Spring security PreAuthentication Filter asks for AuthenticationEntryPoint
17,210
I guess in the case of pre-authentication you need to declare an Http403ForbiddenEntryPoint
and reference it via entry-point-ref
attribute of <http>
.
![Nirmal Patel](https://i.stack.imgur.com/R1Uv9.jpg?s=256&g=1)
Comments
-
Nirmal Patel about 2 years
I am trying to use PreAuthFilter (for Siteminder) with Spring Security 3.0.
<http use-expressions="true"> <intercept-url pattern="/admin/**" access="hasRole('ROLE_ADMIN')" /> <intercept-url pattern="/403.jsp" access="permitAll" /> <!-- Allow non-secure access to static resources --> <intercept-url pattern="/css/**" filters="none" /> <intercept-url pattern="/images/**" filters="none" /> <custom-filter ref="siteminderFilter" position="PRE_AUTH_FILTER"/> <!-- <form-login /> --> <logout logout-success-url="/index.jsp"/> </http> <beans:bean id="siteminderFilter" class="org.springframework.security.web.authentication.preauth.RequestHeaderAuthenticationFilter"> <beans:property name="principalRequestHeader" value="SM_USER"/> <beans:property name="authenticationManager" ref="authenticationManager" /> <beans:property name="exceptionIfHeaderMissing" value="false"/> </beans:bean> <beans:bean id="AdminUserDetailsService" class="com.fw.security.auth.MyUserDetailsService"> </beans:bean> <beans:bean id="preauthAuthProvider" class="org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationProvider"> <beans:property name="preAuthenticatedUserDetailsService"> <beans:bean id="userDetailsServiceWrapper" class="org.springframework.security.core.userdetails.UserDetailsByNameServiceWrapper"> <beans:property name="userDetailsService" ref="AdminUserDetailsService"/> </beans:bean> </beans:property> </beans:bean> <authentication-manager alias="authenticationManager"> <authentication-provider ref="preauthAuthProvider" /> </authentication-manager>
Above configuration fails with
org.springframework.beans.factory.parsing.BeanDefinitionParsingException: Configuration problem: No AuthenticationEntryPoint could be established. Please make sure you have a login mechanism configured through the namespace (such as form-login) or specify a custom AuthenticationEntryPoint with the 'entry-point-ref' attribute Offending resource: ServletContext resource [/WEB-INF/security-app-context.xml]
1) How do I specify an AuthenticationEntryPoint???
2) And is it really applicable for a PreAuthentication scenario???
Solution
as per axtavt's solution below:
Create a bean with Http403ForbiddenEntryPoint
<beans:bean id="http403EntryPoint" class="org.springframework.security.web.authentication.Http403ForbiddenEntryPoint"> </beans:bean>
and refer it in <http>
<http use-expressions="true" auto-config="false" entry-point-ref="http403EntryPoint">