Springsecutiry and JNDI Authentication Problem

Asked

Viewed 141 times

1

I have an authentication problem when I add the datasource in my project, it happens that when trying to login the authentication is performed but not the transition to the post-login page. I use the custom Userdetailsservice, get the connection to the bank, but can not authenticate, and no error appears my xml context. is :

i <Resource auth="Container" 
          name="jdbc/dbtest" 
          type="javax.sql.DataSource" 
          maxActive="100" 
          maxIdle="10" 
          maxWait="-1" 
          username="test" 
          password="test"
          driverClassName="com.mysql.jdbc.Driver"
          url="jdbc:mysql://localhost:3306/dbteste?autoReconnect=true"
          debugMode="true"
          validationQuery="SELECT 1">

My Hibernate.cfg.xml is like this:

i <session-factory>

    <property name="hibernate.dialect">org.hibernate.dialect.MySQLDialect</property>
    <property name="hibernate.connection.datasource">java:comp/env/jdbc/dbtest</property><property name="hibernate.hbm2ddl.auto">update</property>
    <property name="hibernate.format_sql">true</property>
    <property name="hibernate.show_sql">true</property>
    <property name="connection.shutdown">true</property>

My applicationContext is like this:

<jee:jndi-lookup expected-type="javax.sql.DataSource" id="securityDataSource" jndi-name="jdbc/dbtest"></jee:jndi-lookup>    
<b:bean id="loginBean" name="authenticationService" class="br.com.app.controller.AuthenticationService">
    <b:property name="authenticationManager" ref="authenticationManager"></b:property>
</b:bean>
<http auto-config="true" use-expressions="true" access-denied-page="/index.xhtml"> 
  <form-login login-page="/login.xhtml" 
         always-use-default-target="true"
         default-target-url="/cadastro/central.xhtml"
         authentication-failure-url="/login.xhtml?login_error=1" />
  <logout invalidate-session="true" 
            logout-success-url="/index.xhtml" 
            delete-cookies="JSESSION"/>
</http>
<authentication-manager alias="authenticationManager"> 
    <authentication-provider user-service-ref="userDetailsService">
    </authentication-provider>
</authentication-manager>
<b:bean id="userDetailsService" class="br.com.app.controller.UserDetailsServiceImpl"/>

web.xml is like this:

<resource-ref>
     <description>DataSource</description>
    <res-ref-name>jdbc/dbtest</res-ref-name>
    <res-type>javax.sql.DataSource</res-type>
    <res-auth>Container</res-auth>
</resource-ref>

And the implementation of Userdetailsserviceimp is like this:

public class UserDetailsServiceImpl implements UserDetailsService{

private UsuarioDAO us;
@PersistenceContext
private Session sessao;

 public UserDetailsServiceImpl() {
     us = new UsuarioDAO();
    }

 @Override
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
    return findByUsername(username);
}

private Usuario findByUsername(String username) {
    Usuario login;
    sessao = us.getSession();
    try {
        System.out.println("Entrou na Classe UserDetaisServiceImpl e procurando o usuário");
        Criteria cr = sessao.createCriteria(Usuario.class);
        cr.add(Restrictions.eq("email", username));

        login = (Usuario) cr.uniqueResult();
        System.out.println("Login: "+login.toString());
        if (login == null) {
            FacesContext.getCurrentInstance().addMessage("Info", new FacesMessage(FacesMessage.SEVERITY_ERROR, "UserDetailsService: Não foi possivel fazer login, sua lincença expirou ou o login foi digitado incorretamente", "Esse usuário não existe!"));
        }
        if (!login.isCredentialsNonExpired()) {
            FacesContext.getCurrentInstance().addMessage("Info", new FacesMessage(FacesMessage.SEVERITY_ERROR, "UserDetailsService: Não foi possivel fazer login, licença expirou", "Favor tente novamente!"));
            return null;
        } else {
            return login;
        }
    } catch (NoResultException e) {
        e.printStackTrace();
        throw new UsernameNotFoundException("UserDetailsService: Usuario nao encontrado: " + e.getMessage());
    } finally {
        sessao.close();
    }
}

I tested here using a login that does not exist and returns that the login is wrong, I have tried several ways and can not, can not make the transition from login page to post-login page.

  • One possibility is that your login page is not correctly sending data to spring security. See if the field names are following the pattern in the HTTP request. JSF is champion at spoiling names. You came to debug and see if the authentication code gets executed?

  • Yes @utluiz he does authentication, but at the time of transition will not.

  • Right, but if you manually type the post-login page it will? Or it always redirects to the login again?

  • Another thing, I’m not seeing where you define the ROLES of the application. Type: <intercept-url pattern='/login.htm*' filters='none'/>&#xA; <intercept-url pattern='/**' access='ROLE_USER' />. Also, your user brings some role or is empty?

  • The answer to your first question, @utluiz, does not go when I post login page, and does not redirect to login page, already your second omit, because the code would be too big.

  • The interesting thing is that when I stop at Tomcat, it runs the methods that are normally executed after login.

  • Redirect problems are usually caused because the user does not have the permission to see the post-login page and it ends up being redirected back as if there was a fault. But to solve this you have to investigate the case in every detail.

  • <intercept-url pattern="/cadastro/*" access="isAuthenticated()"/>

  • <intercept-url pattern="/cadastro/*" access="isAuthenticated()"/>&#xA;<intercept-url pattern="/info/*" access="permitAll"/> I believe it is not, because in the info page the user enters, and when he is doing the authentication is demonstrated in the console Authentication is satisfactory: true

Show 4 more comments
No answers

Browser other questions tagged

You are not signed in. Login or sign up in order to post.