SEC-1440: Allow setting of separate entry-point-ref for http-basic namespace element #1683

Closed
spring-issuemaster opened this Issue Mar 16, 2010 · 7 comments

1 participant

@spring-issuemaster

Grzegorz Borkowski (Migrated from SEC-1440) said:

After migration to Spring Secuiry 3.0 (from 2.0), our custom EntryPoint, which overrides BasicAuthenticataionEntryPoint, is not being called anymore.
After some debugging, I think the problem is that BasicAuthenticationFilter catches authentication exception, and then it uses its own BasicAuthenticationEntryPoint (the one which is actually created in "createBasicFilter" method from schema builder), instead of delegating to the main, customized entry point declared in "entry-point-ref" attribute.
See more detailed description on Spring forum http://forum.springsource.org/showthread.php?p=289354.

@spring-issuemaster

Luke Taylor said:

I'm not sure this is actually a bug, since this behaviour may be desired in many situations. For example, if basic and form authentication are both being used, then it may be desirable to override the form-login entry point used by the ExceptionTranslation filter, but you would not want a failed basic authentication to result in a redirect to a login page. Possibly we should add an entry-point-ref attribute to the http-basic element, as the two are really independent.

@spring-issuemaster

Grzegorz Borkowski said:

Yes, I agree that in some cases this behavior can be desired, but sometimes (like in my case) it's just opposite. Definitely, adding entry-point-ref to http-basic element would solve the problem. I hope it will be fixed soon, because it's quite serious problem for us at this moment.

@spring-issuemaster

Luke Taylor said:

If it's a pressing problem, you can easily workaround it by using an explicit BasicAuthenticationFilter. Alternatively, you could set it using a BeanFactoryPostProcessor.

Since a namespace change is required, the entry-point-ref change would most likely go into 3.1.

@spring-issuemaster

Grzegorz Borkowski said:

I see. When 3.1 is expected to be released?

@spring-issuemaster

Luke Taylor said:

There isn't a specific date at the moment, but it will be later this year, some time after Spring 3.1 is released.

@spring-issuemaster

Luke Taylor said:

Ok, I've made the changes to both branches, introducing a 3.0.3 namespace schema, which should allow you to use this without waiting for 3.1.

@spring-issuemaster

Grzegorz Borkowski said:

That's good news.

@spring-issuemaster spring-issuemaster added this to the 3.1.0.M1 milestone Feb 5, 2016
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment