Spring security authentication without spring boot doesn't work as opposed to with spring boot and similar configuration

Question

With Spring Boot:

The working Spring Boot + Spring Security application uses this for request mapping:

@SpringBootApplication
public class SampleLDAPApplication extends SpringBootServletInitializer {

    public static void main(String[] args) {
        SpringApplication.run(SampleLDAPApplication.class, args);
    }

    @Bean
    public WebMvcConfigurerAdapter adapter() {
        return new WebMvcConfigurerAdapter() {
            @Override
            public void addViewControllers(ViewControllerRegistry registry) {
                registry.addViewController("/login")
                    .setViewName("login");
            }
        };
    }

}

This is the security configuration:

@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {

        auth.ldapAuthentication().userSearchBase("ou=Users").userSearchFilter("(uid={0})")
                .groupSearchBase("ou=bla,ou=Roles").groupSearchFilter("(roleOccupant={0})")
                .contextSource().root("dc=ops,dc=blabla,dc=com").url("ldap://192.168.1.57:389/dc=ops,dc=blabla,dc=com");
    }
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests().antMatchers("/", "/home").permitAll().anyRequest().authenticated();
        http.formLogin().loginPage("/login").permitAll().and().logout().logoutSuccessUrl("/");
    }
}

And this is the login page:

<div class="content">
    <h2>Login with Username and Password</h2>
    <form name="form" th:action="@{/login}" method="POST">
        <fieldset>
            <input type="text" name="username" value="" placeholder="Username" />
            <input type="password" name="password" placeholder="Password" />
        </fieldset>
        <input type="submit" id="login" value="Login"/>
    </form>
</div>

Whenever I go to the reserved /secure URL, the application correctly redirects me to the login page for authentication.

Without Spring Boot:

My Spring Security web application without Spring Boot uses the following controller for request mapping:

@Controller
@RequestMapping("/")
public class UserController {
    @RequestMapping(value = "login")
    public String login() {
        return "login";
    }
}

The security configuration is completely the same as in the case of Spring Boot application, the only difference being the additional @EnableWebSecurity annotation.

The only difference in the view section of my application without Spring Boot is that I use JSP instead of Thymeleaf as in the case of Spring Boot:

<form action="/login" method="POST">
    <fieldset>
        <input type="text" name="username" value="" placeholder="Username" />
        <input type="password" name="password" placeholder="Password" />
    </fieldset>
    <input type="submit" id="login" value="Login">
</form>

But now when I go to /secure, my application incorrectly serves me this page instead of redirecting to the login page. Why is that so?

gdrt gdrt · Accepted Answer · 2018-04-03T16:20:28

The answer is that Spring Boot is simple, Spring itself not so much. My SecurityConfig class was not registered with the WAR. So in order to do this, in the same package as SecurityConfig I had to create 3 classes.

This:

import org.springframework.security.web.context.*;

public class MessageSecurityWebApplicationInitializer
      extends AbstractSecurityWebApplicationInitializer {
}

This:

@Configuration
@ComponentScan
public class RootConfiguration {
}

And this:

import org.springframework.web.servlet.support.AbstractAnnotationConfigDispatcherServletInitializer;

public class AppInitializer extends AbstractAnnotationConfigDispatcherServletInitializer {

    @Override
    protected Class<?>[] getRootConfigClasses() {
        return new Class[] { RootConfiguration.class };
    }

    @Override
    protected Class<?>[] getServletConfigClasses() {
        return null;
    }

    @Override
    protected String[] getServletMappings() {
        return new String[] { "/" };
    }
}

Why I should do so is explained in details in the Spring Guide.

Spring security authentication without spring boot doesn't work as opposed to with spring boot and similar configuration

With Spring Boot:

Without Spring Boot:

1 Answers