Spring Security. Basic Authentication

Question

I am working with Spring Security 4 based on XML.

This is my configuration:

      <security:http use-expressions="true" authentication-manager-ref="authenticationManager" entry-point-ref="authenticationEntryPoint">
            <security:intercept-url pattern="/**" access="hasRole('ROLE_USER')"/>
            <security:form-login authentication-success-handler-ref="authenticationSuccessHandler"
                                 authentication-failure-handler-ref="authenticationFailureHandler"
                                 />
            <security:logout success-handler-ref="logoutSuccessHandler"/>
            <security:csrf disabled="true"/>
        </security:http>

        <security:authentication-manager id="authenticationManager">
            <security:authentication-provider>
                <security:user-service>
                    <security:user name="username" authorities="ROLE_USER" password="password"/>
                </security:user-service>
            </security:authentication-provider>
        </security:authentication-manager>

        <bean id="authenticationEntryPoint" class="package.CustomBasicAuthenticationEntryPoint">

authenticationEntryPoint has the following implementation:

public class CustomBasicAuthenticationEntryPoint implements AuthenticationEntryPoint {

    @Override
    public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException e) throws IOException, ServletException {

        response.sendError(HttpServletResponse.SC_UNAUTHORIZED);
    }
}

The problem is when trying to authenticate:

http://localhost:8080/myApp/api/j_spring_security_check with body: j_password=password&j_username=username

I always have error 401 due to my user entry point. It seems to me that Spring Security does not call the authentication manager. Did I miss something?

Thanks for the help.

Update

Thanks for your answers, I worked with Spring Security 3.2, I changed j_username, j_password and j_spring_security_check to username, password and login. I still have the same problem: 401 code status: Spring Security triggers user authentication by EnterPoint even when I try to authenticate using a form (POST).

Answer 1

web.xml url Spring Security filterchain : /api/*

url- URL- login-processing-url: "/api/" (login-form), :

login-processing-url="/api/login" 

.

Answer 2

Spring 4 URL- :

http://localhost:8080/myApp/login

(j_spring_security_check .)

, HTTP.

Answer 3

Spring 4 j_username j_password username password. , xml-. --url j_spring_security_check login. .

Answer 4

:

• @holmis83, URL- login, . Spring :

  • login-processing-url filterProcessesUrl UsernamePasswordAuthenticationFilter. - "/login".

• @pomkine, username password, . Spring :

  • -. , . "".
  • _. , . " ".

• HTTP POST, . UsernamePasswordAuthenticationFilter # setPostOnly:

  , HTTP- POST. true, , POST-, , . unsuccessfulAuthentication() , . true, .

• @holmis83 , form-login, HTTP Basic Authentication, . Spring :

  ,

  <http use-expressions="false">
      <intercept-url pattern="/**" access="ROLE_USER" />
      <http-basic />
  </http>
  

  Basic authentication will take precedence and will be used to request login when a user tries to access a secure resource. Registration of the form is still available in this configuration if you want to use it, for example, through the login form embedded in another web page.