Spring Security. Can I use a namespace and a filter chain?

Question

I use spring security, and I have to use both a filter chain and a namespace. The namespace works fine, but it seems like there are no filters in the chain!
Here is my configuration. First, the namespace:

<sec:global-method-security secured-annotations="enabled" /> <sec:http pattern="/app/login.jsp*" security="none" /> <sec:http pattern="/admin/login.jsp*" security="none" /> <sec:http pattern="/app/*.png" security="none" /> <sec:http pattern="/admin/*.png" security="none" /> <sec:http pattern="/app/**" authentication-manager-ref="authenticationManager" access-decision-manager-ref="accessDecisionManager"> <sec:intercept-url pattern="/app/**" access="ROLE_USER" /> <sec:access-denied-handler error-page="/app/login.jsp?aer=" /> <sec:form-login login-processing-url="/app/j_spring_security_check" always-use-default-target="true" default-target-url="/app/index.html" login-page='/app/login.jsp' authentication-failure-url='/app/login.jsp?login_error' /> <sec:logout logout-url="/app/j_spring_security_logout" invalidate-session="true" logout-success-url="/app/login.jsp" /> </sec:http> <sec:http pattern="/admin/**" authentication-manager-ref="authenticationManager" access-decision-manager-ref="accessDecisionManager"> <sec:intercept-url pattern="/admin/**" access="ROLE_ADMIN" /> <sec:access-denied-handler error-page="/admin/login.jsp?aer=" /> <sec:form-login login-processing-url="/admin/j_spring_security_check" always-use-default-target="true" default-target-url="/admin/index.html" login-page='/admin/login.jsp' authentication-failure-url='/admin/login.jsp?login_error' /> <sec:logout logout-url="/admin/j_spring_security_logout" invalidate-session="true" logout-success-url="/admin/login.jsp" /> </sec:http> 

It works great. But I also need a filter chain to check for other queries. (These requests are dynamically created, and we need to control them this way)
This is my filter chain:

 <bean id="springSecurityFilterChain" class="org.springframework.security.web.FilterChainProxy"> <security:filter-chain-map path-type="ant"> <sec:filter-chain pattern="/css/**" filters="none" /> <sec:filter-chain pattern="/common/**" filters="none" /> <sec:filter-chain pattern="/images/**" filters="none" /> <sec:filter-chain pattern="/login.jsp*" filters="none" /> <sec:filter-chain pattern="/rest/**" filters=" ConcurrentSessionFilter, securityContextPersistenceFilter, logoutFilter, authenticationProcessingFilter, sessionManagementFilter, exceptionTranslationFilter, filterSecurityInterceptor" /> </security:filter-chain-map> </bean> 

The problem is that the filter chain does not control anything . I am sure that the filter chain works fine when namespaces are not used. But when I add namespaces, the problem begins.
What for? Can't I use this? or can I, and do I have to change something?

UPDATED:
This is my debug log when calling this resource: /rest/asrv/gtallmmbrsofusrgrp

 DEBUG AntPathRequestMatcher - Checking match of request : '/rest/asrv/gtallmmbrsofusrgrp'; against '/app/login.jsp*' DEBUG AntPathRequestMatcher - Checking match of request : '/rest/asrv/gtallmmbrsofusrgrp'; against '/admin/login.jsp*' DEBUG AntPathRequestMatcher - Checking match of request : '/rest/asrv/gtallmmbrsofusrgrp'; against '/app/*.png' DEBUG AntPathRequestMatcher - Checking match of request : '/rest/asrv/gtallmmbrsofusrgrp'; against '/admin/*.png' DEBUG AntPathRequestMatcher - Checking match of request : '/rest/asrv/gtallmmbrsofusrgrp'; against '/app/**' DEBUG AntPathRequestMatcher - Checking match of request : '/rest/asrv/gtallmmbrsofusrgrp'; against '/admin/**' DEBUG FilterChainProxy - /rest/asrv/gtallmmbrsofusrgrp has no matching filters 

Answer 1

I think you are missing the DelegatingFilterProxy entry in your web.xml. But anyway

As with Spring 3.1, FilterChainProxy is configured using a list of SecurityFilterChain instances, and FilterChainMap is deprecated. Therefore, try to configure it as follows:

 <bean id="filterChainProxy" class="org.springframework.security.web.FilterChainProxy"> <constructor-arg> <list> <sec:filter-chain pattern="/css/**" filters="none" /> <sec:filter-chain pattern="/common/**" filters="none" /> <sec:filter-chain pattern="/images/**" filters="none" /> <sec:filter-chain pattern="/login.jsp*" filters="none" /> <sec:filter-chain pattern="/rest/**" filters=" ConcurrentSessionFilter, securityContextPersistenceFilter, logoutFilter, authenticationProcessingFilter, sessionManagementFilter, exceptionTranslationFilter, filterSecurityInterceptor" /> </list> </constructor-arg> </bean> 

And add a filter to your web.xml as follows:

 <filter> <filter-name>filterChainProxy</filter-name> <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class> </filter> <filter-mapping> <filter-name>filterChainProxy</filter-name> <url-pattern>/*</url-pattern> </filter-mapping> 

API Documentation

UPDATE 1 :

To add registration to your application, just put the log file log4j in the path and add the log4j.properties file under your classpath.

Log4j.properties:

 log4j.rootCategory=INFO, stdout log4j.appender.stdout=org.apache.log4j.ConsoleAppender log4j.appender.stdout.layout=org.apache.log4j.PatternLayout log4j.appender.stdout.layout.ConversionPattern=%d{ISO8601} %-5p %c %M - %m\n log4j.category.org.springframework.security=DEBUG 

See also Logging Using Log4j

UPDATE 2 . It seems to work for me, I put the welcome.xhtml test page in the leisure directory. The debug log is as follows:

 2012-07-30 00:26:05,917 DEBUG org.springframework.security.web.util.AntPathRequestMatcher matches - Checking match of request : '/rest/welcome.xhtml'; against '/javax.faces.resource/**' 2012-07-30 00:26:05,923 DEBUG org.springframework.security.web.FilterChainProxy doFilter - /rest/welcome.xhtml at position 1 of 11 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter' 2012-07-30 00:26:05,923 DEBUG org.springframework.security.web.context.HttpSessionSecurityContextRepository readSecurityContextFromSession - No HttpSession currently exists 2012-07-30 00:26:05,923 DEBUG org.springframework.security.web.context.HttpSessionSecurityContextRepository loadContext - No SecurityContext was available from the HttpSession: null. A new one will be created. 2012-07-30 00:26:05,925 DEBUG org.springframework.security.web.FilterChainProxy doFilter - /rest/welcome.xhtml at position 2 of 11 in additional filter chain; firing Filter: 'LogoutFilter' 2012-07-30 00:26:05,925 DEBUG org.springframework.security.web.FilterChainProxy doFilter - /rest/welcome.xhtml at position 3 of 11 in additional filter chain; firing Filter: 'UsernamePasswordAuthenticationFilter' 2012-07-30 00:26:05,925 DEBUG org.springframework.security.web.FilterChainProxy doFilter - /rest/welcome.xhtml at position 4 of 11 in additional filter chain; firing Filter: 'BasicAuthenticationFilter' 2012-07-30 00:26:05,925 DEBUG org.springframework.security.web.FilterChainProxy doFilter - /rest/welcome.xhtml at position 5 of 11 in additional filter chain; firing Filter: 'RequestCacheAwareFilter' 2012-07-30 00:26:05,925 DEBUG org.springframework.security.web.FilterChainProxy doFilter - /rest/welcome.xhtml at position 6 of 11 in additional filter chain; firing Filter: 'SecurityContextHolderAwareRequestFilter' 2012-07-30 00:26:05,926 DEBUG org.springframework.security.web.FilterChainProxy doFilter - /rest/welcome.xhtml at position 7 of 11 in additional filter chain; firing Filter: 'RememberMeAuthenticationFilter' 2012-07-30 00:26:05,926 DEBUG org.springframework.security.web.FilterChainProxy doFilter - /rest/welcome.xhtml at position 8 of 11 in additional filter chain; firing Filter: 'AnonymousAuthenticationFilter' 2012-07-30 00:26:05,928 DEBUG org.springframework.security.web.authentication.AnonymousAuthenticationFilter doFilter - Populated SecurityContextHolder with anonymous token: 'org.sprin gframework.security.authentication.AnonymousAuthenticationToken@ 9055c2bc: Principal: anonymousUser; Credentials: [PROTECTED]; Authenticated: true; Details: org.sprin gframework.security.web.authentication.WebAuthenticationDetails@ b364: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: null; Granted Authorities: ROLE_ANONYMOUS' 2012-07-30 00:26:05,928 DEBUG org.springframework.security.web.FilterChainProxy doFilter - /rest/welcome.xhtml at position 9 of 11 in additional filter chain; firing Filter: 'SessionManagementFilter' 2012-07-30 00:26:05,929 DEBUG org.springframework.security.web.session.SessionManagementFilter doFilter - Requested session IDD44EAA53A767F3DC9C7338D3CD335198 is invalid. 2012-07-30 00:26:05,929 DEBUG org.springframework.security.web.FilterChainProxy doFilter - /rest/welcome.xhtml at position 10 of 11 in additional filter chain; firing Filter: 'ExceptionTranslationFilter' 2012-07-30 00:26:05,929 DEBUG org.springframework.security.web.FilterChainProxy doFilter - /rest/welcome.xhtml at position 11 of 11 in additional filter chain; firing Filter: 'FilterSecurityInterceptor' 2012-07-30 00:26:05,929 DEBUG org.springframework.security.web.util.AntPathRequestMatcher matches - Checking match of request : '/rest/welcome.xhtml'; against '/login.xhtml' 2012-07-30 00:26:05,929 DEBUG org.springframework.security.web.util.AntPathRequestMatcher matches - Checking match of request : '/rest/welcome.xhtml'; against '/*' 2012-07-30 00:26:05,929 DEBUG org.springframework.security.web.util.AntPathRequestMatcher matches - Checking match of request : '/rest/welcome.xhtml'; against '/admin/**' 2012-07-30 00:26:05,930 DEBUG org.springframework.security.web.access.intercept.FilterSecurityInterceptor beforeInvocation - Public object - authentication not attempted 2012-07-30 00:26:05,932 DEBUG org.springframework.security.web.FilterChainProxy doFilter - /rest/welcome.xhtml reached end of additional filter chain; proceeding with original chain 2012-07-30 00:26:06,229 DEBUG org.springframework.security.web.access.ExceptionTranslationFilter doFilter - Chain processed normally 

I think you have two logins that you invoke. Try to have only one login form and control the navigation after that based on the role. See this question, for example: Can I use one login page to redirect another page using Spring 3.0 Security ..?