GWT RPC with Spring role-base Security

Vote count:

0

My question is quite simple "Can have any problems when using Spring security and GWT RPC ?" .

I would like to use spring's method level security on GWT's RPC methods.For instance : at my ServiceImpl class , I used Expression-Based Access Control as below.

@PreAuthorize("hasRole('ROLE_ADMIN')")
public final String getById(Long id) {
    .........
}

If un-authorize role access users trying to access page dealing with this rpc method , exception was thrown and don't redirect to my access-denied page. I have no idea why doesn't go to my access-denied page ? I got an exception at my console as

threw an unexpected exception: org.springframework.security.access.AccessDeniedException: Access is denied

I configured as this answer exactly but still getting above error.Please correct if I am wrong "I think this problem may due to gwt's RPC" because non-rpc methods were fine and redirect to my unSecure.html . I spend about 3 days for this error . At onFailure(Throwable caught) of my asynchronous method show

500 The call failed on the server; see server log for details

I want to show my configurations .

---

spring-security.xml

<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns:sec="http://ift.tt/1c8inpe"
xmlns:beans="http://ift.tt/GArMu6" xmlns:xsi="http://ift.tt/ra1lAU"
xsi:schemaLocation="http://ift.tt/GArMu6
        http://ift.tt/1jdM0fG
        http://ift.tt/1c8inpe
        http://ift.tt/18sW2ay">

<sec:global-method-security
    secured-annotations="enabled" pre-post-annotations="enabled" />
<sec:http auto-config="false" entry-point-ref="authenticateFilterEntryPoint">
    <sec:access-denied-handler ref="accessDeniedHandler" />
    <sec:intercept-url pattern="/login.html" />

    <sec:logout logout-url="/logout.html" logout-success-url="/login.html"
        invalidate-session="true" />
    <sec:form-login login-page="/login.html"
        login-processing-url="/login_check" authentication-failure-url="/login.html?error=1" />

    <sec:session-management invalid-session-url="/login.html">
        <sec:concurrency-control max-sessions="50"
            error-if-maximum-exceeded="true" />
    </sec:session-management>
    <sec:remember-me key="mykey"
        token-validity-seconds="604800" />
</sec:http>

<beans:bean id="authenticateFilterEntryPoint"
    class="mypackage.common.security.SessionTimeoutEntryPoint">
    <beans:property name="loginFormUrl" value="/login.html" />
</beans:bean>

<beans:bean id="accessDeniedHandler"
    class="mypackage.common.security.AccessDeniedEntryPoint">
    <beans:property name="errorPage" value="/unSecure.html" />
</beans:bean>

<beans:bean
    class="org.springframework.web.servlet.handler.SimpleMappingExceptionResolver">
    <beans:property name="defaultErrorView" value="uncaughtException" />
    <beans:property name="excludedExceptions"
        value="org.springframework.security.access.AccessDeniedException" />

    <beans:property name="exceptionMappings">
        <beans:props>
            <beans:prop key=".DataAccessException">dataAccessFailure</beans:prop>
            <beans:prop key=".NoSuchRequestHandlingMethodException">resourceNotFound</beans:prop>
            <beans:prop key=".TypeMismatchException">resourceNotFound</beans:prop>
            <beans:prop key=".MissingServletRequestParameterException">resourceNotFound</beans:prop>
        </beans:props>
    </beans:property>
</beans:bean>

<beans:bean id="authenticationUserService"
    class="mypackage.common.security.AuthenticationUserService" />

<sec:authentication-manager>
    <sec:authentication-provider
        user-service-ref="authenticationUserService">
        <sec:password-encoder hash="md5" />
    </sec:authentication-provider>
</sec:authentication-manager>

<beans:bean id="authLoggerListener"
    class="org.springframework.security.authentication.event.LoggerListener" />
<beans:bean id="eventLoggerListener"
    class="org.springframework.security.access.event.LoggerListener" />

AccessDeniedEntryPoint.java

public class AccessDeniedEntryPoint extends org.springframework.security.web.access.AccessDeniedHandlerImpl {
private static final Logger logger = LoggerFactory.getLogger(AccessDeniedEntryPoint.class);

@Override
public void handle(HttpServletRequest request, HttpServletResponse response,
        AccessDeniedException accessDeniedException) throws IOException, ServletException {
    super.handle(request, response, accessDeniedException);

}
}

SessionTimeoutEntryPoint.java

public class SessionTimeoutEntryPoint extends LoginUrlAuthenticationEntryPoint {

@Override
public final void commence(final HttpServletRequest request, final HttpServletResponse response,
        final AuthenticationException authException) throws IOException, ServletException {
    super.commence(request, response, authException);
}
}

So , I would like to get unSecure.html when un-authorize role users access this method. I would really appreciated any of your suggestions. Sorry for my long question. I don't want to hit my head anymore ! Thanks.

asked 50 secs ago

Cataclysm

325