Spring Security - Posso usare sia lo spazio dei nomi che la catena dei filtri?

Question

Uso la sicurezza di primavera e devo utilizzare sia la catena dei filtri che lo spazio dei nomi. Namespace funziona bene ma sembra che la catena del filtro non lo faccia!
Ecco la mia configurazione. In primo luogo, dello spazio dei nomi:

<sec:global-method-security secured-annotations="enabled" /> 

<sec:http pattern="/app/login.jsp*" security="none" /> 
<sec:http pattern="/admin/login.jsp*" security="none" /> 
<sec:http pattern="/app/*.png" security="none" /> 
<sec:http pattern="/admin/*.png" security="none" /> 
<sec:http pattern="/app/**" authentication-manager-ref="authenticationManager" 
    access-decision-manager-ref="accessDecisionManager"> 
    <sec:intercept-url pattern="/app/**" access="ROLE_USER" /> 
    <sec:access-denied-handler error-page="/app/login.jsp?aer=" /> 
    <sec:form-login login-processing-url="/app/j_spring_security_check" 
     always-use-default-target="true" default-target-url="/app/index.html" 
     login-page='/app/login.jsp' authentication-failure-url='/app/login.jsp?login_error' /> 
    <sec:logout logout-url="/app/j_spring_security_logout" 
     invalidate-session="true" logout-success-url="/app/login.jsp" /> 
</sec:http> 
<sec:http pattern="/admin/**" authentication-manager-ref="authenticationManager" 
    access-decision-manager-ref="accessDecisionManager"> 
    <sec:intercept-url pattern="/admin/**" access="ROLE_ADMIN" /> 
    <sec:access-denied-handler error-page="/admin/login.jsp?aer=" /> 
    <sec:form-login login-processing-url="/admin/j_spring_security_check" 
     always-use-default-target="true" default-target-url="/admin/index.html" 
     login-page='/admin/login.jsp' authentication-failure-url='/admin/login.jsp?login_error' /> 
    <sec:logout logout-url="/admin/j_spring_security_logout" 
     invalidate-session="true" logout-success-url="/admin/login.jsp" /> 
</sec:http> 

Questo funziona bene. Ma ho anche bisogno di una catena di filtri per controllare altre richieste. (Queste richieste sono in modo dinamico in fase di creazione e dobbiamo controllarli in questo modo)
Questo è il mio filtro a catena:

<bean id="springSecurityFilterChain" class="org.springframework.security.web.FilterChainProxy"> 
    <security:filter-chain-map path-type="ant"> 

    <sec:filter-chain pattern="/css/**" filters="none" /> 
    <sec:filter-chain pattern="/common/**" filters="none" /> 
    <sec:filter-chain pattern="/images/**" filters="none" /> 
    <sec:filter-chain pattern="/login.jsp*" filters="none" /> 
    <sec:filter-chain pattern="/rest/**" 
     filters=" 
     ConcurrentSessionFilter, 
     securityContextPersistenceFilter, 
     logoutFilter, 
     authenticationProcessingFilter, 
     sessionManagementFilter, 
     exceptionTranslationFilter, 
     filterSecurityInterceptor" /> 

    </security:filter-chain-map> 
</bean> 

Il problema è, il filtro a catena non controlla nulla. Sono sicuro che la catena del filtro funzioni bene quando non si usano gli spazi dei nomi. Ma quando aggiungo spazi dei nomi, il problema inizia.
Perché? Non posso usarlo? o posso e devo cambiare qualcosa?

aggiornamento:
Questo il mio registro di debug quando si chiama questa risorsa: /rest/asrv/gtallmmbrsofusrgrp

DEBUG AntPathRequestMatcher   - Checking match of request : '/rest/asrv/gtallmmbrsofusrgrp'; against '/app/login.jsp*' 
DEBUG AntPathRequestMatcher   - Checking match of request : '/rest/asrv/gtallmmbrsofusrgrp'; against '/admin/login.jsp*' 
DEBUG AntPathRequestMatcher   - Checking match of request : '/rest/asrv/gtallmmbrsofusrgrp'; against '/app/*.png' 
DEBUG AntPathRequestMatcher   - Checking match of request : '/rest/asrv/gtallmmbrsofusrgrp'; against '/admin/*.png' 
DEBUG AntPathRequestMatcher   - Checking match of request : '/rest/asrv/gtallmmbrsofusrgrp'; against '/app/**' 
DEBUG AntPathRequestMatcher   - Checking match of request : '/rest/asrv/gtallmmbrsofusrgrp'; against '/admin/**' 
DEBUG FilterChainProxy    - /rest/asrv/gtallmmbrsofusrgrp has no matching filters 

Answer 1

Penso che vi manca la voce DelegatingFilterProxy nel web.xml. Ma in ogni caso,

A partire dalla primavera 3.1, FilterChainProxy viene configurato utilizzando un elenco di istanze SecurityFilterChain e FilterChainMap è deprecato. Quindi provare a configurare in questo modo:

<bean id="filterChainProxy" class="org.springframework.security.web.FilterChainProxy"> 
    <constructor-arg> 
     <list> 
      <sec:filter-chain pattern="/css/**" filters="none" /> 
      <sec:filter-chain pattern="/common/**" filters="none" /> 
      <sec:filter-chain pattern="/images/**" filters="none" /> 
      <sec:filter-chain pattern="/login.jsp*" filters="none" /> 
      <sec:filter-chain pattern="/rest/**" 
       filters=" 
       ConcurrentSessionFilter, 
       securityContextPersistenceFilter, 
       logoutFilter, 
       authenticationProcessingFilter, 
       sessionManagementFilter, 
       exceptionTranslationFilter, 
       filterSecurityInterceptor" /> 
     </list> 
    </constructor-arg> 
</bean> 

E aggiungere il filtro per il vostro web.xml in questo modo:

<filter> 
    <filter-name>filterChainProxy</filter-name> 
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class> 
</filter> 

<filter-mapping> 
    <filter-name>filterChainProxy</filter-name> 
    <url-pattern>/*</url-pattern> 
</filter-mapping> 

API Documentation

UPDATE 1:

Per aggiungere la registrazione alla tua applicazione basta mettere log4j jar sul percorso e aggiungere un file log4j.properties sotto il classpath.

Log4j.properties:

log4j.rootCategory=INFO, stdout 
log4j.appender.stdout=org.apache.log4j.ConsoleAppender 
log4j.appender.stdout.layout=org.apache.log4j.PatternLayout 
log4j.appender.stdout.layout.ConversionPattern=%d{ISO8601} %-5p %c %M - %m\n 

log4j.category.org.springframework.security=DEBUG 

Vedi anche logging using Log4j

UPDATE 2: Sembra funzionare per me, ho messo una pagina di prova welcome.xhtml nella directory di riposo. Il registro di debug è il seguente:

2012-07-30 00:26:05,917 DEBUG org.springframework.security.web.util.AntPathRequestMatcher matches - Checking match of request : '/rest/welcome.xhtml'; against '/javax.faces.resource/**' 
2012-07-30 00:26:05,923 DEBUG org.springframework.security.web.FilterChainProxy doFilter - /rest/welcome.xhtml at position 1 of 11 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter' 
2012-07-30 00:26:05,923 DEBUG org.springframework.security.web.context.HttpSessionSecurityContextRepository readSecurityContextFromSession - No HttpSession currently exists 
2012-07-30 00:26:05,923 DEBUG org.springframework.security.web.context.HttpSessionSecurityContextRepository loadContext - No SecurityContext was available from the HttpSession: null. A new one will be created. 
2012-07-30 00:26:05,925 DEBUG org.springframework.security.web.FilterChainProxy doFilter - /rest/welcome.xhtml at position 2 of 11 in additional filter chain; firing Filter: 'LogoutFilter' 
2012-07-30 00:26:05,925 DEBUG org.springframework.security.web.FilterChainProxy doFilter - /rest/welcome.xhtml at position 3 of 11 in additional filter chain; firing Filter: 'UsernamePasswordAuthenticationFilter' 
2012-07-30 00:26:05,925 DEBUG org.springframework.security.web.FilterChainProxy doFilter - /rest/welcome.xhtml at position 4 of 11 in additional filter chain; firing Filter: 'BasicAuthenticationFilter' 
2012-07-30 00:26:05,925 DEBUG org.springframework.security.web.FilterChainProxy doFilter - /rest/welcome.xhtml at position 5 of 11 in additional filter chain; firing Filter: 'RequestCacheAwareFilter' 
2012-07-30 00:26:05,925 DEBUG org.springframework.security.web.FilterChainProxy doFilter - /rest/welcome.xhtml at position 6 of 11 in additional filter chain; firing Filter: 'SecurityContextHolderAwareRequestFilter' 
2012-07-30 00:26:05,926 DEBUG org.springframework.security.web.FilterChainProxy doFilter - /rest/welcome.xhtml at position 7 of 11 in additional filter chain; firing Filter: 'RememberMeAuthenticationFilter' 
2012-07-30 00:26:05,926 DEBUG org.springframework.security.web.FilterChainProxy doFilter - /rest/welcome.xhtml at position 8 of 11 in additional filter chain; firing Filter: 'AnonymousAuthenticationFilter' 
2012-07-30 00:26:05,928 DEBUG org.springframework.security.web.authentication.AnonymousAuthenticationFilter doFilter - Populated SecurityContextHolder with anonymous token: 'org.springframework.security.authentication.AnonymousAuthenticationToken@9055c2bc: Principal: anonymousUser; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@b364: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: null; Granted Authorities: ROLE_ANONYMOUS' 
2012-07-30 00:26:05,928 DEBUG org.springframework.security.web.FilterChainProxy doFilter - /rest/welcome.xhtml at position 9 of 11 in additional filter chain; firing Filter: 'SessionManagementFilter' 
2012-07-30 00:26:05,929 DEBUG org.springframework.security.web.session.SessionManagementFilter doFilter - Requested session IDD44EAA53A767F3DC9C7338D3CD335198 is invalid. 
2012-07-30 00:26:05,929 DEBUG org.springframework.security.web.FilterChainProxy doFilter - /rest/welcome.xhtml at position 10 of 11 in additional filter chain; firing Filter: 'ExceptionTranslationFilter' 
2012-07-30 00:26:05,929 DEBUG org.springframework.security.web.FilterChainProxy doFilter - /rest/welcome.xhtml at position 11 of 11 in additional filter chain; firing Filter: 'FilterSecurityInterceptor' 
2012-07-30 00:26:05,929 DEBUG org.springframework.security.web.util.AntPathRequestMatcher matches - Checking match of request : '/rest/welcome.xhtml'; against '/login.xhtml' 
2012-07-30 00:26:05,929 DEBUG org.springframework.security.web.util.AntPathRequestMatcher matches - Checking match of request : '/rest/welcome.xhtml'; against '/*' 
2012-07-30 00:26:05,929 DEBUG org.springframework.security.web.util.AntPathRequestMatcher matches - Checking match of request : '/rest/welcome.xhtml'; against '/admin/**' 
2012-07-30 00:26:05,930 DEBUG org.springframework.security.web.access.intercept.FilterSecurityInterceptor beforeInvocation - Public object - authentication not attempted 
2012-07-30 00:26:05,932 DEBUG org.springframework.security.web.FilterChainProxy doFilter - /rest/welcome.xhtml reached end of additional filter chain; proceeding with original chain 
2012-07-30 00:26:06,229 DEBUG org.springframework.security.web.access.ExceptionTranslationFilter doFilter - Chain processed normally 

Penso che i due login di modulo che si sta causando problemi. Prova ad avere un solo modulo di accesso e controlla la navigazione dopo quello basato sul ruolo. Vedere questa domanda ad esempio: Can i use one Login page to redirect different page with Spring 3.0 Security..?