I use Spring MVC to provide RESTful services. I have already enabled authentication through HTTPBasicAuthentication, and using <security:http>, I can control which roles can access URLs.
Now I want to use annotation @Secured. I tried adding it to the Controller methods, but this will not work. He just does nothing.
Here is my class Controller:
@Controller
@RequestMapping("/*")
public class HomeController {
private static final Logger logger = LoggerFactory.getLogger(HomeController.class);
private static final String USERS = "/users";
private static final String USER = USERS+"/{userId:.*}";
@RequestMapping(value=USER, method=RequestMethod.GET)
@Secured(value = {"ROLE_ADMIN"})
public @ResponseBody User signin(@PathVariable String userId) {
logger.info("GET users/"+userId+" received");
User user= service.getUser(userId);
if(user==null)
throw new ResourceNotFoundException();
return user;
}
}
This is mine security-context.xml:
<http auto-config='true'>
<intercept-url pattern="/**" access="ROLE_USER"/>
</http>
<global-method-security secured-annotations="enabled" />
<authentication-manager>
<authentication-provider>
<user-service>
<user name="admin@somedomain.com" password="admin"
authorities="ROLE_USER, ROLE_ADMIN" />
<user name="user@somedomain.com" password="pswd"
authorities="ROLE_USER" />
</user-service>
</authentication-provider>
</authentication-manager>
And mine root-context.xml:
<context:component-scan base-package="org.mypackage" />
<import resource="database/DataSource.xml"/>
<import resource="database/Hibernate.xml"/>
<import resource="beans-context.xml"/>
<import resource="security-context.xml"/>
, @Secured, : user@somedomain.com, ROLE_ADMIN.
<security:global-method-security> root-context.xml, . <security:http>, , @Secured.
.
EDIT:
servlet-context.xml controllers.xml appServlet.
servlet-context.xml:
<mvc:resources mapping="/resources/**" location="/resources/" />
<beans:bean class="org.springframework.web.servlet.view.InternalResourceViewResolver">
<beans:property name="prefix" value="/WEB-INF/views/" />
<beans:property name="suffix" value=".jsp" />
</beans:bean>
<beans:import resource="controllers.xml" />
controllers.xml:
<context:component-scan base-package="org.mose.emergencyalert.controllers" />
<beans:bean id="multipartResolver" class="org.springframework.web.multipart.commons.CommonsMultipartResolver" />
<beans:bean id="homeController" class="org.mose.emergencyalert.controllers.HomeController"/>