Hi all,
While upgrading our project from Spring 4.x to Spring 5.3. Used GWT version as 2.11 and Java as 17. We are facing issues with the code. We have made code changes compatible with Spring 5.x. However, when running the tomcat, the login page is blank and throws an exception as 403. Which is shown in the attachment file.
Please find the code details
Spring configuration
The below code is used to load the necessary details before the login page rendered.
On the getUserService().getUserDetails used to get userDetails was implemented in two ways as below
Creating an interface to have a method for getUserDetails
Another way is to create via extends RemoteService
The below code is used to create the reference to call the server-side.
When the call is triggered on getUserService().getUserDetails(new AsyncCallback<IpUserDetailsDTO>() {..}
Expected to call the getUserDetails() in the IpAuthenticationService as below.
It was calling to another part of the class and returned as a 403 exception.
Can you guys give some thoughts and what I am missing here?
Thanks
While upgrading our project from Spring 4.x to Spring 5.3. Used GWT version as 2.11 and Java as 17. We are facing issues with the code. We have made code changes compatible with Spring 5.x. However, when running the tomcat, the login page is blank and throws an exception as 403. Which is shown in the attachment file.
Please find the code details
Spring configuration
security:http entry-point-ref="authenticationEntryPoint">
<security:custom-filter position="CONCURRENT_SESSION_FILTER" ref="concurrencyFilter"/>
<security:custom-filter position="FORM_LOGIN_FILTER" ref="formLoginFilter"/>
<security:anonymous enabled="false"/>
<security:intercept-url pattern="/ipgui/sc/*" access="ROLE_USER"/>
<security:intercept-url pattern="/sc/*" access="ROLE_USER"/>
<security:logout success-handler-ref="logoutSuccessHandler"/>
<!--
<security:intercept-url pattern="/ipgui/sc/IDACall*" access="ROLE_USER"/>
-->
<security:access-denied-handler ref="accessDeniedHandler"/>
<security:session-management session-authentication-strategy-ref="sessionAuthenticationStrategy"/>
</security:http>
<bean id="authenticationEntryPoint"
class="com.islandpacific.gui.security.IpAuthenticationEntryPoint"/>
<security:authentication-manager alias="authenticationManager">
<security:authentication-provider ref='userDetailsAuthenticationProvider'/>
</security:authentication-manager>
<bean id="userDetailsAuthenticationProvider"
class="com.islandpacific.gui.security.IpUserDetailsAuthenticationProvider">
</bean>
<bean id="formLoginFilter"
class="com.islandpacific.gui.security.IpLoginFilter">
<property name="sessionAuthenticationStrategy" ref="sessionAuthenticationStrategy"/>
<property name="authenticationManager" ref="authenticationManager"/>
<property name="authenticationSuccessHandler">
<bean class="com.islandpacific.gui.security.IpAuthenticationSuccessHandler"/>
</property>
<property name="authenticationFailureHandler">
<bean class="com.islandpacific.gui.security.IpAuthenticationFailureHandler"/>
</property>
</bean>
<bean id="accessDeniedHandler"
class="org.springframework.security.web.access.AccessDeniedHandlerImpl">
<property name="errorPage" value="/accessDenied.html"/>
</bean>
<bean id="concurrencyFilter" class="com.islandpacific.gui.security.IpConcurrentSessionFilter">
<property name="sessionRegistry" ref="sessionRegistry"/>
<property name="invalidSessionHandler">
<bean class="com.islandpacific.gui.security.IpInvalidSessionHandler"/>
</property>
</bean>
<!-- org.springframework.security.web.authentication.session.ConcurrentSessionControlAuthenticationStrategy-->
<!-- old one ConcurrentSessionControlStrategy -->
<bean id="sessionAuthenticationStrategy" class="org.springframework.security.web.authentication.session.ConcurrentSessionControlAuthenticationStrategy">
<constructor-arg name="sessionRegistry" ref="sessionRegistry"/>
<property name="maximumSessions" value="4"/>
</bean>
<bean id="sessionRegistry" class="org.springframework.security.core.session.SessionRegistryImpl"/>
<bean id="logoutSuccessHandler" class="com.islandpacific.gui.security.IpLogoutSuccessHandler" />
<security:custom-filter position="CONCURRENT_SESSION_FILTER" ref="concurrencyFilter"/>
<security:custom-filter position="FORM_LOGIN_FILTER" ref="formLoginFilter"/>
<security:anonymous enabled="false"/>
<security:intercept-url pattern="/ipgui/sc/*" access="ROLE_USER"/>
<security:intercept-url pattern="/sc/*" access="ROLE_USER"/>
<security:logout success-handler-ref="logoutSuccessHandler"/>
<!--
<security:intercept-url pattern="/ipgui/sc/IDACall*" access="ROLE_USER"/>
-->
<security:access-denied-handler ref="accessDeniedHandler"/>
<security:session-management session-authentication-strategy-ref="sessionAuthenticationStrategy"/>
</security:http>
<bean id="authenticationEntryPoint"
class="com.islandpacific.gui.security.IpAuthenticationEntryPoint"/>
<security:authentication-manager alias="authenticationManager">
<security:authentication-provider ref='userDetailsAuthenticationProvider'/>
</security:authentication-manager>
<bean id="userDetailsAuthenticationProvider"
class="com.islandpacific.gui.security.IpUserDetailsAuthenticationProvider">
</bean>
<bean id="formLoginFilter"
class="com.islandpacific.gui.security.IpLoginFilter">
<property name="sessionAuthenticationStrategy" ref="sessionAuthenticationStrategy"/>
<property name="authenticationManager" ref="authenticationManager"/>
<property name="authenticationSuccessHandler">
<bean class="com.islandpacific.gui.security.IpAuthenticationSuccessHandler"/>
</property>
<property name="authenticationFailureHandler">
<bean class="com.islandpacific.gui.security.IpAuthenticationFailureHandler"/>
</property>
</bean>
<bean id="accessDeniedHandler"
class="org.springframework.security.web.access.AccessDeniedHandlerImpl">
<property name="errorPage" value="/accessDenied.html"/>
</bean>
<bean id="concurrencyFilter" class="com.islandpacific.gui.security.IpConcurrentSessionFilter">
<property name="sessionRegistry" ref="sessionRegistry"/>
<property name="invalidSessionHandler">
<bean class="com.islandpacific.gui.security.IpInvalidSessionHandler"/>
</property>
</bean>
<!-- org.springframework.security.web.authentication.session.ConcurrentSessionControlAuthenticationStrategy-->
<!-- old one ConcurrentSessionControlStrategy -->
<bean id="sessionAuthenticationStrategy" class="org.springframework.security.web.authentication.session.ConcurrentSessionControlAuthenticationStrategy">
<constructor-arg name="sessionRegistry" ref="sessionRegistry"/>
<property name="maximumSessions" value="4"/>
</bean>
<bean id="sessionRegistry" class="org.springframework.security.core.session.SessionRegistryImpl"/>
<bean id="logoutSuccessHandler" class="com.islandpacific.gui.security.IpLogoutSuccessHandler" />
The below code is used to load the necessary details before the login page rendered.
Code:
public static void init(final IpCompletionCallback<IpUserDetailsDTO> callback) {
getUserService().getUserDetails(new AsyncCallback<IpUserDetailsDTO>() {
@Override
public void onSuccess(IpUserDetailsDTO result) {
myUserDetails = result;
loadAllApplications();
loadAllEnvironments();
callback.onSuccess(myUserDetails);
}
@Override
public void onFailure(Throwable caught) {
caught.printStackTrace();
callback.onFailure(caught);
}
});
}
Creating an interface to have a method for getUserDetails
Code:
public interface IpAuthenticationServiceAsync {
public void getUserDetails(AsyncCallback<IpUserDetailsDTO> callback);
public void isActivityAuthorized(String activityName, AsyncCallback<Boolean> callback);
public void findGridStateForComponent(String componentName, AsyncCallback<String> callback);
public void changePassword(String userId, String oldPassword, String newPassword, AsyncCallback<String> callback);
}
Code:
@RemoteServiceRelativePath("authentication")
public interface IpAuthenticationService extends RemoteService {
public IpUserDetailsDTO getUserDetails();
public boolean isActivityAuthorized(String activityName);
public String findGridStateForComponent(String componentName);
public String changePassword(String userId, String oldPassword, String newPassword);
}
The below code is used to create the reference to call the server-side.
Code:
IpAuthenticationServiceAsync myUserService= null;
private static IpAuthenticationServiceAsync getUserService() {
if (myUserService == null) {
myUserService = (IpAuthenticationServiceAsync) GWT.create(IpAuthenticationService.class);
}
return myUserService;
}
Expected to call the getUserDetails() in the IpAuthenticationService as below.
Code:
@SuppressWarnings("serial")
public class IpAuthenticationServiceImpl extends RemoteServiceServlet implements
IpAuthenticationService {
private static Logger log = new Logger(IpAuthenticationServiceImpl.class.getName());
private static final long serialVersionUID = 1L;
@Override
public IpUserDetailsDTO getUserDetails() {
IpUserDetailsDTO userDetailsDTO = new IpUserDetailsDTO();
Code:
public class IpAuthenticationManager {
.
public static IpUserDetails getUserDetails() {
if (getUserDetailsOverride() != null) {
return getUserDetailsOverride();
}
Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
if (authentication == null) {
return null;
}
IpUserDetails userDetails = (IpUserDetails) authentication.getprincipal();
return userDetails;
}
Can you guys give some thoughts and what I am missing here?
Thanks
Attached Files
Comment