I have a web Project which uses Spring security and Primefaces.
I am trying to use Primefaces Dialog Framework to call any XHTML File as a dialog .. my problem is when I add this line on my web.xml:
<filter>
<filter-name>springSecurityFilterChain</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
<filter-name>springSecurityFilterChain</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
The dialog Box doesn't appear , if I remove the line above , the dialog box is being displayed .. but If I remove the lines above , I loose the spring security feature .. any configuration I missed?
Yes, Spring Security is blocking the frame generated by Primefaces. You can make it work by adding the following directive to Spring Security configuration
http
// ...
.headers().frameOptions().sameOrigin();
source:
http://docs.spring.io/spring-security/site/docs/current/reference/html/headers.html#headers-frame-options
Related
I'm updating a GAE application to the Java8 Cloud SDK environment; I'm also updating it to use Cloud Endpoints version 2.
My app registers some servlet filters in its web.xml file, one for Objectify and one to do some initialisations such as creating singleton instances of some utility classes the app uses.
This is an excerpt of web.xml:
<servlet>
<servlet-name>EndpointsServlet</servlet-name>
<servlet-class>com.google.api.server.spi.EndpointsServlet</servlet-class>
<init-param>
<param-name>services</param-name>
<param-value>com.myapp.service.Service</param-value>
</init-param>
</servlet>
<servlet-mapping>
<servlet-name>EndpointsServlet</servlet-name>
<url-pattern>/_ah/api/*</url-pattern>
</servlet-mapping>
<filter>
<filter-name>InitializerFilter</filter-name>
<filter-class>com.myapp.InitializerFilter</filter-class>
</filter>
<filter-mapping>
<filter-name>InitializerFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<filter>
<filter-name>ObjectifyFilter</filter-name>
<filter-class>com.googlecode.objectify.ObjectifyFilter</filter-class>
</filter>
<filter-mapping>
<filter-name>ObjectifyFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<!-- Add a filter that fetches the service config from service management. -->
<filter>
<filter-name>endpoints-api-configuration</filter-name>
<filter-class>com.google.api.control.ServiceManagementConfigFilter</filter-class>
</filter>
<!-- Add a filter that performs Endpoints logging and monitoring. -->
<filter>
<filter-name>endpoints-api-controller</filter-name>
<filter-class>com.google.api.control.extensions.appengine.GoogleAppEngineControlFilter</filter-class>
<init-param>
<param-name>endpoints.projectId</param-name>
<param-value>${appId}</param-value>
</init-param>
<init-param>
<param-name>endpoints.serviceName</param-name>
<param-value>${service}-dot-${appId}.appspot.com</param-value>
</init-param>
</filter>
<filter-mapping>
<filter-name>endpoints-api-configuration</filter-name>
<servlet-name>EndpointsServlet</servlet-name>
</filter-mapping>
<filter-mapping>
<filter-name>endpoints-api-controller</filter-name>
<servlet-name>EndpointsServlet</servlet-name>
</filter-mapping>
It looks like filters correctly kick for all URLs (for example, URLs handled by some other servlet that I instantiate but are not shown here), but not the _ah/api/discovery/* URLs that implement Google's nifty APIs Explorer tool.
No exceptions are thrown at deployment.
Note that I already tried changing the <url-pattern>/*</url-pattern> to <url-pattern>/_ah/api/*</url-pattern>, to <url-pattern>/_ah/api/discovery/*</url-pattern> and mapping using <servlet-name>EndpointsServlet</servlet-name> rather than a URL pattern, to no avail.
Awkwardly enough, the very same configuration did work on Friday morning, then after a redeployment made later in the afternoon it stopped. And I'm pretty positive I did not change anything.
Is this known behaviour? For example, this may be because the API Explorer is "stitched on" the endpoints URL externally rather than being part of EndpointServlet itself?
Otherwise, what am I doing wrong?
=========
I fixed this problem by moving the logic that was in the filter to a ServletContextListener, and this made the app stable. This is only viable for once-for-servlet-lifetime initialisations, of course, so the question still stands: is the cloud API Explorer expected to trigger the servlet filters registered on EndpointsServlet?
I have done my RESTful Webservice along with the same project that implements Admin panel application. The problem i face is that the POST request comes to the application gets converted to GET.
<servlet-mapping>
<servlet-name>appServlet</servlet-name>
<url-pattern>/</url-pattern>
</servlet-mapping>
<filter>
<filter-name>springSecurityFilterChain</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
<filter-name>springSecurityFilterChain</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
When the filter got commented everything works as normal.
Other GET requests are having no problem in both case when filter is present or not.
error i get is
HTTP Status 405 - Request method 'POST' not supported
How can i override Spring security filter for my Web service ?
solved
Just un-comment any resource if you don't want authentication to be done on them
# spring security.xml file add the following.
<http pattern="/webservice/**" security="none"/>
I have a problem with Tomcat 7, where all my requests are going twice through our filters. This results in a web-page where static text is displayed twice and all our ajax requests are also displayed twice. This started happening when we implemented the security filter shown below:
<filter>
<filter-name>springSecurityFilterChain</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
<filter-name>springSecurityFilterChain</filter-name>
<url-pattern>/system/*</url-pattern>
<url-pattern>/admin/*</url-pattern>
</filter-mapping>
When I deploy the same war-file on jetty 9 or tomcat 6 it works just fine! Does anyone know how to solve this issue?!
Setup:
Tomcat: 7.0.52
Spring: 3.2.8.RELEASE
Spring-security: 3.2.1.RELEASE
Apache Tiles: 3.0.3
We have tried the following with no luck:
reimplementing apache tiles
added this to /conf/context.xml: <Context resourceOnlyServlets="">
changed the order of our filters
After I add the following into web.xml to support spring security 3. the spring ioc + struts2 not work, when struts2 point to a bean, system can not search the bean definition in applicationContext.xml, it just shows me Class Not Defined
<context-param>
<!-- Defines definition file for security setting. -->
<param-name>contextConfigLocation</param-name>
<param-value>classpath:app-security.xml</param-value>
</context-param>
<!-- Bootstraps the Spring root web application context before servlet initialization -->
<!-- The following code defines filter for Spring Security -->
<listener>
<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>
<filter>
<filter-name>springSecurityFilterChain</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
<filter-name>springSecurityFilterChain</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
Please help! thanks in advance !
Sounds like you forgot to add some JARs that are needed. Make sure that you (and the classloader) can find the class that it says is missing. (Hint: It's probably one of the Spring security JARs.)
I have single sign on working beautifully, but single sign-out is not working.
The scenario is like this:
Open webapp1 and get redirected to CAS login page
Enter details and login
Open webapp2 which also uses CAS. Automatically logs in, as the user already signed in.
Log out of webapp1
Try to open webapp1 or webapp2 (in another tab) redirects you back to the login page.
However, the session to webapp2 in step 3 is not closed and the user can still use the application without any problems. How do I automatically invalidate the session when the user signs out?
The log off button for both applications first call session.invalidate() and then redirects to https://localhost:8443/cas/logout
The single sign out filter is the first filter in the web.xml file. I also have the SingleSignOutHttpSessionListener in web.xml.
Following is the extract from my web.xml
<!-- CAS settings -->
<!-- Use filter init-param if your container does not support context params.
CAS Authentication Filter and CAS Validation Filter need a serverName init-param
in lieu of a context-param definition. -->
<context-param>
<param-name>serverName</param-name>
<param-value>https://localhost:8443</param-value>
</context-param>
<!-- Facilitates CAS single sign-out -->
<listener>
<listener-class>org.jasig.cas.client.session.SingleSignOutHttpSessionListener</listener-class>
</listener>
<!--
CAS client filters
Single sign-out filter MUST come first since it needs to be evaluated
before other filters.
-->
<filter>
<filter-name>CAS Single Sign Out Filter</filter-name>
<filter-class>org.jasig.cas.client.session.SingleSignOutFilter</filter-class>
</filter>
<filter>
<filter-name>CAS Authentication Filter</filter-name>
<!--
IMPORTANT:
Use Saml11AuthenticationFilter for version 3.1.12 and later.
Use org.jasig.cas.client.authentication.AuthenticationFilter for previous
versions.
-->
<filter-class>
org.jasig.cas.client.authentication.Saml11AuthenticationFilter</filter-class>
<init-param>
<param-name>casServerLoginUrl</param-name>
<param-value>https://localhost:8443/cas/login</param-value>
</init-param>
<init-param>
<param-name>service</param-name>
<param-value>https://localhost:8443/JAdaptiv/default.action</param-value>
</init-param>
</filter>
<filter>
<filter-name>CAS Validation Filter</filter-name>
<filter-class>
org.jasig.cas.client.validation.Saml11TicketValidationFilter</filter-class>
<init-param>
<param-name>casServerUrlPrefix</param-name>
<param-value>https://localhost:8443/cas</param-value>
</init-param>
<init-param>
<param-name>redirectAfterValidation</param-name>
<param-value>true</param-value>
</init-param>
<init-param>
<!-- Leniency of time checking in ms when validating SAML assertions. Consider
setting this parameter more liberally if you anticipate system clock drift
on your application servers relative to the CAS server. The default is 1000
(1s) and at least one person had problems with drift at that small a tolerance
value. A good approach is to start low and then increase by 1000 as needed
until problems stop. Note that increasing this value may have negative security
implications. Consider fixing clock drift problems as an alternative. -->
<param-name>tolerance</param-name>
<param-value>1000</param-value>
</init-param>
</filter>
<filter>
<filter-name>CAS HttpServletRequest Wrapper Filter</filter-name>
<filter-class>
org.jasig.cas.client.util.HttpServletRequestWrapperFilter</filter-class>
</filter>
<filter>
<filter-name>CAS Assertion Thread Local Filter</filter-name>
<filter-class>org.jasig.cas.client.util.AssertionThreadLocalFilter</filter-class>
</filter>
<filter-mapping>
<filter-name>CAS Single Sign Out Filter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<filter-mapping>
<filter-name>CAS Authentication Filter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<filter-mapping>
<filter-name>CAS Validation Filter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<filter-mapping>
<filter-name>CAS HttpServletRequest Wrapper Filter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<filter-mapping>
<filter-name>CAS Assertion Thread Local Filter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
I also had another issue with standard CAS protocol, where single sign-out worked on an integration server but not from localhost.
Scenario
log into both http://my-app-dev/app and http://localhost:8080/app with CAS on http://my-cas/cas
log out of CAS http://my-cas/cas/logout
http://my-app-dev/app now bounces me to CAS
http://localhost:8080 - still logged in!
I suspect the reason is the CAS server couldn't send a sign-out message to localhost:8080 because localhost is resolved in the CAS server's context, so it doesn't actually talk to my local dev environment.
If you're using SAML 1.1 protocol be sure that you included the artifactParameterName parameter
https://wiki.jasig.org/display/CASC/Configuring+Single+Sign+Out
<filter>
<filter-name>CAS Single Sign Out Filter</filter-name>
<filter-class>org.jasig.cas.client.session.SingleSignOutFilter</filter-class>
<init-param>
<param-name>artifactParameterName</param-name>
<param-value>SAMLart</param-value>
</init-param>
</filter>
I had the same problem. We had a java and a php client. When I went to http://mycasserver/logout only the java client logged out.
For the single sign out to work in the php client, you have to change:
phpCAS::handleLogoutRequests();
for
phpCAS::handleLogoutRequests(false);
And Voila!
Refer to the documentation at phpCAS examples
I've had basically the same configuration for my application before I switched to the spring configuration. I had a look on the SVN and basically the only difference to your config is the use of the Single Sign Out Listener
listener>
<listener-class>org.jasig.cas.client.session.SingleSignOutHttpSessionListener</listener-class>
</listener>
Could this work for you? Of course don't forget to add it on both WebApps if it works.
UPDATE:
I found the description of the listener in the docs, and it should do what's missing in your setting
You should verify that the CAS server can send a HTTP request to your webapp. Have a look in the logs of the CAS server.