unable to Spring Security working in existing application - spring

Question

I am on day 3 of trying to get this to work and haven't had much luck.
Here's the use scenario (just summarizing using my own words here):
Within the existing application we need to integrate Spring security. User login configuration cannot change and we want to use standard annotations within spring (#Secured and #PreAuthorize) to be able to lock down access to RESTful endpoints. Internal objects can be wrapped but are not permitted to be altered.
I added all of the core dependencies in Maven for security:
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-core</artifactId>
<version>${spring.version}</version>
</dependency>
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-web</artifactId>
<version>${spring.version}</version>
</dependency>
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-config</artifactId>
<version>${spring.version}</version>
</dependency>
I took the custom User class that was in the system and created two wrappers for it to plug into the Spring Security Framework:
CustomAuthentication implementing org.springframework.security.core.Authentication
CustomUserDetails implementing org.springframework.security.core.userdetails.UserDetails
I then created a org.springframework.security.core.userdetails.UserDetailsService implementation that is annotated using #Service("userDetailService"). That completed the basic Java-side implementation for the Spring Security that I thought I needed in order to get things running.
I created a class com.myapp.rest.SecurityTestController that looks like this:
#Controller
#RequestMapping("/security-test")
public class SecurityTestController {
#RequestMapping("wide-open/{name}")
#ResponseBody
public String restWideOpen(#PathVariable String name, HttpSession session) {
return "Hello, " + name + ", from a wide-open RESTful service.";
}
#Secured("ROLE_XYZ")
#RequestMapping("require-auth/{name}")
#ResponseBody
public String restRequireAuthorization(#PathVariable String name, HttpSession session) {
return "Hello, " + name + ", from a RESTful service requiring authorization.";
}
}
I also updated the internal logging code to add (which was implemented as a #Conroller by the original developer):
Authentication customAuthentication = new CustomAuthentication(user);
SecurityContextHolder.getContext().setAuthentication(customAuthentication);
On logout I just simply added:
SecurityContextHolder.clearContext();
That all seems fine, compiles with not issues, etc. So I decided to move on to the configuration side of things in order to get the application working with security. Without any changes I was able to access both interfaces using the basic URL (in this case that happens to be localhost:8080/myapp/security-test/...).
So here's the configs:
web.xml
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns="http://java.sun.com/xml/ns/javaee"
xmlns:web="http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
version="2.5">
<display-name>MyApp</display-name>
<context-param>
<param-name>contextConfigLocation</param-name>
<param-value>/WEB-INF/applicationContext*.xml</param-value>
</context-param>
<listener>
<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>
<servlet>
<servlet-name>myapp-web</servlet-name>
<servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
<load-on-startup>1</load-on-startup>
</servlet>
<servlet-mapping>
<servlet-name>myapp-web</servlet-name>
<url-pattern>/myapp/*</url-pattern>
</servlet-mapping>
<filter>
<filter-name>springSecurityFilterChain</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
<filter-name>springSecurityFilterChain</filter-name>
<url-pattern>/myapp/**</url-pattern>
</filter-mapping>
</web-app>
applicationContext.xml
<?xml version="1.0" encoding="UTF-8"?>
<beans ...>
<context:annotation-config />
<context:component-scan base-package="com.myapp" />
<context:property-placeholder location="/WEB-INF/servlet.properties" />
<bean id="messageSource" class="org.springframework.context.support.ResourceBundleMessageSource">
<property name="basename" value="messages" />
</bean>
<bean id="multipartResolver" class="org.springframework.web.multipart.commons.CommonsMultipartResolver">
<property name="maxUploadSize" value="${maxProfileImageSize}"/>
</bean>
<bean id="dataSource" class="org.springframework.jdbc.datasource.DriverManagerDataSource">
<property name="driverClassName" value="com.mysql.jdbc.Driver"/>
<property name="url" value="${datasource.url}"/>
<property name="username" value="${datasource.username}"/>
<property name="password" value="${datasource.password}"/>
</bean>
<tx:annotation-driven transaction-manager="transactionManager" />
<bean id="transactionManager" class="org.springframework.jdbc.datasource.DataSourceTransactionManager">
<property name="dataSource" ref="dataSource" />
</bean>
<bean id="sqlSessionFactory" class="org.mybatis.spring.SqlSessionFactoryBean">
<property name="dataSource" ref="dataSource" />
<property name="typeAliasesPackage" value="com.myapp.bean" />
</bean>
<bean id="velocityEngine" class="org.springframework.ui.velocity.VelocityEngineFactoryBean">
<property name="resourceLoaderPath" value="/WEB-INF/views/velocity/"/>
<property name="configLocation" value="/WEB-INF/velocity.properties"/>
</bean>
<bean id="properties" class="org.springframework.beans.factory.config.PropertiesFactoryBean">
<property name="location" value="/WEB-INF/servlet.properties"/>
</bean>
</beans>
applicationContext-security.xml
<beans ...>
<sec:global-method-security secured-annotations="enabled" pre-post-annotations="enabled" />
<sec:http auto-config="true" use-expressions="true">
<sec:intercept-url pattern="/myapp/login" access="permitAll" />
</sec:http>
<sec:authentication-manager>
<sec:authentication-provider user-service-ref="userDetailService" />
</sec:authentication-manager>
</beans>
And finally: myapp-web-servlet.xml
<?xml version="1.0" encoding="UTF-8"?>
<beans ...>
<context:component-scan base-package="com.myapp" />
<context:annotation-config />
<context:property-placeholder location="/WEB-INF/servlet.properties" />
<mvc:annotation-driven/>
<mvc:interceptors>
<bean id="sessionInterceptor" class="com.myapp.web.interceptor.SessionInterceptor" />
</mvc:interceptors>
<bean id="handlerAdapter" class="org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter">
<property name="messageConverters">
<util:list>
<ref bean="jsonHttpMessageConverter" />
</util:list>
</property>
</bean>
<bean id="jsonHttpMessageConverter" class="org.springframework.http.converter.json.MappingJacksonHttpMessageConverter" />
<bean id="handlerMapping" class="org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerMapping">
<property name="useTrailingSlashMatch" value="true" />
</bean>
<bean id="viewResolver" class="org.springframework.web.servlet.view.InternalResourceViewResolver">
<property name="prefix" value="/WEB-INF/views/" />
<property name="suffix" value=".jsp" />
</bean>
</beans>
Now comes the problem:
Everything reminds exactly the same. I can access the RESTful services without having the roles be validated. When I start Tomcat in debug my UserDetailsService implementation never actually gets invoked.
What am I missing? This is completely frustrating me as I've never had problems with Spring Security like this before.
UPDATE
I figured it out.
Of all things to miss, I needed to add this to myapp-web-servlet.xml:
<sec:global-method-security secured-annotations="enabled" pre-post-annotations="enabled" />
Now I just need to figure out how to get it to appropriately load my roles between session restarts.

Answer 1

I think the problem might be with your mappings:
<filter>
<filter-name>myFilter</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
<filter-name>myFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>