Problems setting up Spring security in existing MVC project

Question

I'm trying to add Spring security to an existing Spring MVC project. I'm using this as a guide:

http://docs.spring.io/spring-security/site/docs/current/guides/html5//hellomvc.html

However, I can't get the project to display the login screen. I copied SecurityConfig.java and MessageSecurityWebApplicationInitializer.java verbatim, when I turn boot logging to DEBUG, I see this:

o.s.b.c.e.ServletContextInitializerBeans : Created Filter initializer for bean 'springSecurityFilterChain'; order=2147483647, resource=class path resource [org/springframework/security/config/annotation/web/configuration/WebSecurityConfiguration.class]

Which suggests that MessageSecurityWebApplicationInitializer is never being looked at. Sure enough, if I create a default constructor and set a breakpoint, it's never getting hit.

Interestingly, SecurityConfig.configureGlobal is called, which seems like the call that should be setting up the login screen.

So what steps need to happen to make MessageSecurityWebApplicationInitializer do its thing? I'm still trying to understand how Spring handles dependency injection, etc.--what about this class declaration should cause this to get picked up during boot (I would have expected some sort of annotation):

public class MessageSecurityWebApplicationInitializer
      extends AbstractSecurityWebApplicationInitializer {
}

I can't share much other code unfortunately, but this is the Application file:

@ComponentScan(basePackages={"..."})
@EnableAutoConfiguration(exclude={DataSourceAutoConfiguration.class, SpringBootWebSecurityConfiguration.class})
@Configuration
public class Application extends SpringBootServletInitializer {

    /**
     * The main() method is required by the framework.
     * 
     * @param args
     * @throws IOException
     */
    public static void main(String[] args) throws Exception {

        SpringApplication.run(Application.class, args);
    }
}

The one thing that the sample has that this project doesn't is the MessageWebApplicationInitializer class, but to me it looks like that functionality should be picked up by my Application class.

Thanks!

Stefan Isele - prefabware.com · Accepted Answer · 2016-03-04 20:48:43Z

3

You must add annotations @Configuration and @EnableWebSecurity to your MessageSecurityWebApplicationInitializer and take care that its picked up by spring. Than it should work.

answered Mar 4, 2016 at 20:48

Stefan Isele - prefabware.com

9,6064 gold badges31 silver badges34 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Ryan Over a year ago

Hey thanks. Now the constructor for MessageSecurityWebApplicationInitializer is being called, so that's a step forward. I'm still seeing this: Created Filter initializer for bean 'springSecurityFilterChain'; order=2147483647, resource=class path resource [org/springframework/security/config/annotation/web/configuration/WebSecurityConfiguration.class] so it seems like the filter isn't getting set up properly. But this was really helpful, thanks.

Ryan Over a year ago

I'm also curious why the sample doesn't need these annotations..?

Stefan Isele - prefabware.com Over a year ago

In the tutorial there the class is SecurityConfig is annotated with '@EnableWebSecurity'. This annotation can be placed on any configuration, so the effect is the same as placing it on the MessageSecurityWebApplicationInitializer. And you are right, the annotation '@Configuration' is missing in the tutorial, which looks like an error to me.

Ryan · Accepted Answer · 2016-03-07 19:39:13Z

0

So it turns out the problem was these lines in my gradle build:

compile(group: "org.springframework.boot", name: "spring-boot-starter-actuator", version: "1.2.3.RELEASE")
compile(group: "org.springframework.boot", name: "spring-boot-starter-web", version: "1.2.3.RELEASE")
compile(group: "org.springframework.boot", name: "spring-boot-starter-test", version: "1.2.3.RELEASE")
compile(group: "org.springframework.boot", name: "spring-boot-starter-jdbc", version: "1.2.3.RELEASE")

It would be great if anyone could shed some insight into why these lines would break the security setup.

answered Mar 7, 2016 at 19:39

Ryan

5451 gold badge5 silver badges16 bronze badges

1 Comment

Sahin Yanlık Over a year ago

What do you mean by these lines. Did you add these lines ?

Collectives™ on Stack Overflow

Problems setting up Spring security in existing MVC project

2 Answers 2

3 Comments

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

3 Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related