I am trying to call the rest API for creating a cart with /api/v1/cart on POST method. I tried with and without customer id. But still facing the error. Is there to be configured?? Any help would be great.
Below isthe stackrace of jetty server
HTTP ERROR 500
Problem accessing /api/v1/cart. Reason:
XSRF token mismatch (null). Session may be expired.Caused by:org.broadleafcommerce.common.exception.ServiceException: XSRF token mismatch (null). Session may be expired.
at org.broadleafcommerce.common.security.service.ExploitProtectionServiceImpl.compareToken(ExploitProtectionServiceImpl.java:122)
at org.broadleafcommerce.common.security.handler.CsrfFilter.doFilter(CsrfFilter.java:79)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:105)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:87)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
at org.springframework.security.web.access.channel.ChannelProcessingFilter.doFilter(ChannelProcessingFilter.java:144)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330)
at org.broadleafcommerce.common.web.filter.EstablishSessionFilter.doFilter(EstablishSessionFilter.java:43)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
at org.springframework.orm.jpa.support.OpenEntityManagerInViewFilter.doFilterInternal(OpenEntityManagerInViewFilter.java:180)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:192)
at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:166)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:192)
at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:160)
at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:346)
at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:259)
at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1302)
at com.anvayin.webapp.CustomCORSFilter.doFilter(CustomCORSFilter.java:38)
at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1302)
at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:88)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1302)
at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:448)
at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:131)
at org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:524)
at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:231)
at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1067)
at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:377)
at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:192)
at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1001)
at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:129)
at org.eclipse.jetty.server.handler.ContextHandlerCollection.handle(ContextHandlerCollection.java:250)
at org.eclipse.jetty.server.handler.HandlerCollection.handle(HandlerCollection.java:149)
at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:111)
at org.eclipse.jetty.server.Server.handle(Server.java:360)
at org.eclipse.jetty.server.AbstractHttpConnection.handleRequest(AbstractHttpConnection.java:454)
at org.eclipse.jetty.server.AbstractHttpConnection.headerComplete(AbstractHttpConnection.java:890)
at org.eclipse.jetty.server.AbstractHttpConnection$RequestHandler.headerComplete(AbstractHttpConnection.java:944)
at org.eclipse.jetty.http.HttpParser.parseNext(HttpParser.java:630)
at org.eclipse.jetty.http.HttpParser.parseAvailable(HttpParser.java:230)
at org.eclipse.jetty.server.AsyncHttpConnection.handle(AsyncHttpConnection.java:77)
at org.eclipse.jetty.io.nio.SelectChannelEndPoint.handle(SelectChannelEndPoint.java:622)
at org.eclipse.jetty.io.nio.SelectChannelEndPoint$1.run(SelectChannelEndPoint.java:46)
at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:603)
at org.eclipse.jetty.util.thread.QueuedThreadPool$3.run(QueuedThreadPool.java:538)
at java.lang.Thread.run(Thread.java:744)
--
Thanks,
Sneha
Ensure that in your site's web.xml, applicationContext-rest-api.xml is included in the list of patchConfigLocations above applicationContext-security.xml. That applicationContext-rest-api.xml excludes the blCsrfFilter for all paths that start with /api/:
<!-- Set up Spring security for the RESTful API -->
<sec:http pattern="/api/**" create-session="stateless">
<sec:http-basic />
<sec:custom-filter ref="blRestPreSecurityFilterChain" before="CHANNEL_FILTER"/>
<sec:custom-filter ref="blRestCustomerStateFilter" after="REMEMBER_ME_FILTER"/>
<sec:custom-filter ref="blRestPostSecurityFilterChain" after="SWITCH_USER_FILTER"/>
</sec:http>
If you do not have that piece, then Spring Security will throw in the blCsrfFilter into the security filter chain which is required for the site but should be excluded in the Rest APIs. From applicationContext-security.xml:
<sec:http auto-config="false" authentication-manager-ref="blAuthenticationManager" disable-url-rewriting="true">
<!-- We handle session fixation protection ourselves -->
<sec:session-management session-fixation-protection="none" />
<!-- .................................. -->
<!-- Other configuration excluded -->
<!-- .................................. -->
<!-- Specify our custom filters -->
<sec:custom-filter ref="blPreSecurityFilterChain" before="CHANNEL_FILTER"/>
<sec:custom-filter ref="blCsrfFilter" before="FORM_LOGIN_FILTER"/>
<sec:custom-filter ref="blSessionFixationProtectionFilter" before="SESSION_MANAGEMENT_FILTER"/>
<sec:custom-filter ref="blPostSecurityFilterChain" after="SWITCH_USER_FILTER"/>
</sec:http>
Related
I'm using Spring security 5.1.1. I'm trying to create two security entryPoints for my application: one for REST and another for the secured urls of the application. I've created CustomAuthenticationProvider by implementing AuthenticationProvider for the authenticationManager.
I'm following the examples in :
Spring Security for a REST API and
Spring Security – Two Security Realms in one Application
But on the login page, when I enter username and password it doesn't hit the CustomAuthenticationProvider.authenticate() method at all, rather it goes to logout.html.
Below is my xml snippet of http:
<!-- Configuration for API -->
<security:http entry-point-ref="restAuthEntryPoint" pattern="/api/**" use-expressions="true">
<intercept-url pattern="/api/**" access="hasAnyRole('ROLE_DRIVER','ROLE_PARENT') and isAuthenticated()"/>
<intercept-url pattern="/api/driver/**" access="hasRole('ROLE_DRIVER') and isAuthenticated()"/>
<intercept-url pattern="/api/parent/**" access="hasRole('ROLE_PARENT') and isAuthenticated()"/>
<form-login
authentication-success-handler-ref="apiSuccessHandler"
authentication-failure-handler-ref="apiFailureHandler" />
<custom-filter ref="apiAuthenticationFilter" after="BASIC_AUTH_FILTER" />
<logout />
</security:http>
<beans:bean id="apiAuthenticationFilter" class="org.springframework.security.web.authentication.www.BasicAuthenticationFilter">
<beans:constructor-arg name="authenticationEntryPoint" ref="restAuthEntryPoint"/>
<beans:constructor-arg name="authenticationManager" ref="authenticationManager"/>
</beans:bean>
<beans:bean id="restAuthEntryPoint"
class="com.main.sts.api.security.RestAuthenticationEntryPoint"/>
<beans:bean id="apiSuccessHandler"
class="com.main.sts.api.security.MySavedRequestAwareAuthenticationSuccessHandler"/>
<beans:bean id="apiFailureHandler" class=
"org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler"/>
<!-- Configuration for Rest-API finished-->
<security:http auto-config="true" use-expressions="true" authentication-manager-ref="authenticationManager">
<intercept-url pattern="/school_admin/*"
access="hasAnyRole('ROLE_SCHOOLADMIN','ROLE_GUEST','ROLE_SCHOOLTEACHER','ROLE_PARENT')" />
<form-login login-page="/login" authentication-failure-url="/loginfailed"/>
<!-- <custom-filter before="FORM_LOGIN_FILTER" ref="userAuthenticationProcessingFilter" /> -->
<logout invalidate-session="true" logout-success-url="/logout" />
<access-denied-handler error-page="/404" />
<session-management invalid-session-url="/logout.html">
</session-management>
<sec:headers >
<sec:cache-control />
<sec:hsts/>
</sec:headers>
</security:http>
<authentication-manager alias="authenticationManager">
<authentication-provider ref="customAuthenticationProvider" />
</authentication-manager>
<beans:bean id="customAuthenticationProvider" class="com.main.sts.util.CustomAuthenticationProvider">
<beans:property name="loginService" ref="loginService" />
</beans:bean>
Even if I commented out the configuration for the REST-api, still I don't get hit to that class.
Here's my CustomAuthenticationProvider:
#Component
public class CustomAuthenticationProvider implements AuthenticationProvider {
#Override
public Authentication authenticate(Authentication authentication) {
// **I never hit this class**
}
#Override
public boolean supports(Class<?> authentication) {
return authentication.equals(UsernamePasswordAuthenticationToken.class);
}
filter is defined correctly in web.xml:
<filter>
<filter-name>springSecurityFilterChain</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
springSecurityFilterChain /*
In the login jsp, I've setup form as below:
<form class="form-vertical login-form" name='f' action="<c:url value='j_spring_security_check' />" method="post">
I can't access secured urls, it takes me to the login page; this means - this filter works. But why can't I hit CustomAuthenticationProvider? Why does it go to logout.html???
I've also tried by implementing custom filter (which eventually sets authenticationManager as the property); but still no luck.
I've also checked the log files but nothing in there.
BTW, if I try to access through curl, I get Http status 403 (forbidden). The server understood the request but refuses to authorize it.
curl -i -X POST -d username=admin -d password=Admin123 http://localhost:8080/sts/api/login
Please help me to find out the issue.
Alhamdulillah, finally I've found the issue.The code base which I originally started with was implemented on Spring 2.5. I've upgraded Spring version to 5.1. Basically /j_spring_security_check , j_username and j_password have been deprecated.
Now I've changed my jsp accordingly and it works now.
It's weird that there was no error or warning message.
Can someone please advise how to secure a web socket endpoint using Spring Security framework?
I have an application secured with Spring Security.
One of the endpoints is a web socket.
Inside the web socket handler I need to authenticate a user making a connection to the web socket.
Specifically, I need to acquire both userid and also zone/tenant id.
If I use tag sec:http for websocket endpoint in spring-security.xml (please see the file below), this does trigger a login, and then inside web socket's #onOpen(Session session) handler
when I invoke session.getUserPrincipal(), the returned principal has a correct username inside it.
However I also need zone/tenant-id information.
I am trying to use SecurityContextHolder.getContext().getAuthentication() which should contain it, but the call returns null.
Apparently, sec:http does not cause Authentication object to be created for web socket requests.
I had been referred to
http://docs.spring.io/autorepo/docs/spring-security/4.1.x/reference/html/websocket.html
http://docs.spring.io/autorepo/docs/spring-security/4.1.x/reference/html/appendix-namespace.html#nsa-websocket-security
that seems to advise that to get an authenticator with zone information in it for a websocket endpoint, I need to add the following section to spring-security.xml:
<sec:websocket-message-broker>
<sec:intercept-message pattern="/WebSocket.svc" access="isAuthenticated()" />
</sec:websocket-message-broker>
Yet, when I add it and trying to start the application it fails with the following traceback/message:
org.springframework.beans.factory.parsing.BeanDefinitionParsingException: Configuration problem: Security namespace does not support decoration of element [websocket-message-broker]
Offending resource: ServletContext resource [/WEB-INF/spring-security.xml]
at org.springframework.beans.factory.parsing.FailFastProblemReporter.fatal(FailFastProblemReporter.java:60) ~[spring-beans-4.3.1.RELEASE.jar:4.3.1.RELEASE]
at org.springframework.beans.factory.parsing.ReaderContext.fatal(ReaderContext.java:68) ~[spring-beans-4.3.1.RELEASE.jar:4.3.1.RELEASE]
at org.springframework.beans.factory.parsing.ReaderContext.fatal(ReaderContext.java:55) ~[spring-beans-4.3.1.RELEASE.jar:4.3.1.RELEASE]
at org.springframework.security.config.SecurityNamespaceHandler.reportUnsupportedNodeType(SecurityNamespaceHandler.java:144) ~[spring-security-config-4.1.2.RELEASE.jar:4.1.2.RELEASE]
I am using Spring Security 4.1.2, and 4.3.1 for master Spring.
It is also unclear from Spring documentation whether sec:websocket-message-broker and sec:http should be used in conjunction for the web socket endpoint or are mutually exclusive.
Thanks for advice.
Sergey
P.S. My spring-security.xml looks like this:
<?xml version="1.0" encoding="UTF-8" ?>
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:oauth="http://www.springframework.org/schema/security/oauth2"
xmlns:sec="http://www.springframework.org/schema/security"
xmlns:websocket="http://www.springframework.org/schema/websocket"
xsi:schemaLocation="http://www.springframework.org/schema/security/oauth2
http://www.springframework.org/schema/security/spring-security-oauth2-1.0.xsd
http://www.springframework.org/schema/security
http://www.springframework.org/schema/security/spring-security-4.1.xsd
http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans-4.1.xsd">
<sec:http pattern="/Consumer.svc/**" create-session="never"
entry-point-ref="oauthAuthenticationEntryPoint"
access-decision-manager-ref="accessDecisionManager"
authentication-manager-ref="authenticationManager"
use-expressions="true">
<sec:anonymous enabled="false" />
<sec:intercept-url pattern="/Consumer.svc/**" access="isAuthenticated()" />
<sec:custom-filter ref="resourceServerFilter" before="PRE_AUTH_FILTER" />
<sec:access-denied-handler ref="oauthAccessDeniedHandler" />
</sec:http>
<sec:http pattern="/WebSocket.svc" create-session="never"
entry-point-ref="oauthAuthenticationEntryPoint"
access-decision-manager-ref="accessDecisionManager"
authentication-manager-ref="authenticationManager"
use-expressions="true">
<sec:anonymous enabled="false" />
<sec:intercept-url pattern="/WebSocket.svc" access="isAuthenticated()" />
<sec:custom-filter ref="resourceServerFilter" before="PRE_AUTH_FILTER" />
<sec:access-denied-handler ref="oauthAccessDeniedHandler" />
</sec:http>
<sec:websocket-message-broker>
<sec:intercept-message pattern="/WebSocket.svc" access="isAuthenticated()" />
</sec:websocket-message-broker>
<bean id="oauthAuthenticationEntryPoint"
class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint">
</bean>
<bean id="oauthWebExpressionHandler"
class="org.springframework.security.oauth2.provider.expression.OAuth2WebSecurityExpressionHandler">
</bean>
<bean id="accessDecisionManager"
class="org.springframework.security.access.vote.UnanimousBased">
<constructor-arg>
<list>
<bean class="org.springframework.security.web.access.expression.WebExpressionVoter">
<property name="expressionHandler" ref="oauthWebExpressionHandler" />
</bean>
<bean class="org.springframework.security.access.vote.AuthenticatedVoter" />
</list>
</constructor-arg>
</bean>
<sec:authentication-manager alias="authenticationManager"/>
<oauth:resource-server id="resourceServerFilter"
resource-id="springsec" token-services-ref="offlineTokenServices" />
<bean id="oauthAccessDeniedHandler"
class="org.springframework.security.oauth2.provider.error.OAuth2AccessDeniedHandler" />
<!-- ... also some other elements here ... -->
</beans>
It was necessary to add the following to pom.xml:
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-messaging</artifactId>
<version>4.1.2.RELEASE</version>
</dependency>
<dependency>
<groupId>org.springframework</groupId>
<artifactId>spring-messaging</artifactId>
<version>${spring.version}</version>
</dependency>
<dependency>
<groupId>org.springframework</groupId>
<artifactId>spring-websocket</artifactId>
<version>${spring.version}</version>
</dependency>
And this to spring-security.xml:
<bean id="springSecurityMessagePathMatcher"
class="org.springframework.util.AntPathMatcher"/>
Now Spring does not throw an exception at startup and parses spring-security.xml fine, but it does not work either. SecurityContextHolder.getContext().getAuthentication() still returns null.
I'm doing with spring security. When i browser http://localhost:8080/rest/user/json/quypham then occur following error:
[WARNING] /rest/user/json/quypham java.lang.IllegalArgumentException:
Failed to evaluate expression 'ROLE_ADMIN'
at org.springframework.security.access.expression.ExpressionUtils.evalua
teAsBoolean(ExpressionUtils.java:15)
at org.springframework.security.web.access.expression.WebExpressionVoter
.vote(WebExpressionVoter.java:36)
at org.springframework.security.web.access.expression.WebExpressionVoter
.vote(WebExpressionVoter.java:18)
at org.springframework.security.access.vote.AffirmativeBased.decide(Affi
rmativeBased.java:62)
at org.springframework.security.access.intercept.AbstractSecurityInterce
ptor.beforeInvocation(AbstractSecurityInterceptor.java:232)
at org.springframework.security.web.access.intercept.FilterSecurityInter
Caused by:
org.springframework.expression.spel.SpelEvaluationException: EL1008E:
(pos 0): Property or field 'ROLE_ADMIN' cannot be found on object of
type 'org.s
pringframework.security.web.access.expression.WebSecurityExpressionRoot'
- maybe not public?
at org.springframework.expression.spel.ast.PropertyOrFieldReference.read
Property(PropertyOrFieldReference.java:215)
at org.springframework.expression.spel.ast.PropertyOrFieldReference.getV
alueInternal(PropertyOrFieldReference.java:85)
at org.springframework.expression.spel.ast.PropertyOrFieldReference.getV
alueInternal(PropertyOrFieldReference.java:78)
at org.springframework.expression.spel.ast.SpelNodeImpl.getTypedValue(Sp
elNodeImpl.java:114)
at org.springframework.expression.spel.standard.SpelExpression.getValue(
SpelExpression.java:105)
at org.springframework.security.access.expression.ExpressionUtils.evalua
I think to have wrong somthing in file userservice-servlet.xml, please let me know.
Here file userservice-servlet.xml
<security:http>
<security:http-basic/>
<security:intercept-url pattern="/rest/**" access="ROLE_ADMIN"/>
</security:http>
<security:authentication-manager alias="authenticationManager">
<security:authentication-provider>
<security:user-service>
<security:user name="datpham" password="Dat12345" authorities="ROLE_ADMIN"/>
<security:user name="hoaipham" password="Hoai12345" authorities="ROLE_USER"/>
</security:user-service>
</security:authentication-provider>
</security:authentication-manager>
I have replace spring-security-web and spring-security-config version 4.0.3 to version 3.2.4.. Everything run ok, But i don't understand why ????
I work with ADFS 2.0 by SAML using spring-security-saml2-core (1.0.0.RC2). I use HTTP-POST binding. But I have a problem with SingleLogout.
Application receive LogoutRequest
<samlp:LogoutRequest
xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
Consent="urn:oasis:names:tc:SAML:2.0:consent:unspecified"
Destination="https://myhost:8443/my/saml/SingleLogout/alias/defaultAlias"
ID="_438dcef8-cd64-4e04-8e11-e87705f26b6c"
IssueInstant="2014-08-01T10:53:14.641Z"
NotOnOrAfter="2014-08-01T10:58:14.641Z"
Version="2.0">
<Issuer xmlns="urn:oasis:names:tc:SAML:2.0:assertion">https://adfs-server.local/adfs/services/trust</Issuer>
<NameID xmlns="urn:oasis:names:tc:SAML:2.0:assertion">nata</NameID>
<samlp:SessionIndex>_34e48828-a6b5-47c2-96fd-595f9d0a88b7</samlp:SessionIndex>
</samlp:LogoutRequest>
And send LogoutResponse
<saml2p:LogoutResponse
xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"
Destination="https://adfs-server.local/adfs/ls/"
ID="a2ddb014h7d7558f3cd5hfge981bicf"
InResponseTo="_438dcef8-cd64-4e04-8e11-e87705f26b6c"
IssueInstant="2014-08-01T10:53:43.808Z"
Version="2.0">
<saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">https://myhost:8443/my/saml/metadata/alias/defaultAlias</saml2:Issuer>
<saml2p:Status>
<saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
</saml2p:Status>
</saml2p:LogoutResponse>
But ADFS throw error of closing SAML-endpoint:
MSIS7074: SAML authentication request for the WebSSO profile must specify an issuer with no NameQualifier, SPNameQualifier or SPProvidedId properties.
My configuration for SingleLogout:
<bean id="samlFilter" class="org.springframework.security.web.FilterChainProxy">
<security:filter-chain-map request-matcher="ant">
<security:filter-chain pattern="/saml/login/**" filters="samlEntryPoint"/>
<security:filter-chain pattern="/saml/logout/**" filters="samlLogoutFilter"/>
<security:filter-chain pattern="/saml/metadata/**" filters="metadataDisplayFilter"/>
<security:filter-chain pattern="/saml/SSO/**" filters="samlWebSSOProcessingFilter"/>
<security:filter-chain pattern="/saml/SingleLogout/**" filters="samlLogoutProcessingFilter"/>
</security:filter-chain-map>
</bean>
<!-- Filter processing incoming logout messages -->
<!-- First argument determines URL user will be redirected to after successful global logout -->
<bean id="samlLogoutProcessingFilter" class="org.springframework.security.saml.SAMLLogoutProcessingFilter">
<constructor-arg type="org.springframework.security.web.authentication.logout.LogoutSuccessHandler" ref="successLogoutHandler"/>
<constructor-arg>
<array value-type="org.springframework.security.web.authentication.logout.LogoutHandler">
<ref bean="logoutHandler"/>
</array>
</constructor-arg>
</bean>
<bean id="successLogoutHandler" class="org.springframework.security.web.authentication.logout.SimpleUrlLogoutSuccessHandler">
<property name="defaultTargetUrl" value="/"/>
</bean>
<!-- Logout handler terminating local session -->
<bean id="logoutHandler" class="org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler">
<property name="invalidateHttpSession" value="false"/>
</bean>
:-) ouch this was confusing..... And cross-posting??
First of all: My ADFS servers 2.x, on S2008(R2) and S2012 do not have that message. So I believe it cannot be ADFS 2.0. I assume that you are working on the ADFS server on Windows Server 2012R2 (which is never identified as 2.0). :-(
The message (about AuthnRequest vs. LogoutResponse) does seem totally out of place. It looks like you ran in to a minor (super confusing) bug of ADFS on S2012R2. Because ADFS 2.0 would have said something else in that case. It would have said [in the ValidateSignatureRequirements(SamlMessage) method]:
"MSIS1014: SAML LogoutRequest and LogoutResponse messages must be signed when using SAML HTTP Redirect or HTTP POST binding."
So you have a bug to file at Microsoft (a reference to this description could help you). Meanwhile you should ask the SP to sign the LogoutResponse. I am somewhat surprised that ADFS did not sign the LogoutRequest. It normally does sign the LogoutRequest.
paullem is right. Our Windows Server is 2012 R2, ADFS 3.0.
SAML LogoutRequest messages must be signed. Error was fixed. We set parameter requireLogoutResponseSigned in ''true" in ExtendedMetadata.
<bean class="org.springframework.security.saml.metadata.ExtendedMetadata">
<property name="local" value="false" />
<property name="idpDiscoveryEnabled" value="false" />
<property name="requireLogoutResponseSigned" value="true"/>
</bean>
I am trying to setup Spring 3 security using JDBC auth. Everything is working fine apart from when I try to specify multiple access roles to an intercept-url. Eg I want anyone with the roles ROLE_USER and ROLE_ADMIN to be able to access all pages, I use the follwoing line in my spring config file -
<security:intercept-url pattern="/**" access="ROLE_USER, ROLE_ADMIN" />
However this throws the following error -
org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.springframework.security.web.access.intercept.FilterSecurityInterceptor#0': Invocation of init method failed; nested exception is java.lang.IllegalArgumentException: Unsupported configuration attributes: [ ROLE_ADMIN]
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1401)
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:512)
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:450)
at org.springframework.beans.factory.support.AbstractBeanFactory$1.getObject(AbstractBeanFactory.java:289)
at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:222)
at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:286)
at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:188)
at org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingletons(DefaultListableBeanFactory.java:558)
at org.springframework.context.support.AbstractApplicationContext.finishBeanFactoryInitialization(AbstractApplicationContext.java:852)
at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:422)
at org.springframework.web.context.ContextLoader.createWebApplicationContext(ContextLoader.java:261)
at org.springframework.web.context.ContextLoader.initWebApplicationContext(ContextLoader.java:192)
at org.springframework.web.context.ContextLoaderListener.contextInitialized(ContextLoaderListener.java:47)
at org.apache.catalina.core.StandardContext.listenerStart(StandardContext.java:3843)
at org.apache.catalina.core.StandardContext.start(StandardContext.java:4342)
at org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1045)
at org.apache.catalina.core.StandardHost.start(StandardHost.java:719)
at org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1045)
at org.apache.catalina.core.StandardEngine.start(StandardEngine.java:443)
at org.apache.catalina.core.StandardService.start(StandardService.java:516)
at org.apache.catalina.core.StandardServer.start(StandardServer.java:710)
at org.apache.catalina.startup.Catalina.start(Catalina.java:578)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at org.apache.catalina.startup.Bootstrap.start(Bootstrap.java:288)
at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:413)
Caused by: java.lang.IllegalArgumentException: Unsupported configuration attributes: [ ROLE_ADMIN]
at org.springframework.security.access.intercept.AbstractSecurityInterceptor.afterPropertiesSet(AbstractSecurityInterceptor.java:154)
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.invokeInitMethods(AbstractAutowireCapableBeanFactory.java:1460)
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1398)
... 27 more
If specify that only one of the roles can access any url then it is fine (fine for either role). Changing the order in which i specify the roles makes no difference either. It is as though something has changed in Spring Security 3 that now cannot handle mulitple access roles being specified.
I have successfully got this working previously with Spring Security 2, and am using virtually the same configuration. Any ideas?
My security config file is listed below -
<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:security="http://www.springframework.org/schema/security"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
http://www.springframework.org/schema/security
http://www.springframework.org/schema/security/spring-security-3.0.xsd">
<security:http auto-config="true" access-denied-page="/denied.jsp" >
<security:form-login
default-target-url="/app/home"
always-use-default-target="true" />
<security:intercept-url pattern="/**" access="ROLE_USER, ROLE_ADMIN" />
<security:logout invalidate-session="true" logout-url="/logout" logout-success-url="" />
</security:http>
<security:authentication-manager>
<security:authentication-provider>
<security:jdbc-user-service data-source-ref="dataSource"
users-by-username-query='select "username", "password", "enabled"
from users where "username" = ?'
authorities-by-username-query='select "username", "authority" from user_roles where "username" = ?' />
</security:authentication-provider>
</security:authentication-manager>
</beans>
I had the same issue but used expressions to get around this issue:
You should embed
use-expressions="true"
in your existing config. So:
<security:http auto-config="true" access-denied-page="/denied.jsp" >
becomes
<security:http auto-config="true" access-denied-page="/denied.jsp" use-expressions="true">
And then:
<security:intercept-url pattern="/**" access="hasAnyRole('ROLE_USER','ROLE_ADMIN')" />
I am not sure about this problem, actually I am using it currently in my project and don't see an issue. try removing the space after the "," I mean try using ROLE_USER,ROLE_ADMIN
I had the same problem when was trying to migrate from Spring 3.x to 4.x. Finally I found that parameter "use-expressions" of "http" tag became "true" by default in Spring 4.x instead of false (as it was in old versions).
P.S. This question is very old for now, but I found this in Google. So somebody else can find it too and this info might be useful then.
I had the same problem and found the answer here.
Use that line to grant access to user with both roles: <security:intercept-url pattern="/**" access="hasRole('ROLE_USER') and hasRole('ROLE_ADMIN')" />
If you want to grant access to user with one of the listed roles, use: <security:intercept-url pattern="/**" access="hasAnyRole('ROLE_USER', 'ROLE_ADMIN')" />
Also, you need to add ability to use SpEL in your security *.xml, add use-expressions="true" to <http> tag.
I decided to downgrade to Spring Security 2.0.5 without changing anything else to check whether this was a bug in 3, and lo-and-behold it was!
I think I also found a related open bug here - https://jira.springsource.org/browse/SEC-1342
Solution - use 2.0.5 if want to use this feature.