Spring MVC, Security + Hibernate + DWR - Page 4

Spring MVC, Security + Hibernate + DWR, Let's PLay

OK, let's secure it ;)

The Spring security filter and Spring configuration:

in you web.xml edit the line to add a new file called spring-security.xml

<param-value>/WEB-INF/applicationContext.xml,/WEB-INF/dwr-context.xml,/WEB-INF/hibernate-context.xml,/WEB-INF/spring-security.xml</param-value>

<filter>
    <filter-name>springSecurityFilterChain</filter-name>
    <filter-class>
            org.springframework.web.filter.DelegatingFilterProxy
    </filter-class>
</filter>
<filter-mapping>
	<filter-name>springSecurityFilterChain</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

Filter Order

as we are now having two filters (springSecurityFilterChain and OpenSessionInViewFilter) we need to set the filter order as, 1-security 2-Hibernate.
make sure you filter order look like this

<filter-mapping>
	<filter-name>springSecurityFilterChain</filter-name>
	<url-pattern>/*</url-pattern>
</filter-mapping>
<filter-mapping>
	<filter-name>hibernateFilter</filter-name>
	<url-pattern>/*</url-pattern>
</filter-mapping>

spring-security.xml

this file will configure spring security, we will use form authentication, the users will be configured using this file too.

<beans:beans xmlns="http://www.springframework.org/schema/security"
	xmlns:beans="http://www.springframework.org/schema/beans" 
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xsi:schemaLocation="http://www.springframework.org/schema/beans
	http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
	http://www.springframework.org/schema/security
	http://www.springframework.org/schema/security/spring-security-3.0.3.xsd">
 
	<http auto-config="true">
		<intercept-url pattern="/*" access="ROLE_USER" />
	</http>
 
	<authentication-manager>
	  <authentication-provider>
	    <user-service>
		<user name="mtz" password="123" authorities="ROLE_USER" />
	    </user-service>
	  </authentication-provider>
	</authentication-manager>
 
</beans:beans>

the idea here is that we are securing every URL, with:
username:mtz
password:123

Test it

deploy the project and you should see the following page

and you are done, thanks :)
download the full example