Trying to add Security to my Spring Web Flow2 Project

Question

I have a web flow project I been working on and now its time to add some security to it. I have the login screen working for the demo but I want to add:

@PreAuthorize(isAuthenticated());

To some of my functions in the control, service and dao so I know only signed in users are access the functions. @PreAuthorize(isAuthenticated()) does not work and I really dont want to use @PreAuthorize("hasRole('ROLE_USER')").

Can someone please tell me how to lock down my code better

here is my security.xml file:

<?xml version="1.0" encoding="UTF-8"?>
<beans:beans 
    xmlns="http://www.springframework.org/schema/security"
    xmlns:beans="http://www.springframework.org/schema/beans" 
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.springframework.org/schema/beans
                        http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
                        http://www.springframework.org/schema/security
                        http://www.springframework.org/schema/security/spring-security-3.1.xsd">


    <global-method-security pre-post-annotations="enabled"/>

    <http use-expressions="true">
        <intercept-url access="hasRole('ROLE_USER')"    pattern="/visit**" />
        <intercept-url pattern='/*' access='permitAll' />
        <form-login   default-target-url="/visit" />

        <logout logout-success-url="/" />
    </http>

    <authentication-manager>
        <authentication-provider>
            <user-service>
                <user name="user" password="user" authorities="ROLE_USER" />
            </user-service>

        </authentication-provider>
    </authentication-manager>
</beans:beans>

and be a little more precise than just "it does not work". what exception are you getting? did you make sure to have in your security file? — rptmat57, Sep 07 '12 at 19:17
I do have it in my xml. it likes the @PreAuthorize() but does not like @PreAuthorize(isAuthenticated()); — Johnathan Smith, Sep 07 '12 at 19:21

score 3 · Accepted Answer · answered Sep 07 '12 at 19:25

3

Try putting isAuthenticated() in quotes.

As in

@PreAuthorize("isAuthenticated()");

answered Sep 07 '12 at 19:25

Chris Thompson

35,167
12
80
109

Trying to add Security to my Spring Web Flow2 Project

1 Answers1