Ergin Er

I managed to make option 1 work for me.
It appeared I was using wrong realm in AuthName definition.

I is still remarkable that the application behaves strange when Apaches basic authentication is used.

We wanted to secure our application (<url>/tst) by using apache2 basic authentication. Implementation in apache2 was straight forward and worked. The problem is the application. Somehow if I would login to the website of the application, Spring Security is initiated, so that I get anothe login popup. It seems the basic authentication of apache is picked up by spring security. I would like to disable that, since <url>/tst/home.html is not supposed to be secured.

I've tried couple of options, but none seem to work. Maybe someone can help me out.

Here is the basic configuration of Spring security in my app:
<security:global-method-security secured-annotations="enabled"> </security:global-method-security> <security:http auto-config="true"> <security:intercept-url pattern='/index.jsp' access="IS_AUTHENTICATED_ANONYMOUSLY"/> <security:intercept-url pattern='/home.html' access="IS_AUTHENTICATED_ANONYMOUSLY"/> <security:intercept-url pattern='/post_versturen.html' access="IS_AUTHENTICATED_ANONYMOUSLY"/> <security:intercept-url pattern="/aanmelden.html" access="IS_AUTHENTICATED_ANONYMOUSLY"/> <security:intercept-url pattern="/logoutsucces.html" access="IS_AUTHENTICATED_ANONYMOUSLY"/> <security:intercept-url pattern="/login.html" access="IS_AUTHENTICATED_ANONYMOUSLY"/> <security:intercept-url pattern="/loginfailed.html" access="IS_AUTHENTICATED_ANONYMOUSLY"/> <security:intercept-url pattern="/valideren.html" access="IS_AUTHENTICATED_ANONYMOUSLY"/> <security:intercept-url pattern="/nieuwe_gebruikers_mail.html" access="IS_AUTHENTICATED_ANONYMOUSLY"/> <security:intercept-url pattern='/js/**' access="IS_AUTHENTICATED_ANONYMOUSLY"/> <security:intercept-url pattern='/css/**' access="IS_AUTHENTICATED_ANONYMOUSLY"/> <security:intercept-url pattern='/images/**' access="IS_AUTHENTICATED_ANONYMOUSLY"/> <security:intercept-url pattern="/loginsucces.html" access="ROLE_USER, ROLE_SOC, ROLE_FINANCE"/> <security:intercept-url pattern="/*.html" access="ROLE_USER" /> <security:intercept-url pattern="/soc/**" access="ROLE_SOC" /> <security:intercept-url pattern="/finance/**" access="ROLE_FINANCE" /> <security:form-login login-page="/login.html" authentication-failure-url="/loginfailed.html" default-target-url="/loginsucces.html"/> <security:logout invalidate-session="true" logout-success-url="/logoutsucces.html"/> <security:concurrent-session-control max-sessions="1" exception-if-maximum-exceeded="true"/> </security:http> <bean id="userDetailsService" class="nl.dhlonline.model.security.AcegiUserDetailsImpl"> <property name="userService"><ref bean="userService" /></property> </bean> <security:authentication-provider user-service-ref='userDetailsService'/> </beans>

I've tried the following options:
1: Configure Apache to use Digest login:
<Location /tst> AuthType Digest AuthName "PrivateOnly" AuthDigestDomain http://<domain>/tst AuthUserFile /etc/apache2/.digestpw Require valid-user </Location>

.digestpw contained the following user password:
tst:tst:ceaa2115e4ac62de0f46f118921cf018

If I try to go to the application, I get a login popup for PrivateOnly as I'm supposed to. But if I insert username and password, I get the same login popup, untill after 3 time, I get this error:
Authorization Required

This server could not verify that you are authorized to access the document requested. Either you supplied the wrong credentials (e.g., bad password), or your browser doesn't understand how to supply the credentials required.

2: Configure Spring Security - BeasicProcessingFilter
I've added basicProcessingFilter:

<bean id="basicProcessingFilter" class="org.springframework.security.ui.basicauth.BasicProcessingFilter"> <property name="authenticationManager"><ref bean="authenticationManager"/></property> <property name="authenticationEntryPoint"><ref bean="authenticationEntryPoint"/></property> </bean> <bean id="authenticationEntryPoint" class="org.springframework.security.ui.basicauth.BasicProcessingFilterEntryPoint"> <property name="realmName"><value>tst</value></property> </bean> <bean id="authenticationManager" class="org.springframework.security.providers.ProviderManager"> <property name="providers"> <list> <ref bean="daoAuthenticationProvider" /> </list> </property> </bean> <bean id="daoAuthenticationProvider" class="org.springframework.security.providers.dao.DaoAuthenticationProvider"> <property name="userDetailsService"> <ref bean="userDetailsService" /> </property> </bean>

This didn't work.

3: Configure Spring Security - Security Filter

I've placed security filter:

<bean id="springSecurityFilterChain" class="org.springframework.security.util.FilterChainProxy"> <security:filter-chain-map path-type="ant"> <!--<security:filter-chain pattern="/**" filters="httpSessionContextIntegrationFilter,logoutFilter,authenticationProcessingFilter,basicProcessingFilter,securityContextHolderAwareRequestFilter,rememberMeProcessingFilter,anonymousProcessingFilter,exceptionTranslationFilter,filterInvocationInterceptor,switchUserProcessingFilter"/>--> <security:filter-chain pattern="/**" filters="httpSessionContextIntegrationFilter,logoutFilter,securityContextHolderAwareRequestFilter,rememberMeProcessingFilter,anonymousProcessingFilter,exceptionTranslationFilter,filterInvocationInterceptor,switchUserProcessingFilter"/> </security:filter-chain-map> </bean>

This didn't work.

All in all, I think I'm very close to solution, but I'm missing something. Can anyone help me out with this?

I think I've found the problem. It's indeed the intercept-url configuration that caused the problem.
<security:intercept-url pattern="/login*.html" filters='none'/>

Without any filtering there was no security activity inside the loginsuccess.jsp
After I added the access parameter for my roles:
access="ROLE_USER, ROLE_SOC, ROLE_FINANCE"
I was able to use the security inside the screen. Thanks for your pointer ;-)

We've just impelmented spring security (with spring 2.5) in our web app where I'm struggling with some things.
I'm trying to do a redirect (from within a loginsuccess.jsp) according to the role of a user.
I've put the following in the jsp (this is from spring security tutorial) to test out:
<%@ taglib prefix="sec" uri="http://www.springframework.org/security/tags" %> <sec:authorize ifAnyGranted="ROLE_SOC" > TEST </sec:authorize>

Somehow I never pass this test even if the user has granted authority of ROLE_SOC

If I retrieve the sessionScope in this jsp, I can see the role:
{javax.servlet.jsp.jstl.fmt.request.charset=ISO-8859-1, SPRING_SECURITY_LAST_USERNAME=user@somemail.com, SPRING_SECURITY_CONTEXT=org.springframework.security.context.SecurityContextImpl@a9a3fb41: Authentication: org.springframework.security.providers.UsernamePasswordAuthenticationToken@a9a3fb41: Principal: org.springframework.security.userdetails.User@0: Username: user@somemail.com; Password: [PROTECTED]; Enabled: true; AccountNonExpired: true; credentialsNonExpired: true; AccountNonLocked: true; Granted Authorities: ROLE_SOC; Password: [PROTECTED]; Authenticated: true; Details: org.springframework.security.ui.WebAuthenticationDetails@0: RemoteIpAddress: 127.0.0.1; SessionId: 1128102A01AC8D176926A91795BF2B7A; Granted Authorities: ROLE_SOC}

Am I missing something here?

Hi all,

I'm getting the following JSF exception message:
com.sun.faces.el.ValueBindingImpl@11733f8 - Validation Error: Value is less than allowable minimum of '4'
This message is thrown on following standard validation field in jsp page.
<f:validateLength minimum="4" maximum="4" />

Is it possible to easily remove the "com.sun.faces.el.ValueBindingImpl@11733f8 - " part without adding listeners/other components etc. to modify validation messages manually?

BTW: I'm using the following to display error messages:
<f:facet name="messages"> <af:messages /> </f:facet>
[ November 02, 2006: Message edited by: Ergin Er ]

Is it possible to use message bundle with key values gathered from an object?
Standard message-bundles work this way:

<f:loadBundle basename="src.view.bundles.Bundle" var="bundleContent" /> <af:forEach var="eventObject" items="#{myBean.eventList}" > <af:outputText value="#{bundleContent.label1}" styleClass="columnHeader"/> <af:outputText value="#{bundleContent.label2}" styleClass="columnHeader"/> <af:outputText value="#{bundleContent.label3}" styleClass="columnHeader"/> </af:forEach>

I would like to get the #{bundleContent.label3} part used in a dynamic way. the .labelx part needs to correspond with the eventObject.label. Something like this:
value="#{bundleContent.#{eventObject.label}}". Of course this doesn't work, so I'm looking for a solution on this. Ik can manipulate the eventObject before it's passed on to the jsf page, but that seems to me as a very dirty solution.
In short:
I need a jsf component that works like the following struts component:
<bean:message bundle="moreResources" key="some.message.key"/>
[ October 19, 2006: Message edited by: Ergin Er ]

I'm having same type of problems. Als working on a matrix that needs to have a dynamic range of colums and rows (gatehered from lists generated for rows and colums) where the headers are not given and the whole matrix is filled with checkboxes that are checked/unchecked according to a listof results that need to be compared at each row/column cross section with the according column and row values from their lists.

the jsf components that are given feel complicated to use. Having experience with struts components doesn't help me out in any way.

Right now I'm trying to generate the whole matrix serverside using HtmlPanelGrid in java. Maybe that's an outcome for you?

Hahaha, this types of questions always make me laugh. No one is forced to use any of the frameworks. It's just about what's convenient for you. If you're comfortable using servlets + DAO's who's to say you're doing wrong.
And the customer never looks what's under the hood as long as it does what it should!
The only things in these descisions is conveniency, knowledge of the framework to use. Do you want to dive into a new framework that might make your life easier (but until it does it will eat a lot of your time to learn it)?
In short, nobody can decide for you what to use. Every framework has it's plus and it's negative.

I'm getting the idea about injection. The problem with MimeMessage is that it doesn't have a default empty contructor. The simplest constructor for MimeMessage is:
MimeMessage(Session session) -> Session is from javax.mail.Session

So when I add <constructor-arg><ref bean="session"/></constructor-arg> to MimeMessage to define the constructor argument by the following bean:
<bean id="session" class="javax.mail.Session"></bean>

I get the same error, but now focussed on the bean session. That is also understandable since Session doesn't have a constructor. Normally a session is gathered by Session.getInstance(); command. But how do I implement this into the session bean I declared in ApplicationContext?

Update:
I think the configuration options that Spring offers, makes things needlessly complex. In my Java class, I'm done 5 rows of code. For Spring I need to create like 3 to 4 beans referring to each othe since the MimeMessage (and its constructor arguments) don't have default EMPTY constructor. So far for configurability...
[ June 12, 2006: Message edited by: Ergin Er ]

Hi all,

I'm trying to get emailing to work in spring. So far I have succesfully configured mailing using SimpleMailMessage. Since that doesn't contain attachments I wanted to configure mailing by using MimeMessage:

In the context.xml I already wanted to set default values for some attributes (that worked on SimpleMailMessage). This is what I have now:
<bean id="enrollmentMailMessage" class="javax.mail.internet.MimeMessage"> <property name="to"> <value>a@b.com</value> </property> <property name="from"> <value>a@b.com</value> </property> <property name="subject"> <value>Course enrollment report</value> </property> </bean>

This throw the following error:
org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'enrollmentMailMessage' defined in ServletContext resource [/WEB-INF/applicationContext.xml]: Instantiation of bean failed; nested exception is org.springframework.beans.FatalBeanException: Could not instantiate class [javax.mail.internet.MimeMessage]: no default constructor found; nested exception is java.lang.NoSuchMethodException: javax.mail.internet.MimeMessage.<init>()

org.springframework.beans.FatalBeanException: Could not instantiate class [javax.mail.internet.MimeMessage]: no default constructor found; nested exception is java.lang.NoSuchMethodException: javax.mail.internet.MimeMessage.<init>()

java.lang.NoSuchMethodException: javax.mail.internet.MimeMessage.<init>()
at java.lang.Class.getConstructor0(Class.java:2647)
...

How do I correctly set the configuration for MimeMessage?
[ June 09, 2006: Message edited by: Ergin Er ]

I think this is more eclipse specific that struts.
You can include a jar into the project by going to project properties (Alt+Enter)>java build path>libraries

Unknown source usually means that the class you want to call methods from is not properly imported.
When I look at your code I don't see import ****.parse333.java (in this case it should be: import com.blogic.back.parse333.java)
If your test class can't find the source, it can't execute its methods.

[ December 19, 2005: Message edited by: Ergin Er ]

[ December 19, 2005: Message edited by: Ergin Er ]

Ow yeah, one more advise: Using an IDE that can organize your imports will keep you from these problems.
[ December 19, 2005: Message edited by: Ergin Er ]

Hi all,

Wit this code:
Calendar calendar = Calendar.getInstance(new Locale("nl"));
I can generate date fields for web interface that displays the dates in dutch. The problem is, when I change the regional settings in control panel, the date fields don't stay dutch, but change to english for example.

How can I make the local "fixed" no matter what regional settings are used?

Edit:
Problem is solved. I forgot to set the locale in the DateFormatter which translates the calendar instance into "readable" date field string.
[ December 19, 2005: Message edited by: Ergin Er ]

Depends on what you want to do. Just keep in mind Struts does not equal Spring.
Struts is just a front end framework. Spring covers the whole deal!

the simplest (depens on your preference):

validation.xml:
add a mask dependency that checks on [0-9] (regex)

if you're more comfortable with java in stead of xml:
add validate() method in the actionform and there you can check if the variable does have chars in it.

In both cases you do need to activate the validator framework by setting it in the struts-config.

If you don't want to use validator framework:
throw error in the action when your variable is null or 0