Spring Security sends AuthenticationEvent twice - jsf-2

Question

I've embeded Spring Security in my existing JSF 2 application running on Glassfish 3.1.2.
To do it, I used approach using forwarding to /j_spring_security_check, described in the following article:
http://ocpsoft.org/java/acegi-spring-security-jsf-login-page/
My code is almost 1-to-1 copy of the code of the article.
Here is login.xhtml:
<ui:composition xmlns="http://www.w3.org/1999/xhtml"
xmlns:ui="http://java.sun.com/jsf/facelets"
xmlns:h="http://java.sun.com/jsf/html"
xmlns:f="http://java.sun.com/jsf/core"
template="/template/template.xhtml">
<ui:define name="content">
<h:form id="loginForm" prependId="false">
<h:panelGrid columns="2">
<h:outputText value="#{msg['loginDialog.login']}: " />
<h:inputText id="j_username" required="true" />
<h:outputText value="#{msg['loginDialog.password']}" />
<h:inputSecret id="j_password" required="true" />
</h:panelGrid>
<h:commandButton type="submit"
action="#{loginBean.doLogin}"
value="#{msg['loginDialog.register']}" />
</h:form>
</ui:define>
Here is my login bean:
public class LoginBean implements Serializable {
public String doLogin() throws IOException, ServletException {
ExternalContext context = FacesContext.getCurrentInstance().getExternalContext();
Map map = FacesContext.getCurrentInstance().getExternalContext().getRequestParameterMap();
String j_user = (String) map.get("j_username");
String j_pwd = (String) map.get("j_password");
RequestDispatcher dispatcher = ((ServletRequest) context.getRequest()).getRequestDispatcher("/j_spring_security_check?j_username=" + j_user + "&j_password=" + j_pwd);
dispatcher.forward((ServletRequest) context.getRequest(), (ServletResponse) context.getResponse());
FacesContext.getCurrentInstance().responseComplete();
return null;
}
}
And this is declaration of security context:
<context:component-scan base-package="com.mycompany.package"/>
<security:global-method-security
secured-annotations="enabled">
</security:global-method-security>
<security:http auto-config="true"
access-denied-page="/accessDenied.xhtml">
<security:intercept-url pattern="/*"
access="ROLE_VIEWER,ROLE_CREATOR,ROLE_ADMIN" />
<security:form-login
login-processing-url="/j_spring_security_check"
login-page="/login.xhtml"
default-target-url="/main.xhtml"
authentication-failure-url="/login.xhtml" />
<security:logout logout-url="/logout*"
logout-success-url="/login.xhtml"
invalidate-session="true"/>
</security:http>
<security:authentication-manager>
<security:authentication-provider user-service-ref='userDetailsService'/>
</security:authentication-manager>
Then I created a listener to catch all AbstractAuthenticationEvent:
public class AuthenticationListener implements
ApplicationListener<AbstractAuthenticationEvent> {
private final static Log log = LogFactory.getLog(AuthenticationListener.class);
#Override
public void onApplicationEvent(AbstractAuthenticationEvent e) {
// some processing
}
}
The problem is: after each successefull login, the AuthenticationEvent is generated twice, not once, as it could be suggested.
Would somebody explain, what is wrong ?
Some addition: the event is generated twice, because (I don't understand why), there is automatic logout right after login and then new authentication. Here is the snippet from log:
INFO: ** trying to retrieve user
INFO: ** user is found
INFO: Hibernate: insert into audit (EVENT_TYPE, EVENT_TIMESTAMP,
USER_ID) values (?, ?, ?)
INFO: Current Session destroyed :3ee7b951888eb8920d07fefceaec by
org.apache.catalina.session.StandardSessionFacade#57ac8e Logging out
user...
INFO: Logging out
INFO: Current Session created : 3f1fd377302220f2f27313c06cdc at Mon
Jun 25 16:00:57 CEST 2012 by
org.apache.catalina.session.StandardSessionFacade#912e6a
INFO: Hibernate: insert into audit (EVENT_TYPE, EVENT_TIMESTAMP,
USER_ID) values (?, ?, ?)
Here is the the log with debugging on (sorry for the long list):
26 Jun 2012 12:47:58,703 DEBUG HttpSessionSecurityContextRepository : SecurityContext is empty or contents are anonymous - context will not be stored in HttpSession.
26 Jun 2012 12:47:58,703 DEBUG SecurityContextPersistenceFilter : SecurityContextHolder now cleared, as request processing completed
26 Jun 2012 12:48:04,078 DEBUG FilterChainProxy : /login.xhtml at position 1 of 10 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter'
26 Jun 2012 12:48:04,078 DEBUG HttpSessionSecurityContextRepository : HttpSession returned null object for SPRING_SECURITY_CONTEXT
26 Jun 2012 12:48:04,078 DEBUG HttpSessionSecurityContextRepository : No SecurityContext was available from the HttpSession: org.apache.catalina.session.StandardSessionFacade#10fbf9. A new one will be created.
26 Jun 2012 12:48:04,078 DEBUG FilterChainProxy : /login.xhtml at position 2 of 10 in additional filter chain; firing Filter: 'LogoutFilter'
26 Jun 2012 12:48:04,078 DEBUG FilterChainProxy : /login.xhtml at position 3 of 10 in additional filter chain; firing Filter: 'UsernamePasswordAuthenticationFilter'
26 Jun 2012 12:48:04,078 DEBUG FilterChainProxy : /login.xhtml at position 4 of 10 in additional filter chain; firing Filter: 'BasicAuthenticationFilter'
26 Jun 2012 12:48:04,078 DEBUG FilterChainProxy : /login.xhtml at position 5 of 10 in additional filter chain; firing Filter: 'RequestCacheAwareFilter'
26 Jun 2012 12:48:04,078 DEBUG DefaultSavedRequest : pathInfo: both null (property equals)
26 Jun 2012 12:48:04,078 DEBUG DefaultSavedRequest : queryString: both null (property equals)
26 Jun 2012 12:48:04,078 DEBUG DefaultSavedRequest : requestURI: arg1=/mdmd/; arg2=/mdmd/login.xhtml (property not equals)
26 Jun 2012 12:48:04,093 DEBUG HttpSessionRequestCache : saved request doesn't match
26 Jun 2012 12:48:04,093 DEBUG FilterChainProxy : /login.xhtml at position 6 of 10 in additional filter chain; firing Filter: 'SecurityContextHolderAwareRequestFilter'
26 Jun 2012 12:48:04,093 DEBUG FilterChainProxy : /login.xhtml at position 7 of 10 in additional filter chain; firing Filter: 'AnonymousAuthenticationFilter'
26 Jun 2012 12:48:04,093 DEBUG AnonymousAuthenticationFilter : Populated SecurityContextHolder with anonymous token: 'org.springframework.security.authentication.AnonymousAuthenticationToken#6faba4dc: Principal: anonymousUser; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails#fffed504: RemoteIpAddress: 127.0.0.1; SessionId: 7f9b291fe5d980eba4639fdcb232; Granted Authorities: ROLE_ANONYMOUS'
26 Jun 2012 12:48:04,093 DEBUG FilterChainProxy : /login.xhtml at position 8 of 10 in additional filter chain; firing Filter: 'SessionManagementFilter'
26 Jun 2012 12:48:04,093 DEBUG FilterChainProxy : /login.xhtml at position 9 of 10 in additional filter chain; firing Filter: 'ExceptionTranslationFilter'
26 Jun 2012 12:48:04,093 DEBUG FilterChainProxy : /login.xhtml at position 10 of 10 in additional filter chain; firing Filter: 'FilterSecurityInterceptor'
26 Jun 2012 12:48:04,093 DEBUG AntPathRequestMatcher : Checking match of request : '/login.xhtml'; against '/accessdenied*'
26 Jun 2012 12:48:04,093 DEBUG AntPathRequestMatcher : Checking match of request : '/login.xhtml'; against '/login*'
26 Jun 2012 12:48:04,093 DEBUG FilterSecurityInterceptor : Secure object: FilterInvocation: URL: /login.xhtml; Attributes: [IS_AUTHENTICATED_ANONYMOUSLY]
26 Jun 2012 12:48:04,093 DEBUG FilterSecurityInterceptor : Previously Authenticated: org.springframework.security.authentication.AnonymousAuthenticationToken#6faba4dc: Principal: anonymousUser; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails#fffed504: RemoteIpAddress: 127.0.0.1; SessionId: 7f9b291fe5d980eba4639fdcb232; Granted Authorities: ROLE_ANONYMOUS
26 Jun 2012 12:48:04,093 DEBUG AffirmativeBased : Voter: org.springframework.security.access.vote.RoleVoter#88fcb2, returned: 0
26 Jun 2012 12:48:04,093 DEBUG AffirmativeBased : Voter: org.springframework.security.access.vote.AuthenticatedVoter#18620f5, returned: 1
26 Jun 2012 12:48:04,093 DEBUG FilterSecurityInterceptor : Authorization successful
26 Jun 2012 12:48:04,093 DEBUG FilterSecurityInterceptor : RunAsManager did not change Authentication object
26 Jun 2012 12:48:04,093 DEBUG FilterChainProxy : /login.xhtml reached end of additional filter chain; proceeding with original chain
26 Jun 2012 12:48:04,281 DEBUG FilterChainProxy : /j_spring_security_check?j_username=admin&j_password=admin at position 1 of 10 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter'
26 Jun 2012 12:48:04,281 DEBUG FilterChainProxy : /j_spring_security_check?j_username=admin&j_password=admin at position 2 of 10 in additional filter chain; firing Filter: 'LogoutFilter'
26 Jun 2012 12:48:04,281 DEBUG FilterChainProxy : /j_spring_security_check?j_username=admin&j_password=admin at position 3 of 10 in additional filter chain; firing Filter: 'UsernamePasswordAuthenticationFilter'
26 Jun 2012 12:48:04,281 DEBUG UsernamePasswordAuthenticationFilter : Request is to process authentication
26 Jun 2012 12:48:04,296 DEBUG ProviderManager : Authentication attempt using org.springframework.security.authentication.dao.DaoAuthenticationProvider
26 Jun 2012 12:48:04,296 INFO UserDetailsServiceImpl : ** trying to retrieve user
26 Jun 2012 12:48:06,203 INFO UserDetailsServiceImpl : ** user is found
26 Jun 2012 12:48:06,421 WARN LoggerListener : Authentication event AuthenticationSuccessEvent: admin; details: org.springframework.security.web.authentication.WebAuthenticationDetails#fffed504: RemoteIpAddress: 127.0.0.1; SessionId: 7f9b291fe5d980eba4639fdcb232
26 Jun 2012 12:48:06,421 DEBUG SessionFixationProtectionStrategy : Invalidating session with Id '7f9b291fe5d980eba4639fdcb232' and migrating attributes.
26 Jun 2012 12:48:06,468 DEBUG SessionFixationProtectionStrategy : Started new session: 7f9eb44f14616034a4b5169d6ac6
26 Jun 2012 12:48:06,468 DEBUG UsernamePasswordAuthenticationFilter : Authentication success. Updating SecurityContextHolder to contain: org.springframework.security.authentication.UsernamePasswordAuthenticationToken#be0d966d: Principal: org.mycompany.domain.security.UserDetailsImpl#1508a8b; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails#fffed504: RemoteIpAddress: 127.0.0.1; SessionId: 7f9b291fe5d980eba4639fdcb232; Granted Authorities: ROLE_ADMIN
26 Jun 2012 12:48:06,531 WARN LoggerListener : Authentication event InteractiveAuthenticationSuccessEvent: admin; details: org.springframework.security.web.authentication.WebAuthenticationDetails#fffed504: RemoteIpAddress: 127.0.0.1; SessionId: 7f9b291fe5d980eba4639fdcb232
26 Jun 2012 12:48:06,531 DEBUG SavedRequestAwareAuthenticationSuccessHandler : Redirecting to DefaultSavedRequest Url: 'http://localhost:9080/mdmd/'
26 Jun 2012 12:48:06,531 DEBUG DefaultRedirectStrategy : Redirecting to 'http://localhost:9080/mdmd/'
26 Jun 2012 12:48:06,531 DEBUG HttpSessionSecurityContextRepository : SecurityContext stored to HttpSession: 'org.springframework.security.core.context.SecurityContextImpl#be0d966d: Authentication: org.springframework.security.authentication.UsernamePasswordAuthenticationToken#be0d966d: Principal: org.mycompany.domain.security.UserDetailsImpl#1508a8b; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails#fffed504: RemoteIpAddress: 127.0.0.1; SessionId: 7f9b291fe5d980eba4639fdcb232; Granted Authorities: ROLE_ADMIN'
26 Jun 2012 12:48:06,562 DEBUG ExceptionTranslationFilter : Chain processed normally
26 Jun 2012 12:48:06,562 DEBUG SecurityContextPersistenceFilter : SecurityContextHolder now cleared, as request processing completed
26 Jun 2012 12:48:06,593 DEBUG FilterChainProxy : /index.jsp at position 1 of 10 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter'
26 Jun 2012 12:48:06,609 DEBUG HttpSessionSecurityContextRepository : Obtained a valid SecurityContext from SPRING_SECURITY_CONTEXT: 'org.springframework.security.core.context.SecurityContextImpl#be0d966d: Authentication: org.springframework.security.authentication.UsernamePasswordAuthenticationToken#be0d966d: Principal: org.mycompany.domain.security.UserDetailsImpl#1508a8b; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails#fffed504: RemoteIpAddress: 127.0.0.1; SessionId: 7f9b291fe5d980eba4639fdcb232; Granted Authorities: ROLE_ADMIN'
26 Jun 2012 12:48:06,609 DEBUG FilterChainProxy : /index.jsp at position 2 of 10 in additional filter chain; firing Filter: 'LogoutFilter'
26 Jun 2012 12:48:06,609 DEBUG FilterChainProxy : /index.jsp at position 3 of 10 in additional filter chain; firing Filter: 'UsernamePasswordAuthenticationFilter'
26 Jun 2012 12:48:06,609 DEBUG FilterChainProxy : /index.jsp at position 4 of 10 in additional filter chain; firing Filter: 'BasicAuthenticationFilter'
26 Jun 2012 12:48:06,609 DEBUG FilterChainProxy : /index.jsp at position 5 of 10 in additional filter chain; firing Filter: 'RequestCacheAwareFilter'
26 Jun 2012 12:48:06,609 DEBUG DefaultSavedRequest : pathInfo: both null (property equals)
26 Jun 2012 12:48:06,609 DEBUG DefaultSavedRequest : queryString: both null (property equals)
26 Jun 2012 12:48:06,609 DEBUG DefaultSavedRequest : requestURI: arg1=/mdmd/; arg2=/mdmd/ (property equals)
26 Jun 2012 12:48:06,609 DEBUG DefaultSavedRequest : serverPort: arg1=9080; arg2=9080 (property equals)
26 Jun 2012 12:48:06,609 DEBUG DefaultSavedRequest : requestURL: arg1=http://localhost:9080/mdmd/; arg2=http://localhost:9080/mdmd/ (property equals)
26 Jun 2012 12:48:06,609 DEBUG DefaultSavedRequest : scheme: arg1=http; arg2=http (property equals)
26 Jun 2012 12:48:06,609 DEBUG DefaultSavedRequest : serverName: arg1=localhost; arg2=localhost (property equals)
26 Jun 2012 12:48:06,609 DEBUG DefaultSavedRequest : contextPath: arg1=/mdmd; arg2=/mdmd (property equals)
26 Jun 2012 12:48:06,609 DEBUG DefaultSavedRequest : servletPath: arg1=/index.jsp; arg2=/index.jsp (property equals)
26 Jun 2012 12:48:06,609 DEBUG HttpSessionRequestCache : Removing DefaultSavedRequest from session if present
26 Jun 2012 12:48:06,609 DEBUG FilterChainProxy : /index.jsp at position 6 of 10 in additional filter chain; firing Filter: 'SecurityContextHolderAwareRequestFilter'
26 Jun 2012 12:48:06,609 DEBUG FilterChainProxy : /index.jsp at position 7 of 10 in additional filter chain; firing Filter: 'AnonymousAuthenticationFilter'
26 Jun 2012 12:48:06,609 DEBUG AnonymousAuthenticationFilter : SecurityContextHolder not populated with anonymous token, as it already contained: 'org.springframework.security.authentication.UsernamePasswordAuthenticationToken#be0d966d: Principal: org.mycompany.domain.security.UserDetailsImpl#1508a8b; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails#fffed504: RemoteIpAddress: 127.0.0.1; SessionId: 7f9b291fe5d980eba4639fdcb232; Granted Authorities: ROLE_ADMIN'
26 Jun 2012 12:48:06,609 DEBUG FilterChainProxy : /index.jsp at position 8 of 10 in additional filter chain; firing Filter: 'SessionManagementFilter'
26 Jun 2012 12:48:06,609 DEBUG FilterChainProxy : /index.jsp at position 9 of 10 in additional filter chain; firing Filter: 'ExceptionTranslationFilter'
26 Jun 2012 12:48:06,609 DEBUG FilterChainProxy : /index.jsp at position 10 of 10 in additional filter chain; firing Filter: 'FilterSecurityInterceptor'
26 Jun 2012 12:48:06,609 DEBUG AntPathRequestMatcher : Checking match of request : '/index.jsp'; against '/accessdenied*'
26 Jun 2012 12:48:06,625 DEBUG AntPathRequestMatcher : Checking match of request : '/index.jsp'; against '/login*'
26 Jun 2012 12:48:06,625 DEBUG AntPathRequestMatcher : Checking match of request : '/index.jsp'; against '/sessionexpired*'
26 Jun 2012 12:48:06,625 DEBUG AntPathRequestMatcher : Checking match of request : '/index.jsp'; against '/*'
26 Jun 2012 12:48:06,625 DEBUG FilterSecurityInterceptor : Secure object: FilterInvocation: URL: /index.jsp; Attributes: [ROLE_AVIEWER, ROLE_BVIEWER, ROLE_ACREATOR, ROLE_BCREATOR, ROLE_AREGISTER, ROLE_BREGISTER, ROLE_ADMIN]
26 Jun 2012 12:48:06,625 DEBUG FilterSecurityInterceptor : Previously Authenticated: org.springframework.security.authentication.UsernamePasswordAuthenticationToken#be0d966d: Principal: org.mycompany.domain.security.UserDetailsImpl#1508a8b; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails#fffed504: RemoteIpAddress: 127.0.0.1; SessionId: 7f9b291fe5d980eba4639fdcb232; Granted Authorities: ROLE_ADMIN
26 Jun 2012 12:48:06,625 DEBUG AffirmativeBased : Voter: org.springframework.security.access.vote.RoleVoter#88fcb2, returned: 1
26 Jun 2012 12:48:06,625 DEBUG FilterSecurityInterceptor : Authorization successful
26 Jun 2012 12:48:06,625 DEBUG FilterSecurityInterceptor : RunAsManager did not change Authentication object
26 Jun 2012 12:48:06,625 DEBUG FilterChainProxy : /index.jsp reached end of additional filter chain; proceeding with original chain
26 Jun 2012 12:48:11,953 DEBUG FilterChainProxy : /main.xhtml at position 1 of 10 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter'
26 Jun 2012 12:48:11,953 DEBUG FilterChainProxy : /main.xhtml at position 2 of 10 in additional filter chain; firing Filter: 'LogoutFilter'
26 Jun 2012 12:48:11,953 DEBUG FilterChainProxy : /main.xhtml at position 3 of 10 in additional filter chain; firing Filter: 'UsernamePasswordAuthenticationFilter'
26 Jun 2012 12:48:11,953 DEBUG FilterChainProxy : /main.xhtml at position 4 of 10 in additional filter chain; firing Filter: 'BasicAuthenticationFilter'
26 Jun 2012 12:48:11,953 DEBUG FilterChainProxy : /main.xhtml at position 5 of 10 in additional filter chain; firing Filter: 'RequestCacheAwareFilter'
26 Jun 2012 12:48:11,953 DEBUG FilterChainProxy : /main.xhtml at position 6 of 10 in additional filter chain; firing Filter: 'SecurityContextHolderAwareRequestFilter'
26 Jun 2012 12:48:11,953 DEBUG FilterChainProxy : /main.xhtml at position 7 of 10 in additional filter chain; firing Filter: 'AnonymousAuthenticationFilter'
26 Jun 2012 12:48:11,953 DEBUG AnonymousAuthenticationFilter : SecurityContextHolder not populated with anonymous token, as it already contained: 'org.springframework.security.authentication.UsernamePasswordAuthenticationToken#be0d966d: Principal: org.mycompany.domain.security.UserDetailsImpl#1508a8b; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails#fffed504: RemoteIpAddress: 127.0.0.1; SessionId: 7f9b291fe5d980eba4639fdcb232; Granted Authorities: ROLE_ADMIN'
26 Jun 2012 12:48:11,953 DEBUG FilterChainProxy : /main.xhtml at position 8 of 10 in additional filter chain; firing Filter: 'SessionManagementFilter'
26 Jun 2012 12:48:11,953 DEBUG FilterChainProxy : /main.xhtml at position 9 of 10 in additional filter chain; firing Filter: 'ExceptionTranslationFilter'
26 Jun 2012 12:48:11,953 DEBUG FilterChainProxy : /main.xhtml at position 10 of 10 in additional filter chain; firing Filter: 'FilterSecurityInterceptor'
26 Jun 2012 12:48:11,953 DEBUG FilterChainProxy : /main.xhtml reached end of additional filter chain; proceeding with original chain