As I currently evaluate some frameworks and how the can be used in further projects I thought ‘let’s have a look at Spring security for authentication and authorization’. You need just some simple steps to include Spring security into your Spring project.
First of all you need the necessary lib. In a Maven project just add the following dependency to your pom.xml:
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-core</artifactId>
<version>${org.springframework_spring_version}</version>
</dependency>
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-web</artifactId>
<version>${org.springframework_spring_version}</version>
</dependency>
(${org.springframework_spring_version} is set to ’3.0.5.RELEASE’ so I just have one version information for all Spring libs)
As second step you need a security context configuration file in your classpath e.g. security-applicationContext.xml:
<beans:beans xmlns="http://www.springframework.org/schema/security"
xmlns:beans="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.0.xsd">
<http use-expressions="true">
<intercept-url pattern="/**" access="permitAll" />
<form-login />
</http>
<authentication-manager>
<authentication-provider>
<user-service>
<user name="rod" password="koala" authorities="supervisor, teller, user" />
<user name="dianne" password="emu" authorities="teller, user" />
<user name="scott" password="wombat" authorities="user" />
<user name="peter" password="opal" authorities="user" />
</user-service>
</authentication-provider>
</authentication-manager>
</beans:beans>
The third step is to tell your web application to use the security filter. This is made within the web.xml. The context-param has to be edited like this:
<context-param>
<param-name>contextConfigLocation</param-name>
<param-value>
classpath:applicationContext.xml
classpath:security-applicationContext.xml
</param-value>
</context-param>
… and the filter has to be added:
<filter>
<filter-name>springSecurityFilterChain</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
<filter-name>springSecurityFilterChain</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
That’s it. BUT you will get the following error message when starting your web server (like Jetty or Tomcat):
org.springframework.beans.factory.parsing.BeanDefinitionParsingException: Configuration problem: Unable to locate Spring NamespaceHandler for XML schema namespace [http://www.springframework.org/schema/security] Offending resource: ServletContext resource [classpath:spring-applicationContext.xml]
It took me hours to solve this issue. The error message better should say, ‘You are missing a dependency…’ :/ ’cause adding
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-config</artifactId>
<version>${org.springframework_spring_version}</version>
</dependency>
to your pom.xml solves the problem.
Now you are ready to use Spring security in your web project.
