Spring security Configuration

[Samar Land]

Hi All,
I''m adding login to my application, whenever I add the filter into my web.xml I get this error when I start up the server in localhost.log:

04-Nov-2015 11:30:06.621 SEVERE [localhost-startStop-1] org.apache.catalina.core.StandardContext.listenerStart Exception sending context initialized event to listener instance of class org.springframework.web.context.ContextLoaderListener
 org.springframework.beans.factory.BeanCreationException: [b]Error creating bean with name 'org.springframework.security.filterChains':[/b] Cannot resolve reference to bean 'org.springframework.security.web.DefaultSecurityFilterChain#0' while setting bean property 'sourceList' with key [0]; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.springframework.security.web.DefaultSecurityFilterChain#0': Cannot resolve reference to bean 'org.springframework.security.web.access.intercept.FilterSecurityInterceptor#0' while setting constructor argument with key [12]; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.springframework.security.web.access.intercept.FilterSecurityInterceptor#0': Cannot create inner bean '(inner bean)' of type [org.springframework.security.web.access.expression.ExpressionBasedFilterInvocationSecurityMetadataSource] while setting bean property 'securityMetadataSource'; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name '(inner bean)#43': Instantiation of bean failed; nested exception is org.springframework.beans.BeanInstantiationException: Could not instantiate bean class [org.springframework.security.web.access.expression.ExpressionBasedFilterInvocationSecurityMetadataSource]: Constructor threw exception; nested exception is java.lang.IllegalArgumentException: Failed to parse expression 'ROLE_ADMIN,ROLE_REGULAR_USER'
	at org.springframework.beans.factory.support.BeanDefinitionValueResolver.resolveReference(BeanDefinitionValueResolver.java:328)
	at org.springframework.beans.factory.support.BeanDefinitionValueResolver.resolveValueIfNecessary(BeanDefinitionValueResolver.java:107)
	at org.springframework.beans.factory.support.BeanDefinitionValueResolver.resolveManagedList(BeanDefinitionValueResolver.java:351)
	at org.springframework.beans.factory.support.BeanDefinitionValueResolver.resolveValueIfNecessary(BeanDefinitionValueResolver.java:154)
	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.applyPropertyValues(AbstractAutowireCapableBeanFactory.java:1456)
	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.populateBean(AbstractAutowireCapableBeanFactory.java:1197)
	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:537)
	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:475)
	at org.springframework.beans.factory.support.AbstractBeanFactory$1.getObject(AbstractBeanFactory.java:304)
	at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:228)
	at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:300)
	at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:195)
	at org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingletons(DefaultListableBeanFactory.java:681)
	at org.springframework.context.support.AbstractApplicationContext.finishBeanFactoryInitialization(AbstractApplicationContext.java:760)
	at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:482)
	at org.springframework.web.context.ContextLoader.configureAndRefreshWebApplicationContext(ContextLoader.java:403)
	at org.springframework.web.context.ContextLoader.initWebApplicationContext(ContextLoader.java:306)

I added this part to dispatcher-servlet.xml file

	 <security:global-method-security secured-annotations="enabled"/>
	
	 <security:http auto-config="true" use-expressions="true">
		<security:intercept-url pattern="/main.do" access="ROLE_ADMIN,ROLE_REGULAR_USER" />
		<security:form-login login-page="/login.do" default-target-url="/main.do"
			authentication-failure-url="/loginfail.do"/>
	</security:http>

	<security:authentication-manager>
		<security:authentication-provider>
			<security:user-service>
				<security:user name="alpha" password="pass1" authorities="ROLE_ADMIN"/>
				<security:user name="beta" password="pass2" authorities="ROLE_REGULAR_USER"/>
			</security:user-service>
		</security:authentication-provider>
	</security:authentication-manager>

web.xml

    <listener>
		<listener-class>org.springframework.web.util.Log4jConfigListener</listener-class>
	</listener>
	<servlet>
		<servlet-name>dispatcher</servlet-name>
		<servlet-class>
			org.springframework.web.servlet.DispatcherServlet
		</servlet-class>
		<load-on-startup>1</load-on-startup>
	</servlet>
 
	<servlet-mapping>
		<servlet-name>dispatcher</servlet-name>
		<url-pattern>/</url-pattern>
	</servlet-mapping>
 
	<context-param>
		<param-name>contextConfigLocation</param-name>
		<param-value>/WEB-INF/dispatcher-servlet.xml
		</param-value>
	</context-param>

	<listener>
	    <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
	</listener>
	
	<!-- Spring Security Filter -->
    <filter>
	    <filter-name>springSecurityFilterChain</filter-name>
	    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
	</filter>
	<filter-mapping>
	    <filter-name>springSecurityFilterChain</filter-name>
	    <url-pattern>/*</url-pattern>
	</filter-mapping>

LoginController.java

	@RequestMapping(value = { "/login.do" }, method = { RequestMethod.GET, RequestMethod.HEAD })
	public ModelAndView showLoginPage() {
		return new ModelAndView("login");
	}
	
	
	@RequestMapping(value = { "/loginfail.do" }, method = { RequestMethod.GET })
	public ModelAndView showLoginFailPage() {
		return new ModelAndView("loginfail");
	}
	
	@Secured("ROLE_REGULAR_USER")
	@RequestMapping(value = { "/main.do" }, method = { RequestMethod.GET })
	public ModelAndView showHomePage(ModelMap model, Principal principal) {
		ModelAndView view = new ModelAndView("home");
		String name = principal.getName();
		model.addAttribute("username", name);
		return view;
	}
	
	@RequestMapping(value="/logout.do", method = RequestMethod.GET)
	public ModelAndView logout(ModelMap model) {
		return showLoginPage();
	}
	
	@Secured("ROLE_ADMIN")
	@RequestMapping(value="/admin.do", method = RequestMethod.GET)
	public ModelAndView admin(ModelMap model) {
		ModelAndView view = new ModelAndView("admin");
	return view;
	 
	}
	
	@Secured({"ROLE_REGULAR_USER","ROLE_ADMIN"})
	@RequestMapping(value="/common.do", method = RequestMethod.GET)
	public ModelAndView common(ModelMap model) {
		ModelAndView view = new ModelAndView("common");
	return view;
	}

What I'm doing wrong?

[Samar Land]

Do I need to declare the bean in dispatcher-servlet.xml file?

Something like this code?

<bean id="filterChainProxy" class="org.springframework.security.web.FilterChainProxy">
  <sec:filter-chain-map path-type="ant">
     <sec:filter-chain pattern="/webServices/**" filters="
           securityContextPersistenceFilterWithASCFalse,
           basicAuthenticationFilter,
           exceptionTranslationFilter,
           filterSecurityInterceptor" />
     <sec:filter-chain pattern="/**" filters="
           securityContextPersistenceFilterWithASCTrue,
           formLoginFilter,
           exceptionTranslationFilter,
           filterSecurityInterceptor" />
  </sec:filter-chain-map>
</bean>

https://docs.spring.io/spring-security/site/docs/3.0.x/reference/security-filter-chain.html

[Partheban Udayakumar]

Samar Land,

See the first line of stack trace till the end, the causing exception is

java.lang.IllegalArgumentException: Failed to parse expression 'ROLE_ADMIN,ROLE_REGULAR_USER'

In this line,

<security:intercept-url pattern="/main.do" access="ROLE_ADMIN,ROLE_REGULAR_USER" />

instead of

access="ROLE_ADMIN,ROLE_REGULAR_USER"

use

access=hasAnyRole("ROLE_ADMIN","ROLE_REGULAR_USER")

ref: SO Url

[Samar Land]

My bad, didn't check this message!
Thanks a lot for your reply!
It worked with this line for me!

 access="hasAnyRole('ROLE_ADMIN','ROLE_REGULAR_USER')" />

[Partheban Udayakumar]

Samar Land

Please mark the post as resolved if you got the answer.