Custom Login Form in Spring Security

[Soheil Tayari]

I have a problem with Spring Security custom login form. I think I'm following the API example but the login just don't work. Here's my simple login page (I'm using Struts2):

...
<s:url value="j_spring_security_check" var="securityCheck"/>
<s:form action="%{securityCheck}" method="POST">
    <s:textfield name="j_username"/>
    <s:password name="j_password"/>
    <s:submit/>
</s:form>
...

And here is my application context:

...
    <http auto-config="true">
        <intercept-url pattern="/secure/*" access="ROLE_USER"/>
        <intercept-url pattern="/SpringLogin" requires-channel="https" access="IS_AUTHENTICATED_ANONYMOUSLY"/>
        <form-login login-page="/SpringLogin"/> (It's a Struts2 action which brings up the login form above)
        <port-mappings>
            <port-mapping http="8081" https="8443"/>
        </port-mappings>
        <session-management>
            <concurrency-control max-sessions="1"/>
        </session-management>
    </http>

    <authentication-manager>
        <authentication-provider>
            <user-service>
                <user name="jimi" password="1234" authorities="ROLE_USER, ROLE_ADMIN"/>
                <user name="john" password="1234" authorities="ROLE_USER"/>
            </user-service>
        </authentication-provider>
    </authentication-manager>
...

Once I hit the submit the page just gets reloaded. I tried this even without Struts2 tags and with plain HTML. I don't know what I'm doing wrong here.

[Mark Spritzler]

It looks like you are securing your login page. So you have to be logged in to get to the login page.


<intercept-url pattern="/SpringLogin" requires-channel="https" access="IS_AUTHENTICATED_ANONYMOUSLY"/>
<form-login login-page="/SpringLogin"/> (It's a Struts2 action which brings up the login form above)

Basically the "IS_AUTHENTICATED_ANONYMOUSLY" means they have to be logged in.

Mark

[Soheil Tayari]

Mark Spritzler wrote:It looks like you are securing your login page. So you have to be logged in to get to the login page.


<intercept-url pattern="/SpringLogin" requires-channel="https" access="IS_AUTHENTICATED_ANONYMOUSLY"/>
<form-login login-page="/SpringLogin"/> (It's a Struts2 action which brings up the login form above)

Basically the "IS_AUTHENTICATED_ANONYMOUSLY" means they have to be logged in.

Mark

Thank you Mark. You're right I set the filters to "none" and it worked. But How can I achieve the secure channel for that URL?

[Mark Spritzler]

Won't just

<intercept-url pattern="/SpringLogin" requires-channel="https" filters="none/>

work?

Mark">