Spring Security does not display login page - spring

Question

I'm trying to securize my application (Spring 4.3.10 + Hibernate 5.2.10) using Spring Security (4.2.3).
I configure spring security with the Digest authentification method the following way :
spring-security.xml :
<security:http create-session="stateless" use-expressions="true" >
<security:intercept-url pattern="/**" access="isAuthenticated()"/>
<security:intercept-url pattern="/login*" access="isAnonymous()" />
<security:http-basic/>
<security:form-login login-page="/login" authentication-failure-url="/login"/>
<security:custom-filter ref="digestFilter" after="BASIC_AUTH_FILTER"/>
</security:http>
<bean id="digestEntryPoint" class="org.springframework.security.web.authentication.www.DigestAuthenticationEntryPoint">
<property name="realmName" value="my_realm"/>
<property name="key" value="my_key"/>
</bean>
<bean id="digestFilter" class="org.springframework.security.web.authentication.www.DigestAuthenticationFilter">
<property name="userDetailsService" ref="jdbcDaoImpl"/>
<property name="authenticationEntryPoint" ref="digestEntryPoint"/>
</bean>
<bean id="jdbcDaoImpl" class="org.springframework.security.core.userdetails.jdbc.JdbcDaoImpl">
<property name="dataSource" ref="dataSource"/>
</bean>
I added the DelegatingFilterProxy in the web.xml :
<filter>
<filter-name>digestFilter</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
<filter-name>digestFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
I created a basic controller to show the login page (did not managed to use the default one) :
#Controller
#RequestMapping("/login")
public class LoginController {
#GetMapping
public String login() {
return "login";
}
}
I have also a login.jsp in the WEB-INF that contains the form, and the default mysql schema for the users and authorities tables as describe in the reference documentation.
My problem is that Spring Security never display the login page. I put a breakpoint into the doFilter method of the DigestAuthentificationFilter, and it seems that the header "Authorization" is null and spring just continue the filter chain without doing anything. It seems that the filter is expecting a Digest header...
My question is then, who put this Authorization header ? And why spring do not ask for authentifaction is the header is null ?
I think there is something that I don't understand...
Thanks for your help !

Answer 1

I solved my problem. I specified digestFilter as the filter-name for the DelegatingFilerProxy because I thought I had to bind it to the custoim filter I declared in the spring-security.xml. But Spring actually use a filters chain and add many more filters to it behind the scene. Thus, it did not use the filters chain created by spring but only the digest filter that cannot work alone.
I modified the web.xml as follow :
<filter>
<filter-name>springSecurityFilterChain</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
<filter-name>springSecurityFilterChain</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>