRpcPartnerAuthProxy"/>
</beans:property>
<beans:property name="systemService">
<beans:ref bean="systemService"/>
</beans:property>
</beans:bean>
<beans:bean id="limitLoginAuthenticationProvider" class="com.litv.litvweb.web.security.LimitLoginAuthenticationProvider">
<beans:property name="userDetailsService">
<beans:ref bean="securityManagerService"/>
</beans:property>
<beans:property name="cdiPartnerService">
<beans:ref bean="cdiPartnerService"/>
</beans:property>
<!--
<beans:property name="userCacheService">
<beans:ref bean="userCacheService"/>
</beans:property>
-->
<beans:property name="passwordEncoder">
<beans:ref bean="encoder"/>
</beans:property>
</beans:bean>
No specific exception was thrown. Just couldn't get the login works. Does anyone know what goes wrong?
Thanks,
YI-CHAN

Answer 1

Yi-Chan,
I'm assuming that if you remove GridGain web session clustering configuration from your application, login function does work. Is that right? Please confirm.
Also could you check if web session clustering works correctly in case you disable Spring security?
Thanks!