Announcement

**nitroamos** · 28 May 2015, 08:36

I'd appreciate any advice to help me track down the problem! Here's a quick summary:

1. I believe I've followed the instructions correctly, but I'm losing the transaction during relogin.

2. I'm not using Smart GWT. I couldn't figure out how to implement loginSuccessMarker.html with Spring Security 4.

**atlanticdecisionsciences** · 29 Nov 2015, 08:46

I've spent a few days upgrading to Spring Security 4.0.3 and thought I would share my findings with the community. Note that my upgrade to Spring 4 is based on the fine work described in post

http://forums.smartclient.com/showthread.php?t=9633

I make no claims that this is a perfect implementation nor am I a Spring Security expert. I post this with the sole intent of helping other smartGWT users make the transition to Spring 4. Use at your own risk.

Changes to Entry Point to comply with Spring Security 4: CREDENTIALS_URL changed to /login. J_PASSWORD variable changed to "password". J_USERNAME variable changed to "username".

Code:

public class WebGUI implements EntryPoint {
private static final String CREDENTIALS_URL="/login";
private LoginWindow loginWindow;
private LoginForm loginForm;


public void onModuleLoad() {

RPCManager.setLoginRequiredCallback(new LoginRequiredCallback(){
            @Override
            public void loginRequired(int i, RPCRequest rpcRequest, RPCResponse rpcResponse) {
                raiseLoginWindow();
            }
        });

}

protected void raiseLoginWindow(){
         if(loginWindow==null)
             loginWindow=new LoginWindow();
         if(!(loginWindow.isVisible() && loginWindow.isDrawn())){
             loginForm.clearValues();
             loginForm.focusInItem("username");
         }
         loginWindow.show();
         loginWindow.bringToFront();    
    }

public class LoginWindow extends Window {
         
        private static final int PADDING = 50;
        private static final int LOGIN_LAYOUT_WIDTH = 533;
        private static final int SPACER_HEIGHT = 180;
        private static final String LOGIN_BACKGROUND_PNG = "login_background.png";
        private static final int LOGIN_HEIGHT = 487;
        private static final int LOGIN_WIDTH = 545;
        private static final int LOGIN_LEFT = 400;
        private static final int LOGIN_TOP = 150;

        public LoginWindow(){
            this.setTop(LOGIN_TOP);
            this.setLeft(LOGIN_LEFT);  
            this.setWidth(LOGIN_WIDTH);
            this.setHeight(LOGIN_HEIGHT);
            this.setShowHeader(false);
            //this.setBackgroundImage("login_background.png");
            //this.setMargin(120);
            
            VLayout loginLayout = new VLayout();
            loginLayout.setBackgroundImage(LOGIN_BACKGROUND_PNG);       
            loginLayout.setWidth(LOGIN_LAYOUT_WIDTH);          
            LayoutSpacer spacer = new LayoutSpacer();
            spacer.setHeight(SPACER_HEIGHT);
            loginLayout.addMember(spacer);
            
            loginForm=new LoginForm(CREDENTIALS_URL);
            loginForm.setPadding(PADDING);
            setShowModalMask(true);
            //centerInPage();
            setShowCloseButton(false);
            setShowMinimizeButton(false);
            setIsModal(true);
            //setAutoSize(true);
            loginLayout.addMember(loginForm);          
            addItem(loginLayout);
        }
    }

    private class LoginForm extends DynamicForm {
        private static final int COLUMN_2_WIDTH = 125;
        private static final int COLUMN_1_WIDTH = 150;
        private static final int NUMBER_OF_COLUMNS = 2;
        private static final int LOGIN_FORM_WIDTH = 520;
        //private static final String J_PASSWORD = "j_password";
        //private static final String J_USERNAME = "j_username";
        private static final String J_PASSWORD = "password";
        private static final String J_USERNAME = "username";
        private static final String ENTER = "Enter";
        private static final String PASSWORD = "password";
        private static final String USERNAME = "username";
        private static final String FORM_CELL_ERROR = "formCellError";
        private static final String LOGIN_FAILURE = "loginFailure";
        private String credentialsURL;

        public LoginForm(String credentialsURL){
            //this.setBackgroundColor("gray");
            this.setWidth(LOGIN_FORM_WIDTH);
            this.setNumCols(NUMBER_OF_COLUMNS);
            this.setColWidths(COLUMN_1_WIDTH, COLUMN_2_WIDTH); 
             
            this.credentialsURL=credentialsURL;
            BlurbItem blurbItem=new BlurbItem(LOGIN_FAILURE);
            blurbItem.setVisible(false);
            blurbItem.setColSpan(2);
            blurbItem.setDefaultValue(constants.Invalid_User_Name_or_Password());
            blurbItem.setCellStyle(FORM_CELL_ERROR);
        
            TextItem textItem=new TextItem(USERNAME);
            //textItem.setTitleStyle("loginFailure");
            textItem.setTitle(constants.UserName());
            textItem.setTitleOrientation(TitleOrientation.LEFT);
            textItem.addKeyPressHandler(new KeyPressHandler(){
                @Override
                public void onKeyPress(KeyPressEvent keyPressEvent) {
                    if(keyPressEvent.getKeyName().equals(ENTER)){
                        focusInItem(PASSWORD);
                    }
                }
            });
            PasswordItem passwordItem=new PasswordItem(PASSWORD);
            passwordItem.setTitle(constants.Password());
            passwordItem.setTitleOrientation(TitleOrientation.LEFT);
            passwordItem.addKeyPressHandler(new KeyPressHandler(){
                @Override
                public void onKeyPress(KeyPressEvent keyPressEvent) {
                    if(keyPressEvent.getKeyName().equals(ENTER)){
                        doLogin();
                    }
                }
            });
              
            ButtonItem buttonItem=new ButtonItem(constants.Login());
            buttonItem.setAlign(Alignment.RIGHT);
             buttonItem.addClickHandler(new ClickHandler(){
                @Override
                public void onClick(ClickEvent clickEvent) {
                    doLogin();
                }
            });
            setFields(blurbItem, textItem,passwordItem,buttonItem);
        }

        public void doLogin(){
            RPCRequest request=new RPCRequest();
            request.setContainsCredentials(true);
            request.setActionURL(credentialsURL);
            request.setUseSimpleHttp(true);
            request.setShowPrompt(false);
            Map<String,String> params=new HashMap<String,String>();
            final String userName = getValueAsString(USERNAME);
            params.put(J_USERNAME,getValueAsString(USERNAME));
            params.put(J_PASSWORD,getValueAsString(PASSWORD));
            request.setParams(params);
            RPCManager.sendRequest(request,new RPCCallback(){
                @Override
                public void execute(RPCResponse response, Object rawData, RPCRequest request) {
                    clearValues();
                    if(response.getStatus()==RPCResponse.STATUS_SUCCESS){
                        hideItem(LOGIN_FAILURE);
                        
                        AuthService.CommandApp.getInstance().retrieveUsername(new AsyncCallback<String>(){

                            @Override
                            public void onFailure(Throwable caught) {
                                Log.warn("Unable to retrieve user name.  Logged in user label on toolbar will be blank");            
                            }

                            @Override
                            public void onSuccess(String result) {
                                 setLoggedInUser(result);
                                 getMain().setOpacity(100);
                            }
                            
                        });
                                                           
                        
                        RPCManager.resendTransaction();
                        loginWindow.hide();
                    }else if(response.getStatus()==RPCResponse.STATUS_LOGIN_INCORRECT){
                        Log.warn("Login failed");
                        showItem(LOGIN_FAILURE);
                    }else if(response.getStatus()==RPCResponse.STATUS_MAX_LOGIN_ATTEMPTS_EXCEEDED){
                        SC.warn("Max login attempts exceeded.");
                    }
                    focusInItem(USERNAME);
                }
            });
        }
    }

Below is a logout hyperlink that I have enabled in another part of my smartGWT gui. It completes a Spring security logout, sets the opacity of the main window to 2 so it is "invisible", and raises the logout window again.

Code:

...
private static final String LOGOUT_URL="/logout";

private Canvas getLogoutLink(){
        DynamicForm genericHyperlinkForm = new DynamicForm();
        genericHyperlinkForm.setNumCols(1);
        genericHyperlinkForm.setColWidths(110);
        LinkItem logoutLink = new LinkItem();
        logoutLink.setShowTitle(false);
        logoutLink.setWidth(100);
        logoutLink.setAlign(Alignment.LEFT);
        logoutLink.setLinkTitle(constants.Logout());
        logoutLink.setTooltip(constants.Logout_of_Atlantic());

        logoutLink.addClickHandler(new com.smartgwt.client.widgets.form.fields.events.ClickHandler() {

            @Override
            public void onClick(com.smartgwt.client.widgets.form.fields.events.ClickEvent event) {
                Log.info("Responding to Logout Hyperlink");
                doLogOut();
                webGUI.raiseLoginWindow();
                webGUI.getMain().setOpacity(2);
                
            }
            });  //  end on click
     
         
        genericHyperlinkForm.setFields(logoutLink);
        genericHyperlinkForm.setSize("125px", "20px");
        return genericHyperlinkForm;
            
    }

public void doLogOut(){
        Log.info("Managing logout.  Logout url is "+LOGOUT_URL);
         RPCRequest request=new RPCRequest();
        // request.setContainsCredentials(true);
         request.setActionURL(LOGOUT_URL);
         request.setUseSimpleHttp(true);
         request.setShowPrompt(false);     
         RPCManager.sendRequest(request,new RPCCallback(){
             @Override
             public void execute(RPCResponse response, Object rawData, RPCRequest request) {
                
                 if(response.getStatus()==RPCResponse.STATUS_SUCCESS){
                    Log.info("Logged out");
                    
                   
                     
                 }else {
                     Log.warn("Log Out Failed.");
                 
                 }
              }
         });
     
        
    }

There are no changes required to the BiztrackAuthenticationEntryPoint, BiztrackAuthenticationFailureHandler, BiztrackAuthenticationSuccessHandler, BiztrackConcurrentSessionFilter, BiztrackInvalidSessionHandler, BiztrackMarkerResponseHandler or InvalidSessionHandler described by the original Spring 3 Security post above.

My Spring applicationcontext.xml. Note that I have renamed many of the original "biztrack" classes to "Atlantic" to conform with my application naming conventions. Passwords are encoded using Spring 4's upgraded bcrypt algorithm. I obtain the user and password from a custom user details service that looks up the info from a Mongo database. Key changes from the original Spring 3 Security post include :

Disabling csrf.
Adding <logout> information pointing to the url to go to upon successful logout.
Disabling content-type-options which caused problems in the chrome browser
Specifying the bcrypt decoder
Adding my custom mongo UserDetailsService

Code:

<?xml version="1.0" encoding="UTF-8"?>
 
<beans:beans xmlns="http://www.springframework.org/schema/security"
    xmlns:beans="http://www.springframework.org/schema/beans"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
    http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd">


    <!--    must disable spring csrf support for smartgwt to work    -->
      <http entry-point-ref="authenticationEntryPoint" use-expressions="false">
        <custom-filter position="CONCURRENT_SESSION_FILTER" ref="concurrencyFilter"/>
        <custom-filter position="FORM_LOGIN_FILTER" ref="formLoginFilter"/>
        <anonymous enabled="false"/>
        <csrf disabled="true"/>
        <intercept-url pattern="/Atlantic/sc/IDACall*" access="ROLE_USER"/>
        <access-denied-handler ref="accessDeniedHandler"/>
        <session-management session-authentication-strategy-ref="sessionAuthenticationStrategy"/>
        <logout invalidate-session="true" logout-success-url="/Atlantic.html"/>
        
        <headers defaults-disabled="true">
            <cache-control/>
            <hsts />
            <xss-protection/>
            <frame-options/>
            <!--   disable the content type options below so Atlantic works in Chrome-->
            <!--   >content-type-options/-->
        </headers>
        
    </http>
    
    
    <authentication-manager alias="authenticationManager">
        <authentication-provider ref="daoAuthenticationProvider"/>
      </authentication-manager>
   
      
      <beans:bean id="encoder" class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder"/>
 
  
    <beans:bean id="formLoginFilter" class="org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter">
        <beans:property name="sessionAuthenticationStrategy" ref="sessionAuthenticationStrategy"/>
        <beans:property name="authenticationManager" ref="authenticationManager"/>
        <beans:property name="authenticationSuccessHandler">
            <beans:bean class="com.atlanticds.server.Authentication.AtlanticAuthenticationSuccessHandler"/>
        </beans:property>
        <beans:property name="authenticationFailureHandler">
            <beans:bean class="com.atlanticds.server.Authentication.AtlanticAuthenticationFailureHandler"/>
        </beans:property>
    </beans:bean>

    <beans:bean id="authenticationEntryPoint"  class="com.atlanticds.server.Authentication.AtlanticAuthenticationEntryPoint"/>

    <beans:bean id="accessDeniedHandler"  class="org.springframework.security.web.access.AccessDeniedHandlerImpl">
        <beans:property name="errorPage" value="/accessDenied.htm"/>
    </beans:bean>

    <beans:bean id="concurrencyFilter" class="com.atlanticds.server.Authentication.AtlanticConcurrentSessionFilter">
        <beans:property name="sessionRegistry" ref="sessionRegistry"/>
        <beans:property name="invalidSessionHandler">
            <beans:bean class="com.atlanticds.server.Authentication.AtlanticInvalidSessionHandler"/>
        </beans:property>
    </beans:bean>

    <beans:bean id="sessionAuthenticationStrategy" class="org.springframework.security.web.authentication.session.ConcurrentSessionControlAuthenticationStrategy">
        <beans:constructor-arg name="sessionRegistry" ref="sessionRegistry"/>
        <beans:property name="maximumSessions" value="1"/>
    </beans:bean>
    
    <beans:bean id="sessionRegistry" class="org.springframework.security.core.session.SessionRegistryImpl"/>
     
    <beans:bean id="customAuthListener"    class="com.atlanticds.server.Authentication.CustomAuthListener" />
    
    
     
    <!--     Spring authentication for login   -->
    <beans:bean id="mongoUserDetailsService"    class="com.atlanticds.server.Authentication.MongoUserDetailsService">
    </beans:bean>

    
     <beans:bean id="daoAuthenticationProvider"    class="org.springframework.security.authentication.dao.DaoAuthenticationProvider">
        <beans:property name="userDetailsService" ref="mongoUserDetailsService" />
          <beans:property name="passwordEncoder" ref="encoder" />
    </beans:bean>

web.xml is unchanged.

Additional Spring dependencies in my maven pom:

Code:

<properties>
        <gwtVersion>2.7.0</gwtVersion>  
        <org.springframework-version>4.2.3.RELEASE</org.springframework-version>
        <org.springframework.security-version>4.0.3.RELEASE</org.springframework.security-version>
    </properties>
<dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-beans</artifactId>
            <version>${org.springframework-version}</version>
        </dependency>
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-aop</artifactId>
            <version>${org.springframework-version}</version>
        </dependency>
        
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-context</artifactId>
            <version>${org.springframework-version}</version>
        </dependency>
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-core</artifactId>
            <version>${org.springframework-version}</version>
        </dependency>

        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-web</artifactId>
            <version>${org.springframework-version}</version>
        </dependency>
        
        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-core</artifactId>      
            <version>${org.springframework.security-version}</version>
        </dependency>
        
        
        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-web</artifactId>
            <version>${org.springframework.security-version}</version>
        </dependency>
        
        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-config</artifactId>
            <version>${org.springframework.security-version}</version>
        </dependency>

**Isomorphic** · 30 Nov 2015, 17:34

Thanks for posting this! That change of the username/password parameter is enough to confuse people trying to apply the Spring 3 solution via copy-and-paste, this should help them past it.

Announcement

Implementing Relogin with Spring Security

Comment

Comment

Comment