0

By using Spring security,When i leave my application web opened for a while then the authentification is lost and the user must login again so when i click on a button or a link in my application to complete my work this exception appear :

Etat HTTP 500 - javax.servlet.ServletException: javax.servlet.jsp.JspException: org.springframework.beans.NotReadablePropertyException: Invalid property 'principal.username' of bean class [org.springframework.security.authentication.AnonymousAuthenticationToken]: Bean property 'principal.username' is not readable or has an invalid getter method: Does the return type of the getter match the parameter type of the setter?

so i want to hide this and show a pretty page said that the user must login, because the user may not understand the message of tomcat and he may be scary by that !! Any suggestions ?

/* EDIT */

    <?xml version="1.0" encoding="UTF-8"?>
    <beans:beans xmlns="http://www.springframework.org/schema/security"
        xmlns:beans="http://www.springframework.org/schema/beans" 
        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xsi:schemaLocation="http://www.springframework.org/schema/beans
         http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
        http://www.springframework.org/schema/security
        http://www.springframework.org/schema/security/spring-security-3.0.xsd">

        <http auto-config="true">
            <intercept-url pattern="/" access="ROLE_ADMIN,ROLE_USER" />
            <intercept-url pattern="/index*" access="ROLE_ADMIN,ROLE_USER" />
            <intercept-url pattern="/mise_a_jour*" access="ROLE_ADMIN,ROLE_USER" />
            <intercept-url pattern="/recherche*" access="ROLE_ADMIN,ROLE_USER" />
            <intercept-url pattern="/pages/*" filters="none" />
            <intercept-url pattern="/css/*" filters="none" />
            <intercept-url pattern="/js/*" filters="none" />
            <intercept-url pattern="/images/*" filters="none" />
            <form-login login-page="/login" authentication-failure-url="/failLogin" />
            <logout logout-success-url="/logoff" />
            <access-denied-handler error-page="/403" />

        </http>



   <beans:bean id="concurrencyFilter"
          class="org.springframework.security.web.session.ConcurrentSessionFilter">
        <beans:property name="sessionRegistry" ref="sessionRegistry" />
        <beans:property  name="expiredUrl" value="/session-expired"  />
      </beans:bean>

        <authentication-manager>
            <authentication-provider>
                <password-encoder hash="sha" />
                <jdbc-user-service data-source-ref="dataSource"
                    users-by-username-query="select login,password, enable from utilisateurs where login=?"
                    authorities-by-username-query="select u.login, r.role from utilisateurs u, roles r where u.id = r.id and u.login =?  " />
            </authentication-provider>
        </authentication-manager>


    </beans:beans>

the stack trace :

Caused by: org.springframework.beans.factory.NoSuchBeanDefinitionException: No bean named 'sessionRegistry' is defined
    at org.springframework.beans.factory.support.DefaultListableBeanFactory.getBeanDefinition(DefaultListableBeanFactory.java:527)
    at org.springframework.beans.factory.support.AbstractBeanFactory.getMergedLocalBeanDefinition(AbstractBeanFactory.java:1083)
    at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:274)
    at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:190)
    at org.springframework.beans.factory.support.BeanDefinitionValueResolver.resolveReference(BeanDefinitionValueResolver.java:322)
    ... 25 more
1
  • This doesn't seem like an authentication related problem. I mean, Spring throws AccessDeniedException if the user is not authenticated. May 21, 2013 at 17:52

1 Answer 1

0

There is a config called expired-url that you can set, something like this

<beans:bean id="concurrencyFilter"
      class="org.springframework.security.web.session.ConcurrentSessionFilter">
    <beans:property name="sessionRegistry" ref="sessionRegistry" />
    <beans:property **name="expiredUrl" value="/session-expired.htm"** />
  </beans:bean>

More information here http://static.springsource.org/spring-security/site/docs/3.0.x/reference/session-mgmt.html.

9
  • Should I write this in a new file XML ?
    – Souad
    May 21, 2013 at 20:44
  • Should be in the security context xml May 22, 2013 at 1:49
  • should i add something else such as a class or a controller expect the xml configuration? i adedd the lines you provide above but it generate an error.
    – Souad
    Jun 14, 2013 at 10:06
  • I just add your code to the xml file and this is the error : cvc-complex-type.2.4.a: Invalid content was found starting with element 'beans:property'. One of '{"http://www.springframework.org/schema/beans":description, "http:// www.springframework.org/schema/beans":import, "http://www.springframework.org/ schema/beans":alias, "http://www.springframework.org/schema/beans":bean, WC[##other:"http://www.springframework.org/schema/beans"]}' is expected.
    – Souad
    Jun 14, 2013 at 13:12
  • Looks like you need to adjust the namespaces according to what you have defined in your xml file. Can you post the entire xml file? Jun 14, 2013 at 15:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.