My Spring Web project with Spring Security works successfully. I want to separate "view" of the project by creating a new static web project. It will have a login screen, access to pages by user's role etc.
my spring-security.xml file
<http auto-config="true">
<intercept-url pattern=“/restricted” access="ROLE_ADMIN" />
<form-login login-page="/login"
default-target-url="/welcome"
authentication-failure-url=“/fail” />
<logout logout-success-url="/login" />
</http>
In addition to this, i have REST controllers that return JSON data; but they are stricted if user's role is not ROLE_ADMIN (.../restricted/getlist)
What do i have to do in static web page (client) side?
Thank you.
You can use Spring security tags :
<sec:authorize access="hasRole('ROLE_ADMIN')">
http://static.springsource.org/spring-security/site/docs/3.0.x/reference/taglibs.html
Related
We are creating a spring boot web application to send RSS data to a Ticker Sign (ticker).
The URLs that send RSS data to the ticker sign do not need to be secured with ldap or other credentials.
But we have one page we we update a custom message that we send to the Ticker sign. We want to secure this page with the corporate ldap.
Is it possible to configure spring boot to only require a login for one page and the rest of the pages can remain unsecured.
You can create a role with all permission to access and grant that access just in some methods using Spring security annotation http://docs.spring.io/spring-security/site/docs/3.0.x/reference/el-access.html
<http use-expressions="true">
<intercept-url pattern="/*"
access="hasRole('admin')"/>
</http>
Then in your free access method
#PreAuthorize("hasRole('admin')")
public void create(Contact contact);
To use this it is very important that you name your URLs wisely i.e. if you want to assign admin role then make a URL look something like /admin/v1/something-here. It will make things readable and simple for you.
We are integrating our JSF2 application with Spring Security. We have done the basic setup and its working fine. However we need to implement a custom access decision manager to filter the requests.
For example if user with user privileges try to access a page dedicated to admin, in this case we need to check first whether the user is logged in or not , if logged in get his authorities. I have written a access decision manager and i am still in the process of enhancing it. But when i deploy i am getting below error.
java.lang.IllegalArgumentException: AccessDecisionManager does not support secure object class: class org.springframework.security.web.FilterInvocation
Any idea what is the reason for the same.
below is sample from my security-config.xml
disable-url-rewriting="true" access-decision-manager-ref="accessDecisionManager">
I am new in spring framework and little confused in managing the directory structure according to the role of user like admin (all jsp will be inside admin directory), how to make login according to the user role like admin will have access only to the admin directory and the session of the user it's time out etc.
I have used this website as reference for login management using hibernate :-
http://fruzenshtein.com/spring-mvc-security-mysql-hibernate/
what i want to do is to protect the user from seeing the pages, which they do not have permission in spring and my project is managing the directory as their role like admin - admin directory, user - user directory and other user - other directory and home pages, when admin will login he will have access to the pages inside admin.
Using hibernate security framework how can i do this.
You have to use SPRING security framework to achive that.
just add whatever filter you want to add in spring-security.xml.
For example: add
<intercept-url pattern="/admin/*" access="ROLE_ADMIN" />
<intercept-url pattern="/user/*" access="ROLE_USER" />
It will create check that accessing controller mapping starting with /admin* will require admin login.
Go through spring security docs then configure security with help of below link:
Steps for configuring spring security
I was reading many tutorials and none of them is working for me...
I use Spring 3.1.x with Spring Security. I have a bunch of secured url and many unsecured. Now, when the user is logged in and tries to logout I want him to stay in the same page as he was before so I use this:
<beans:bean id="logoutSuccessHandler" class="org.springframework.security.web.authentication.logout.SimpleUrlLogoutSuccessHandler">
<beans:property name="useReferer" value="true"/>
</beans:bean>
This works fine, however when the user logs out from the secured page it redirects him to the login page, and I would like to redirect to home page.. How can I achieve this?
Thanks in advance!
Since you have custom logic for redirecting, you need a custom LogoutSuccessHandler.
In this handler, you need to add this logic:
String refererUrl = request.getHeader("Referer");
String normalizedRefererUrl = ...; // "Normalize" (if needed) the URL so it is in the form that you need.
if (requiresAuthentication(normalizedRefererUrl, authentication)) {
response.sendRedirect(request.getContextPath()); // home page
} else {
response.sendRedirect(refererUrl); // or normalizedUrl
}
In your requiresAuthentication() method, you need to use some part of Spring Security that determined if the URL needs authentication.
You can use a WebInvocationPrivilegeEvaluator reference there. You get a hold of it through Spring through autowiring by class (since there will be a bean implementing WebInvocationPrivilegeEvaluator).
The evaluator has a method that you can use, isAllowed(uri, authentication).
<security:http auto-config="true">
<security:form-login login-page="/spring/login"
login-processing-url="/spring/loginProcess"
default-target-url="/spring/main"
authentication-failure-url="/spring/login?login_error=1" />
<security:logout logout-url="/spring/logout" logout-success-url="/spring/logout-success" />
</security:http>
logout-success-url from the docs or for a custom succeshandler
as per documentation for spring security if you don't specify logout-success-url then it should be redirecting /. check this configuration and may be you can use SimpleRedirectInvalidSessionStrategy
How can I overwrite default login logout pages of Spring Security. I will put my own login.html and logout.html files and don't use jsp files just works with static contents at that side.
Specify them in your security-context.xml (or whatever you've called yours) like this:
<form-login login-page="/login.htm" authentication-failure-url="/login.htm?login_error=1" default-target-url="/home/index.htm" />
But I think you'll find it difficult to write a login page that works with Spring Security and doesn't use JSP.
Here's an example JSP page you can start from: http://loianegroner.com/2010/01/spring-security-login-and-logout-form-jsp/