Debugging Spring Security Filter Chain - spring

Question

I am using a custom implemented SSO in my app which is using Spring.
(Recently I was upgrading my app to Spring 5.2.5 and Java 11.)
At final stage of that SSO process, a URL like below is posted which bypasses authentication/login page and opens main page.
http://localhost:8181/MyApp/j_spring_security_check?tokenId=999a1ec9-d92a-4a5e-a7ec-a8985c421000
But instead of opening main page it directs me to
access-denied-handler error-page="/ui/ordinary/noauthorization.xhtml"
But when I look at Spring debug logs, I realize that permitAll is matched. No access denied occured.
How can I find out what is really happening here? Why does not it proceed to main page or CustomAuthenticationFilter.attemptAuthentication method not called (overriding UsernamePasswordAuthenticationFilter)?
[2020-09-02 01:39:04,782][DEBUG] Checking match of request : '/j_spring_security_check'; against '/noauthorization.xhtml' - org.springframework.security.web.util.matcher.AntPathRequestMatcher.matches(AntPathRequestMatcher.java:177)
[2020-09-02 01:39:04,782][DEBUG] Checking match of request : '/j_spring_security_check'; against '/login' - org.springframework.security.web.util.matcher.AntPathRequestMatcher.matches(AntPathRequestMatcher.java:177)
[2020-09-02 01:39:04,782][DEBUG] Checking match of request : '/j_spring_security_check'; against '/j_spring_security_check' - org.springframework.security.web.util.matcher.AntPathRequestMatcher.matches(AntPathRequestMatcher.java:177)
[2020-09-02 01:39:04,782][DEBUG] Secure object: FilterInvocation: URL: /j_spring_security_check?tokenId=3e004f91-1aec-4f98-bc5c-1f49b69c209a; Attributes: [permitAll] - org.springframework.security.access.intercept.AbstractSecurityInterceptor.beforeInvocation(AbstractSecurityInterceptor.java:219)
[2020-09-02 01:39:04,782][DEBUG] Previously Authenticated: org.springframework.security.authentication.AnonymousAuthenticationToken#ca1ab61a: Principal: anonymousUser; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails#ffff6a82: RemoteIpAddress: 127.0.0.1; SessionId: node08gmgybqdzxi6l88ent9iokp01; Granted Authorities: ROLE_ANONYMOUS - org.springframework.security.access.intercept.AbstractSecurityInterceptor.authenticateIfRequired(AbstractSecurityInterceptor.java:348)
[2020-09-02 01:39:04,782][DEBUG] Voter: org.springframework.security.web.access.expression.WebExpressionVoter#75a450d1, returned: 1 - org.springframework.security.access.vote.AffirmativeBased.decide(AffirmativeBased.java:66)
[2020-09-02 01:39:04,782][DEBUG] Authorization successful - org.springframework.security.access.intercept.AbstractSecurityInterceptor.beforeInvocation(AbstractSecurityInterceptor.java:243)
[2020-09-02 01:39:04,782][DEBUG] RunAsManager did not change Authentication object - org.springframework.security.access.intercept.AbstractSecurityInterceptor.beforeInvocation(AbstractSecurityInterceptor.java:256)
[2020-09-02 01:39:04,782][DEBUG] /j_spring_security_check?tokenId=3e004f91-1aec-4f98-bc5c-1f49b69c209a reached end of additional filter chain; proceeding with original chain org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:313)
[2020-09-02 01:39:04,791][DEBUG] Not injecting HSTS header since it did not match the requestMatcher org.springframework.security.web.header.writers.HstsHeaderWriter$SecureRequestMatcher#b7199c7 - org.springframework.security.web.header.writers.HstsHeaderWriter.writeHeaders(HstsHeaderWriter.java:169)
[2020-09-02 01:39:04,791][DEBUG] SecurityContext is empty or contents are anonymous - context will not be stored in HttpSession. - org.springframework.security.web.context.HttpSessionSecurityContextRepository$SaveToSessionResponseWrapper.saveContext(HttpSessionSecurityContextRepository.java:351)
[2020-09-02 01:39:04,791][DEBUG] Chain processed normally - org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:120)
[2020-09-02 01:39:04,792][DEBUG] SecurityContextHolder now cleared, as request processing completed - org.springframework.security.web.context.SecurityContextPersistenceFilter.
I have made many changes to xml after posting question but as far as I remember,
my securityContext.xml was like below:
<?xml version="1.0" encoding="UTF-8"?>
<beans:beans default-lazy-init="true"
xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:context="http://www.springframework.org/schema/context"
xmlns:util="http://www.springframework.org/schema/util" xmlns="http://www.springframework.org/schema/security"
xmlns:tx="http://www.springframework.org/schema/tx" xmlns:mvc="http://www.springframework.org/schema/mvc"
xmlns:p="http://www.springframework.org/schema/p" xmlns:task="http://www.springframework.org/schema/task"
xmlns:aop="http://www.springframework.org/schema/aop"
xsi:schemaLocation="
http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd
http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd
http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx.xsd
http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc.xsd
http://www.springframework.org/schema/task http://www.springframework.org/schema/task/spring-task.xsd
http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop.xsd">
<context:component-scan base-package="com.myapp.authentication" />
<http auto-config='true' use-expressions="true" entry-point-ref="myAuthenticationEntryPoint">
<custom-filter ref="customAuthenticationFilter" position="PRE_AUTH_FILTER"/>
<intercept-url pattern="/css/**" access="permitAll" />
<intercept-url pattern="/images/**" access="permitAll" />
<intercept-url pattern="/templates/**" access="isAuthenticated()" />
.
.
<intercept-url pattern="/ui/ordinary" access="denyAll" />
<intercept-url pattern="/ui/ordinary/" access="denyAll" />
.
.
<intercept-url pattern="/ui/ordinary/**"
access="hasAnyRole('ROLE_ORDINARY','ROLE_ADMINISTRATOR','ROLE_ROOT')" />
<intercept-url pattern="/ui/**" access="isAuthenticated()" />
<intercept-url pattern="/login.xhtml" access="permitAll" />
<intercept-url pattern="/j_spring_security_check" access="permitAll" />
<intercept-url pattern="/noauthorization.xhtml" access="permitAll" />
<intercept-url pattern="/**" access="denyAll" />
<form-login login-page='/login.xhtml'
username-parameter="j_username"
password-parameter="j_password"
login-processing-url="/j_spring_security_check"
authentication-failure-url="/login.xhtml"
always-use-default-target="false"
default-target-url="/ui/ordinary/list.xhtml" />
<access-denied-handler error-page="/ui/ordinary/noauthorization.xhtml" />
<logout logout-url="/j_spring_security_logout" logout-success-url="/login.xhtml?logout" delete-cookies="JSESSIONID" />
<csrf disabled="true" />
<session-management invalid-session-url="/login.xhtml"/>
</http>
<authentication-manager alias="authenticationManager">
<authentication-provider ref="customSpringAuthentication" />
</authentication-manager>
<beans:bean id="customAuthenticationFilter"
class="com.mayapp.authentication.CustomAuthenticationFilter" p:postOnly="false" p:authenticationManager-ref="authenticationManager">
<beans:property name="authenticationManager" ref="authenticationManager"/>
<beans:property name="authenticationFailureHandler" ref="failureHandler"/>
<beans:property name="authenticationSuccessHandler" ref="successHandler"/>
<beans:property name="sessionAuthenticationStrategy" ref="sessionFixationAttackHandler"/>
</beans:bean>
<beans:bean id="successHandler"
class="org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler">
<beans:property name="defaultTargetUrl" value="/ui/ordinary/list.xhtml"/>
</beans:bean>
<beans:bean id="failureHandler"
class="org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler">
<beans:property name="defaultFailureUrl" value="/login.xhtml?login_error=true"/>
</beans:bean>
<beans:bean id="customSpringAuthentication" class="com.mayapp.authentication.CustomSpringAuthentication"/>
<beans:bean id="myAuthenticationEntryPoint" class="com.mayapp.authentication.CustomAuthenticationEntryPoint">
<!-- beans:property name="loginFormUrl" value="/login.xhtml" /-->
<beans:constructor-arg value="/login.xhtml"/>
</beans:bean>
<beans:bean id="sessionFixationAttackHandler" class="org.springframework.security.web.authentication.session.SessionFixationProtectionStrategy"/>
</beans:beans>

Answer 1

After numerious experiments, I was able to solve the problem.
I removed
<intercept-url pattern="/j_spring_security_check" access="permitAll" />
And the most important thing solving it was adding "setRequiresAuthenticationRequestMatcher" in my token filter's constructor as below:
public class CustomAuthenticationFilter extends UsernamePasswordAuthenticationFilter {
public CustomAuthenticationFilter() {
super();
// Because by default value of postOnly is true in UsernamePasswordAuthenticationFilter
super.setPostOnly(false);
super.setRequiresAuthenticationRequestMatcher( new AntPathRequestMatcher("/j_spring_security_check","GET") );
}
#Override
public Authentication attemptAuthentication(HttpServletRequest request,
HttpServletResponse response) throws AuthenticationException {
.
.
}
}
Thank to all guys who kindly asked me for more details to help me. I am appreciated