Collectives™ on Stack Overflow

Find centralized, trusted content and collaborate around the technologies you use most.

Teams

Q&A for work

Connect and share knowledge within a single location that is structured and easy to search.

I am using Spring Security 3.0.7. Below is my security config file:

    <?xml version="1.0" encoding="UTF-8"?>
    <beans:beans xmlns="http://www.springframework.org/schema/security"
        xmlns:beans="http://www.springframework.org/schema/beans"
        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xsi:schemaLocation="http://www.springframework.org/schema/beans
        http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
        http://www.springframework.org/schema/security 
        http://www.springframework.org/schema/security/spring-security-3.0.xsd">
<http auto-config="false" use-expressions="true"
    access-denied-page="/nazir/auth/denied"
    entry-point-ref="authenticationEntryPoint">
    <intercept-url pattern="/nazir/auth/login" access="permitAll"/>
    <intercept-url pattern="/nazir/main/admin" access="hasRole('ROLE_ADMIN')"/>
    <intercept-url pattern="/nazir/main/common" access="hasRole('ROLE_USER')"/>
    <logout invalidate-session="true" logout-url="/nazir/auth/logout"
    logout-success-url="/nazir/auth/login"/>
    <custom-filter ref="authenticationFilter" position="FORM_LOGIN_FILTER"/>
    <custom-filter ref="concurrencyFilter"    position="CONCURRENT_SESSION_FILTER"/>
    <session-management session-authentication-strategy-ref="sas"/>
</http>
<beans:bean id="authenticationFilter"
    class="org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter">
    <beans:property name="sessionAuthenticationStrategy" ref="sas"/>
    <beans:property name="authenticationManager" ref="authenticationManager"/>
    <beans:property name="authenticationFailureHandler" ref="customAuthenticationFailureHandler"/>
    <beans:property name="authenticationSuccessHandler" ref="customAuthenticationSuccessHandler"/>
</beans:bean>
<beans:bean id="customAuthenticationFailureHandler1"
class="org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler">
    <beans:property name="defaultFailureUrl" value="/nazir/auth/login"/> 
</beans:bean>
<beans:bean id="customAuthenticationSuccessHandler"
class="org.springframework.security.web.authentication.SimpleUrlAuthenticationSuccessHandler">
    <beans:property name="defaultTargetUrl" value="/nazir/main/common" />
</beans:bean>
<beans:bean id="authenticationEntryPoint"
class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint">
    <beans:property name="loginFormUrl" value="/nazir/auth/login"/>
</beans:bean>
<authentication-manager alias="authenticationManager">
    <authentication-provider user-service-ref="userDetailsService">
        <password-encoder ref="passwordEncoder"/>
    </authentication-provider> 
</authentication-manager> 
<beans:bean class="org.springframework.security.authentication.encoding.Md5PasswordEncoder"
        id="passwordEncoder"/>
<user-service id="userDetailsService">
    <user name="username" password="ee11cbb19052e40b07aac0ca060c23ee"
        authorities="ROLE_USER, ROLE_ADMIN" />
    <user name="test" password="21232f297a57a5a743894a0e4a801fc3"
        authorities="ROLE_USER" /> 
</user-service> 
<beans:bean id="concurrencyFilter"
    class="org.springframework.security.web.session.ConcurrentSessionFilter">
    <beans:property name="sessionRegistry" ref="sessionRegistry"/>
    <beans:property name="expiredUrl" value="/nazir/auth/session-expired" />
</beans:bean> 
<beans:bean id="sas"      
    class="org.springframework.security.web.authentication.session.ConcurrentSessionControlStrategy">
    <beans:property name="maximumSessions" value="1" />
    <beans:property name="exceptionIfMaximumExceeded" value="true" />
    <beans:constructor-arg name="sessionRegistry" ref="sessionRegistry" />
</beans:bean>
<beans:bean id="sessionRegistry" class="org.springframework.security.core.session.SessionRegistryImpl" />  
<beans:bean id="customAuthenticationFailureHandler" 
        class="org.springframework.security.web.authentication.ExceptionMappingAuthenticationFailureHandler" >
    <beans:property name="exceptionMappings">
        <beans:props>
            <beans:prop key="org.springframework.security.authentication.CredentialsExpiredException">/nazir/auth/login?error=resetPassword</beans:prop>
            <beans:prop key="org.springframework.security.authentication.BadCredentialsException">/nazir/auth/login?error=BadCredentials</beans:prop>
            <beans:prop key="org.springframework.security.authentication.AccountExpiredException">/nazir/auth/login?error=AccountExpired</beans:prop>
            <beans:prop key="org.springframework.security.authentication.AccountStatusException">/nazir/auth/login?error=AccountStatus</beans:prop>
            <beans:prop key="org.springframework.security.authentication.AuthenticationCredentialsNotFoundException">/nazir/auth/login?error=AuthenticationCredentialsNotFound</beans:prop>
            <beans:prop key="org.springframework.security.authentication.AuthenticationServiceException">/nazir/auth/login?error=AuthenticationService</beans:prop>
            <beans:prop key="org.springframework.security.authentication.DisabledException">/nazir/auth/login?error=Disabled</beans:prop>
            <beans:prop key="org.springframework.security.authentication.InsufficientAuthenticationException">/nazir/auth/login?error=InsufficientAuthentication</beans:prop>
            <beans:prop key="org.springframework.security.authentication.LockedException">/nazir/auth/login?error=Locked</beans:prop>
            <beans:prop key="org.springframework.security.authentication.ProviderNotFoundException">/nazir/auth/login?error=ProviderNotFound</beans:prop>
            <beans:prop key="org.springframework.security.authentication.SessionAuthenticationException">/nazir/auth/login?error=SessionAuthenticationException</beans:prop>
        </beans:props>
    </beans:property>
</beans:bean>
Question(Help):  How can I route the SessionAuthenticationException through my customAuthenticationFailureHandler filter?  The above scenario all exceptions are handled well, except for the SessionAuthenticationException which is being routes through 401.  The SessionAuthenticationException works well if I use org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler instead of 
org.springframework.security.web.authentication.ExceptionMappingAuthenticationFailureHandler .
Regards,
Nazir
                Can you explain this little bit clear "When I did not use the customAuthenticationFailureHandler then it was routed properly through customAuthenticationFailureHandler!"
– Ravi Kadaboina
                Apr 14, 2012 at 21:03
                Sorry, I let your commet waiting for a reponse little too long; I have updated my question.
– Nazir
                Apr 16, 2012 at 18:12
                Resolved...I added the following property in my customAuthenticationFailureHandler bean configuration:<beans:property name="defaultFailureUrl" value="/login?error=other"/>
– Nazir
                Apr 19, 2012 at 8:59
        
Thanks for contributing an answer to Stack Overflow!
Please be sure to answer the question. Provide details and share your research!
But avoid …
Asking for help, clarification, or responding to other answers.
Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.