Access Denied error: Spring web MVC(4.1.6)+ Spring security(4.0.1)+ Apache TIles(3.0.5) - spring

Question

I tried integrating Apache Tiles with Spring Security. But my webpage displays " Error: Access is Denied ".
Spring MVC + Spring Security -- https://github.com/spring-projects/spring-security/tree/master/samples/gae-xml
My tiles-configuration xml--
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE tiles-definitions PUBLIC
"-//Apache Software Foundation//DTD Tiles Configuration 2.0//EN"
"http://tiles.apache.org/dtds/tiles-config_2_0.dtd">
<tiles-definitions>
<definition name="base.definition"
template="/jsp/layout.jsp">
<put-attribute name="title" value="" />
<put-attribute name="header" value="/jsp/header.jsp" />
<put-attribute name="menu" value="" />
<put-attribute name="body" value="" />
<put-attribute name="footer" value="/jsp/footer.jsp" />
</definition>
<definition name="home" extends="base.definition">
<put-attribute name="title" value="Home" />
<put-attribute name="body" value="/jsp/home.jsp" />
</definition>
<definition name="hello" extends="base.definition">
<put-attribute name="title" value="logged In" />
<put-attribute name="body" value="/jsp/hello.jsp" />
</definition>
</tiles-definitions>
Security config xml--
<http use-expressions="true" entry-point-ref="gaeEntryPoint">
<intercept-url pattern="/" access="permitAll" />
<intercept-url pattern="/logout.do" access="permitAll" />
<intercept-url pattern="/register.do" access="hasRole('NEW_USER')" />
<intercept-url pattern="/**" access="hasRole('USER')" />
<custom-filter position="PRE_AUTH_FILTER" ref="gaeFilter" />
</http>
<b:bean id="gaeEntryPoint" class="com.app.security.GoogleAccountsAuthenticationEntryPoint" />
<b:bean id="gaeFilter" class="com.app.security.GaeAuthenticationFilter">
<b:property name="authenticationManager" ref="authenticationManager"/>
</b:bean>
<authentication-manager alias="authenticationManager">
<authentication-provider ref="gaeAuthenticationProvider"/>
</authentication-manager>
<b:bean id="gaeAuthenticationProvider" class="com.app.security.GoogleAccountsAuthenticationProvider">
<b:property name="userRegistry" ref="userRegistry" />
</b:bean>
<b:bean id="userRegistry" class="com.app.security.GaeDatastoreUserRegistry" />
web.xml--
<context-param>
<param-name>contextConfigLocation</param-name>
<param-value>
/WEB-INF/gae-security.xml,
/WEB-INF/gae-servlet.xml
</param-value>
</context-param>
<servlet>
<servlet-name>gae</servlet-name>
<servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
<load-on-startup>1</load-on-startup>
</servlet>
<servlet-mapping>
<servlet-name>gae</servlet-name>
<url-pattern>/</url-pattern>
</servlet-mapping>
<servlet-mapping>
<servlet-name>gae</servlet-name>
<url-pattern>*.do</url-pattern>
</servlet-mapping>
<listener>
<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>
<filter>
<filter-name>springSecurityFilterChain</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
<filter-name>springSecurityFilterChain</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
Spring Controllers--
#RequestMapping(value="/",method=RequestMethod.GET)
public String landingPage(ModelMap model) {
return "home";
}
#RequestMapping(value="/home.do",method=RequestMethod.GET)
public String loggedIn(ModelMap model){
return "hello";
}
I am beginner to Spring Security and while experimenting with Apache Tiles I am repeatedly getting Access Denied error. Please Help.

Answer 1

Maybe you should check your [intercept-url/] patterns... It seems that [intercept-url pattern="/" access="permitAll"/] is overriden by the other ones below... In spring security url patterns can be overriden by the next one we define. Try to map from the most specific url to the most generic. Cheers.