spring security always returning anonymousUser

Question

i have a spring security implementation for the existing spring based application, it always returns anonymous user regardless of what i supply at login page.

@Configuration
@EnableWebSecurity
@EnableGlobalAuthentication
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {



    @Autowired
    public void configureGlobalSecurity(AuthenticationManagerBuilder auth) throws Exception {
        auth.inMemoryAuthentication().withUser("bill").password("abc123").roles("ROLE_USER");
        auth.inMemoryAuthentication().withUser("admin").password("root123").roles("ADMIN");
        auth.inMemoryAuthentication().withUser("dba").password("root123").roles("ADMIN","DBA");
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        System.out.println("configure called");
         http.authorizeRequests()
            .antMatchers("/*").access("hasRole('ROLE_USER')")
            //.antMatchers("/*").access("IS_AUTHENTICATED")
            .and().formLogin().loginPage("/login")
            .usernameParameter("user").passwordParameter("passWord")
            .and().csrf()
            .and().exceptionHandling().accessDeniedPage("/Access_Denied");
    }

}

form from login.jsp:

<form action="/Patching/Authen" name="form1" method="POST" onsubmit="return validateForm();"><br><br>
                    <h1>User Login</h1>
                    <table>
                        <tr>
                            <th>Username</th>
                            <td><input type="text" name="username" id="user" required/></td>
                        </tr>
                        <tr>
                            <th>Password</th>
                            <td><input type="password" name="password" required/></td>
                        </tr>
                    </table><br><input type="hidden" name="${_csrf.parameterName}"  value="${_csrf.token}" />
                    <input type="submit"><br><br><br>
                </form>

While i do at my controller post the form submit :

Object principal = SecurityContextHolder.getContext().getAuthentication().getPrincipal();

anonymous authentication is returned.

P.S. I already have a login.jsp where I have the configured user and password parameter. Help appreciated.

score 1 · Accepted Answer · answered Dec 28 '18 at 11:54

I tried whatever you suggest above...what worked for me is changing the form action on the login.jsp to "login" and modifying configure to

 http.authorizeRequests()
        .antMatchers("/", "/home").access("hasRole('USER')")
        .antMatchers("/resources/**").permitAll()
        //.antMatchers("/*").access("IS_AUTHENTICATED")
        .anyRequest().authenticated()
        .and().csrf().disable().formLogin().loginPage("/login").permitAll()
        //.loginProcessingUrl("/Authen")
        .usernameParameter("user").passwordParameter("passWord")
        .defaultSuccessUrl("/Authen")
        .failureUrl("/failedLogin")
        .and().exceptionHandling().accessDeniedPage("/Access_Denied");

further I need to work on the flow of the existing implementation along with spring security.

Noman Khan · Answer 2 · 2018-12-26T13:20:52.393

0

Your config do not mention any authenticated uri pattern. You need to add
anyRequest().authenticated()

edited Dec 26 '18 at 13:20

answered Dec 26 '18 at 09:40

Noman Khan

920
5
12

but as far as I have read and understood its used for something to be done post authentication like redirecting to different URLs based on roles. What i understand is I should be able to find the user in the security context post authentication. – kunzsoni Dec 26 '18 at 11:24

spring security always returning anonymousUser

2 Answers2