Styjun

I am a Spring security newbie am am having an issue when I am pairing it up with GWT. Namely, my calls to the services in GWT are marked as 403 forbidden.

POST http://127.0.0.1:8888/grapl/adminService 403 (Forbidden)

Here is my spring-security.xml

<?xml version="1.0" encoding="UTF-8"?>
<b:beans xmlns="http://www.springframework.org/schema/beans"
 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 xmlns:b="http://www.springframework.org/schema/beans"
 xmlns:security="http://www.springframework.org/schema/security"
 xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
 http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd">


 <!-- This is where we configure Spring-Security -->
 <security:http auto-config="true" use-expressions="true">

 <security:intercept-url pattern="/login" access="permitAll" />
 <security:intercept-url pattern="/**" access="isAuthenticated()" />
 <security:intercept-url pattern="/grapl/auth/**" access="isAuthenticated()"/>
 <security:intercept-url pattern="/grapl/adminService/**" access="isAuthenticated()"/>

 </security:http>

 <b:bean id="graplAuthentication" class="com.lilly.rim.security.GraplAuthentication"/>

 <security:authentication-manager alias="authenticationManager">
 <security:authentication-provider ref="graplAuthentication" />
 </security:authentication-manager>

</b:beans>

Web.xml

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 xsi:schemaLocation="http://java.sun.com/xml/ns/javaee 
 http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
 version="2.5"
 xmlns="http://java.sun.com/xml/ns/javaee">
 <context-param>
 <param-name>contextConfigLocation</param-name>
 <param-value>/WEB-INF/spring-security.xml, /WEB-INF/applicationContext.xml</param-value>
 </context-param>
 <filter>
 <filter-name>springSecurityFilterChain</filter-name>
 <filter-class>org.springframework.web.filter.DelegatingFilterProxy
 </filter-class>
 </filter>

 <filter-mapping>
 <filter-name>springSecurityFilterChain</filter-name>
 <url-pattern>/*</url-pattern>
 </filter-mapping>



 <!-- Servlets -->

 <servlet>
 <servlet-name>AdminServiceServlet</servlet-name>
 <servlet-class>com.foo.rim.server.AdminServiceImpl</servlet-class>

 </servlet>

 <servlet>
 <servlet-name>LoaderServiceServlet</servlet-name>
 <servlet-class>com.foo.rim.server.LoaderServiceImpl</servlet-class>
 </servlet>

 <servlet>
 <servlet-name>authServlet</servlet-name>
 <servlet-class>com.foo.rim.server.AuthServiceImpl</servlet-class>
 </servlet>

 <servlet-mapping>
 <servlet-name>authServlet</servlet-name>
 <url-pattern>/grapl/auth</url-pattern>
 </servlet-mapping>
 <servlet-mapping>
 <servlet-name>AdminServiceServlet</servlet-name>
 <url-pattern>/grapl/adminService</url-pattern>
 </servlet-mapping>

 <servlet-mapping>
 <servlet-name>LoaderServiceServlet</servlet-name>
 <url-pattern>/grapl/loaderService</url-pattern>
 </servlet-mapping>
 <listener>
 <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
 </listener>



 <welcome-file-list>
 <welcome-file>grapl.html</welcome-file>
 </welcome-file-list>

</web-app>

Login and authentication is fine. I am redirected to my gwt frontend. My backend for the Spring authentication is a custom provider. All the configuration is done in the spring-security.xml.

Do the GWT servlets need a Spring annotation? Any example I have seen seems like it should all work via the configuration.

I needed to disable the csrf check.

<security:http ...

<security:csrf disabled="true" />
</security:http>