Good day everyone.
I got a spring mvc application with spring security layer. So i configured security to permit access for /good-transfer/** URL for all users who has one of four roles
@Override
protected void configure(HttpSecurity http) throws Exception {
http.csrf()
.disable()
// For all static resources we got permissions
.authorizeRequests()
.antMatchers("/css/**", "/js/**", "/img/**","/font/**").permitAll()
// Good transfer
.antMatchers("/good_transfer/**").hasAnyRole(UserRole.ROLE_ASSEMBLER.name(),UserRole.ROLE_LOADER.name(),UserRole.ROLE_SHIPPER.name(),UserRole.ROLE_SELLER.name())
.anyRequest().authenticated()
.and();
http.formLogin()
// указываем страницу с формой логина
.loginPage("/login")
// указываем action с формы логина
.loginProcessingUrl("/j_spring_security_check")
// указываем URL при неудачном логине
.failureUrl("/login?error")
// Указываем параметры логина и пароля с формы логина
.usernameParameter("j_username")
.passwordParameter("j_password")
// даем доступ к форме логина всем
.permitAll();
http.logout()
// разрешаем делать логаут всем
.permitAll()
// указываем URL логаута
.logoutUrl("/logout")
// указываем URL при удачном логауте
.logoutSuccessUrl("/")
// делаем не валидной текущую сессию
.invalidateHttpSession(true);
}
I submit login form with login and password of user with role ROLE_ASSEMBLER and after a successful login i fall to / controller:
@Controller
public class LoginController extends CommonController
{
@RequestMapping("/login")
public ModelAndView login()
{
return model("login");
}
@RequestMapping("/")
public ModelAndView main(HttpServletRequest request)
{
String redirect = "login";
if(request.isUserInRole(UserRole.ROLE_ASSEMBLER.name())||request.isUserInRole(UserRole.ROLE_LOADER.name())||request.isUserInRole(UserRole.ROLE_SHIPPER.name())||request.isUserInRole(UserRole.ROLE_SELLER.name()))
{
redirect = "good_transfer";
}
return new ModelAndView("redirect:/"+redirect);
}
}
The expression request.isUserInRole(UserRole.ROLE_ASSEMBLER.name()) returns true, so i got a role needed. After that controller redirects me to /good-transfer URL (i got a controller for that URL):
@Controller
public class GoodTransferController extends CommonController
{
@RequestMapping("/good_transfer")
public ModelAndView getAssemblyList()
{
ModelAndView model = model("good-transfer");
return model;
}
}
But i cant each the controller
s method :(.
It throws the AccessDenied exception...
I can`t understand why. This URL must be permitted for ROLE_ASSEMBLER users.
Please help me.