53

I am developing my first application in spring security. My applicationContext-security.xml file looks like this:

<?xml version="1.0" encoding="UTF-8"?>

<!--
  -  Namespace-based OpenID configuration
  -->

<b:beans xmlns="http://www.springframework.org/schema/security"
    xmlns:b="http://www.springframework.org/schema/beans"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
                        http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.0.xsd">

    <http>
        <intercept-url pattern="/**" access="ROLE_USER"/>
        <intercept-url pattern="/index.xhtml*" filters="none"/>
        <logout/>
        <openid-login login-page="/index.xhtml" authentication-failure-url="/index.xhtml?login_error=true">
            <attribute-exchange>
                <openid-attribute name="email" type="http://schema.openid.net/contact/email" required="true" count="2"/>
                <openid-attribute name="name" type="http://schema.openid.net/namePerson/friendly" />
            </attribute-exchange>
        </openid-login>
        <remember-me token-repository-ref="tokenRepo"/>
    </http>

    <b:bean id="tokenRepo"
            class="org.springframework.security.web.authentication.rememberme.InMemoryTokenRepositoryImpl" />

    <authentication-manager alias="authenticationManager"/>

    <user-service id="userService">
        <user name="http://user.myopenid.com/" authorities="ROLE_SUPERVISOR,ROLE_USER" />
    </user-service>

</b:beans>

and Web.xml file is:

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns="http://java.sun.com/xml/ns/j2ee"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd" version="2.4">

    <display-name>Spring Security OpenID Demo Application</display-name>

    <context-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>
            /WEB-INF/applicationContext-security.xml
        </param-value>
    </context-param>

    <context-param>
        <param-name>log4jConfigLocation</param-name>
        <param-value>/WEB-INF/classes/log4j.properties</param-value>
    </context-param>

    <context-param>
        <param-name>webAppRootKey</param-name>
        <param-value>openid.root</param-value>
    </context-param>

    <filter>
        <filter-name>springSecurityFilterChain</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    </filter>

    <filter-mapping>
      <filter-name>springSecurityFilterChain</filter-name>
      <url-pattern>/*</url-pattern>
    </filter-mapping>

    <listener>
        <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
    </listener>

    <listener>
        <listener-class>org.springframework.web.util.Log4jConfigListener</listener-class>
    </listener>
     <welcome-file-list>
        <welcome-file>faces/index.xhtml</welcome-file>
    </welcome-file-list>
</web-app>

Clean and Build of the application is successful, but when I try to deploy the application jetty 7 gives me following error:

SEVERE: Context initialization failed
org.springframework.beans.factory.parsing.BeanDefinitionParsingException: Configuration problem: Unable to locate Spring NamespaceHandler for XML schema namespace [http://www.springframework.org/schema/security]
Offending resource: ServletContext resource [/WEB-INF/applicationContext-security.xml]
at org.springframework.beans.factory.parsing.FailFastProblemReporter.error(FailFastProblemReporter.java:68)
at org.springframework.beans.factory.parsing.ReaderContext.error(ReaderContext.java:85)
at org.springframework.beans.factory.parsing.ReaderContext.error(ReaderContext.java:80)

Tried everything but can't solve this error. Any help would be appreciated.

EDIT I tried added 3.0.2 version of the Spring-Security and got this:

Context initialization failed
org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException: Line 13 in XML document from ServletContext resource [/WEB-INF/applicationContext-security.xml] is invalid;
nested exception is org.xml.sax.SAXParseException; lineNumber: 13; columnNumber: 11; cvc-complex-type.2.4.c: The matching wildcard is strict, but no declaration can be found for element 'http'. at org.springframework.beans.factory.xml.XmlBeanDefinitionReader.doLoadBeanDefinitions(XmlBeanDefinitionReader.java:396)
at org.springframework.beans.factory.xml.XmlBeanDefinitionReader.loadBeanDefinitions(XmlBeanDefinitionReader.java:334

3 Answers 3

92

You need a spring-security-config.jar on your classpath.

The exception means that the security: xml namescape cannot be handled by spring "parsers". They are implementations of the NamespaceHandler interface, so you need a handler that knows how to process <security: tags. That's the SecurityNamespaceHandler located in spring-security-config

4
  • Please note the typo in 'spring-secuirty-config.jar'. I did try editing this, but SO doesn't allow such short changes. (WTH?)
    – Paul
    Apr 23, 2013 at 9:02
  • 1
    for maven you need : <dependency> <groupId>org.springframework.security</groupId> <artifactId>spring-security-config</artifactId> <version>${spring.security.version}</version> </dependency>
    – Justin
    Sep 9, 2014 at 15:31
  • In my case added spring-security jar files to the WEB-INF/lib, this solved the problem. Dec 29, 2014 at 17:01
  • If using eclipse, one thing that gets me is that it is sometimes necessary to package jars when creating a jar rather than extracting. This error occurs when forgetting to select this option as well. Nov 13, 2015 at 20:07
7

I had the same problem. The only thing that solved it was merge the content of META-INF/spring.handler and META-INF/spring.schemas of each spring jar file into same file names under my META-INF project.

This two threads explain it better:

4
  • Solved by replacing my META-INF/spring.handler with the one cited in your first link : blog.idm.fr/2009/09/… Mar 4, 2014 at 16:31
  • Alas, both your references are dead.
    – Gangnus
    Nov 11, 2020 at 14:03
  • Sorry @Gangnus, they are at least 6 year old. Maybe the first one is here now: cnblogs.com/abnercai/p/3253644.html but I've lost the context of this.
    – Carlos
    Nov 12, 2020 at 15:17
  • Thank you, and for the future, please, @Carlos, notice, that, according to the SO rules and to common sense, too, it is better to cntrl+C/v the citations directly into the answer, for such cases. As for the problem, I solved it by javax.servlet taken as a maven dependency and the refresh of external jars both in maven and in IntelliJ.
    – Gangnus
    Nov 12, 2020 at 16:17
0

In my case, this was caused by custom manifest entries added by the maven-jar-plugin.

<plugin>
    <groupId>org.apache.maven.plugins</groupId>
    <artifactId>maven-jar-plugin</artifactId>
    <version>2.6</version>
    <configuration>
        <archive>
            <index>true</index>
            <manifest>
                <addClasspath>true</addClasspath>
            </manifest>
            <manifestEntries>
                <git>${buildNumber}</git>
                <build-time>${timestamp}</build-time>
            </manifestEntries>
        </archive>
    </configuration>
</plugin>

Removing the following entries fixed the problem

<index>true</index>
<manifest>
    <addClasspath>true</addClasspath>
</manifest>

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.