From 21aa12753d6fd61061894098bc9e0246a5f94757 Mon Sep 17 00:00:00 2001
From: lor6 <loredana.crusoveanu@yahoo.com>
Date: Wed, 15 Mar 2017 14:11:37 +0200
Subject: [PATCH] add entry points (#1413)

---
 .../MultipleEntryPointsSecurityConfig.java    | 31 +++++++++++++--
 .../multipleentrypoints/PagesController.java  | 12 +++++-
 .../spring-security-multiple-entry.xml        | 38 ++++++++++++++++---
 .../multipleHttpElems/loginWithWarning.html   | 28 ++++++++++++++
 .../multipleHttpElems/multipleHttpLinks.html  |  4 +-
 .../multipleHttpElems/myPrivateUserPage.html  | 13 +++++++
 .../baeldung/web/MultipleEntryPointsTest.java |  4 +-
 7 files changed, 118 insertions(+), 12 deletions(-)
 create mode 100644 spring-security-mvc-boot/src/main/resources/templates/multipleHttpElems/loginWithWarning.html
 create mode 100644 spring-security-mvc-boot/src/main/resources/templates/multipleHttpElems/myPrivateUserPage.html

diff --git a/spring-security-mvc-boot/src/main/java/org/baeldung/multipleentrypoints/MultipleEntryPointsSecurityConfig.java b/spring-security-mvc-boot/src/main/java/org/baeldung/multipleentrypoints/MultipleEntryPointsSecurityConfig.java
index eba67706fa..9f2eba0a2e 100644
--- a/spring-security-mvc-boot/src/main/java/org/baeldung/multipleentrypoints/MultipleEntryPointsSecurityConfig.java
+++ b/spring-security-mvc-boot/src/main/java/org/baeldung/multipleentrypoints/MultipleEntryPointsSecurityConfig.java
@@ -9,6 +9,10 @@ import org.springframework.security.config.annotation.web.configuration.WebSecur
 import org.springframework.security.core.userdetails.User;
 import org.springframework.security.core.userdetails.UserDetailsService;
 import org.springframework.security.provisioning.InMemoryUserDetailsManager;
+import org.springframework.security.web.AuthenticationEntryPoint;
+import org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint;
+import org.springframework.security.web.authentication.www.BasicAuthenticationEntryPoint;
+import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
 
 @Configuration
 @EnableWebSecurity
@@ -31,10 +35,17 @@ public class MultipleEntryPointsSecurityConfig {
             //@formatter:off
             http.antMatcher("/admin/**")
                 .authorizeRequests().anyRequest().hasRole("ADMIN")
-                .and().httpBasic()
+                .and().httpBasic().authenticationEntryPoint(authenticationEntryPoint())    
                 .and().exceptionHandling().accessDeniedPage("/403");
             //@formatter:on
         }
+        
+        @Bean
+        public AuthenticationEntryPoint authenticationEntryPoint(){
+            BasicAuthenticationEntryPoint entryPoint = new  BasicAuthenticationEntryPoint();
+            entryPoint.setRealmName("admin realm");
+            return entryPoint;
+        }
     }
 
     @Configuration
@@ -42,17 +53,31 @@ public class MultipleEntryPointsSecurityConfig {
     public static class App2ConfigurationAdapter extends WebSecurityConfigurerAdapter {
 
         protected void configure(HttpSecurity http) throws Exception {
+            
             //@formatter:off
             http.antMatcher("/user/**")
                 .authorizeRequests().anyRequest().hasRole("USER")              
-                .and().formLogin().loginPage("/userLogin").loginProcessingUrl("/user/login")
+                .and().formLogin().loginProcessingUrl("/user/login")
                 .failureUrl("/userLogin?error=loginError").defaultSuccessUrl("/user/myUserPage")
                 .and().logout().logoutUrl("/user/logout").logoutSuccessUrl("/multipleHttpLinks")
                 .deleteCookies("JSESSIONID")
-                .and().exceptionHandling().accessDeniedPage("/403")
+                .and().exceptionHandling()
+                .defaultAuthenticationEntryPointFor(loginUrlauthenticationEntryPointWithWarning(),  new AntPathRequestMatcher("/user/private/**"))
+                .defaultAuthenticationEntryPointFor(loginUrlauthenticationEntryPoint(), new AntPathRequestMatcher("/user/general/**"))
+                .accessDeniedPage("/403")
                 .and().csrf().disable();
             //@formatter:on
         }
+        
+        @Bean
+        public AuthenticationEntryPoint loginUrlauthenticationEntryPoint(){
+            return new LoginUrlAuthenticationEntryPoint("/userLogin");
+        }
+        
+        @Bean
+        public AuthenticationEntryPoint loginUrlauthenticationEntryPointWithWarning(){
+            return new LoginUrlAuthenticationEntryPoint("/userLoginWithWarning");
+        }
     }
 
     @Configuration
diff --git a/spring-security-mvc-boot/src/main/java/org/baeldung/multipleentrypoints/PagesController.java b/spring-security-mvc-boot/src/main/java/org/baeldung/multipleentrypoints/PagesController.java
index 3b59678b87..b3462d4061 100644
--- a/spring-security-mvc-boot/src/main/java/org/baeldung/multipleentrypoints/PagesController.java
+++ b/spring-security-mvc-boot/src/main/java/org/baeldung/multipleentrypoints/PagesController.java
@@ -16,10 +16,15 @@ public class PagesController {
         return "multipleHttpElems/myAdminPage";
     }
 
-    @RequestMapping("/user/myUserPage")
+    @RequestMapping("/user/general/myUserPage")
     public String getUserPage() {
         return "multipleHttpElems/myUserPage";
     }
+    
+    @RequestMapping("/user/private/myPrivateUserPage")
+    public String getPrivateUserPage() {
+        return "multipleHttpElems/myPrivateUserPage";
+    }
 
     @RequestMapping("/guest/myGuestPage")
     public String getGuestPage() {
@@ -30,6 +35,11 @@ public class PagesController {
     public String getUserLoginPage() {
         return "multipleHttpElems/login";
     }
+    
+    @RequestMapping("/userLoginWithWarning")
+    public String getUserLoginPageWithWarning() {
+        return "multipleHttpElems/loginWithWarning";
+    }
 
     @RequestMapping("/403")
     public String getAccessDeniedPage() {
diff --git a/spring-security-mvc-boot/src/main/resources/spring-security-multiple-entry.xml b/spring-security-mvc-boot/src/main/resources/spring-security-multiple-entry.xml
index 1a68bd5c30..c026700810 100644
--- a/spring-security-mvc-boot/src/main/resources/spring-security-multiple-entry.xml
+++ b/spring-security-mvc-boot/src/main/resources/spring-security-multiple-entry.xml
@@ -2,7 +2,7 @@
 <beans xmlns="http://www.springframework.org/schema/beans"
 	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 	xmlns:security="http://www.springframework.org/schema/security"
-	xsi:schemaLocation="http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-4.1.xsd
+	xsi:schemaLocation="http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-4.2.xsd
 		http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd">
 
     <security:authentication-manager>
@@ -14,9 +14,10 @@
         </security:authentication-provider>
     </security:authentication-manager>
     
-    <security:http pattern="/user/**" use-expressions="true" auto-config="true">
-        <security:intercept-url pattern="/**" access="hasRole('ROLE_USER')"/>
-        <security:form-login login-page="/userLogin" login-processing-url="/user/login" 
+    <security:http pattern="/user/general/**" use-expressions="true" auto-config="true"
+      entry-point-ref="loginUrlAuthenticationEntryPoint">
+        <security:intercept-url pattern="/**" access="hasRole('ROLE_USER')" />
+        <security:form-login login-processing-url="/user/general/login" 
           authentication-failure-url="/userLogin?error=loginError"
           default-target-url="/user/myUserPage"/>
         <security:csrf disabled="true"/>
@@ -24,14 +25,41 @@
         <security:logout logout-url="/user/logout" delete-cookies="JSESSIONID" logout-success-url="/multipleHttpLinks"/>
     </security:http>
     
+    <bean id="loginUrlAuthenticationEntryPoint"
+      class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint">
+      <constructor-arg name="loginFormUrl" value="/userLogin" />
+    </bean>
+     
+     <security:http pattern="/user/private/**" use-expressions="true" auto-config="true"
+       entry-point-ref="loginUrlAuthenticationEntryPointWithWarning">
+        <security:intercept-url pattern="/**" access="hasRole('ROLE_USER')"/>
+        <security:form-login login-processing-url="/user/private/login" 
+          authentication-failure-url="/userLogin?error=loginError"
+          default-target-url="/user/myUserPage" />
+        <security:csrf disabled="true"/>
+        <security:access-denied-handler error-page="/403"/>
+        <security:logout logout-url="/user/logout" delete-cookies="JSESSIONID" logout-success-url="/multipleHttpLinks"/>
+    </security:http>
+
+    <bean id="loginUrlAuthenticationEntryPointWithWarning"
+       class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint">
+        <constructor-arg name="loginFormUrl" value="/userLoginWithWarning" />
+     </bean>
+    
     <security:http pattern="/admin/**" use-expressions="true" auto-config="true">
         <security:intercept-url pattern="/**" access="hasRole('ROLE_ADMIN')"/>
-        <security:http-basic/>
+        <security:http-basic entry-point-ref="authenticationEntryPoint" />
         <security:access-denied-handler error-page="/403"/>
      </security:http>
+     
+     <bean id="authenticationEntryPoint"
+       class="org.springframework.security.web.authentication.www.BasicAuthenticationEntryPoint">
+       <property name="realmName" value="admin realm" />
+     </bean>
     
      <security:http pattern="/**" use-expressions="true" auto-config="true">
         <security:intercept-url pattern="/guest/**" access="permitAll()"/>  
      </security:http>
 
+    
 </beans>
diff --git a/spring-security-mvc-boot/src/main/resources/templates/multipleHttpElems/loginWithWarning.html b/spring-security-mvc-boot/src/main/resources/templates/multipleHttpElems/loginWithWarning.html
new file mode 100644
index 0000000000..a5b2eaf3dc
--- /dev/null
+++ b/spring-security-mvc-boot/src/main/resources/templates/multipleHttpElems/loginWithWarning.html
@@ -0,0 +1,28 @@
+<html>
+<head></head>
+
+<body>
+    <h1>Login</h1>
+    <h3>Warning! You are about to access sensible data!</h3>
+
+    <form name='f' action="user/login" method='POST'>
+
+        <table>
+            <tr>
+                <td>Username:</td>
+                <td><input type="text" name="username" /></td>
+            </tr>
+            <tr>
+                <td>Password:</td>
+                <td><input type="password" name="password" /></td>
+            </tr>
+			
+            <tr>
+                <td><input name="submit" type="submit" value="submit" /></td>
+            </tr>
+        </table>
+
+    </form>
+
+</body>
+</html>
\ No newline at end of file
diff --git a/spring-security-mvc-boot/src/main/resources/templates/multipleHttpElems/multipleHttpLinks.html b/spring-security-mvc-boot/src/main/resources/templates/multipleHttpElems/multipleHttpLinks.html
index 4a2af1d649..676badb16f 100644
--- a/spring-security-mvc-boot/src/main/resources/templates/multipleHttpElems/multipleHttpLinks.html
+++ b/spring-security-mvc-boot/src/main/resources/templates/multipleHttpElems/multipleHttpLinks.html
@@ -8,7 +8,9 @@
 
 <a th:href="@{/admin/myAdminPage}">Admin page</a>
 <br />
-<a th:href="@{/user/myUserPage}">User page</a>
+<a th:href="@{/user/general/myUserPage}">User page</a>
+<br />
+<a th:href="@{/user/private/myPrivateUserPage}">Private user page</a>
 <br />
 <a th:href="@{/guest/myGuestPage}">Guest page</a>
 
diff --git a/spring-security-mvc-boot/src/main/resources/templates/multipleHttpElems/myPrivateUserPage.html b/spring-security-mvc-boot/src/main/resources/templates/multipleHttpElems/myPrivateUserPage.html
new file mode 100644
index 0000000000..52045ec320
--- /dev/null
+++ b/spring-security-mvc-boot/src/main/resources/templates/multipleHttpElems/myPrivateUserPage.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="ISO-8859-1" />
+<title>Insert title here</title>
+</head>
+<body>
+Welcome user to your private page! <a th:href="@{/user/logout}" >Logout</a>
+
+<br /><br />
+<a th:href="@{/multipleHttpLinks}" >Back to links</a>
+</body>
+</html>
\ No newline at end of file
diff --git a/spring-security-mvc-boot/src/test/java/org/baeldung/web/MultipleEntryPointsTest.java b/spring-security-mvc-boot/src/test/java/org/baeldung/web/MultipleEntryPointsTest.java
index 96d38d4943..050d2363af 100644
--- a/spring-security-mvc-boot/src/test/java/org/baeldung/web/MultipleEntryPointsTest.java
+++ b/spring-security-mvc-boot/src/test/java/org/baeldung/web/MultipleEntryPointsTest.java
@@ -46,9 +46,9 @@ public class MultipleEntryPointsTest {
 
     @Test
     public void whenTestUserCredentials_thenOk() throws Exception {
-        mockMvc.perform(get("/user/myUserPage")).andExpect(status().isFound());
+        mockMvc.perform(get("/user/general/myUserPage")).andExpect(status().isFound());
 
-        mockMvc.perform(get("/user/myUserPage").with(user("user").password("userPass").roles("USER"))).andExpect(status().isOk());
+        mockMvc.perform(get("/user/general/myUserPage").with(user("user").password("userPass").roles("USER"))).andExpect(status().isOk());
 
         mockMvc.perform(get("/admin/myAdminPage").with(user("user").password("userPass").roles("USER"))).andExpect(status().isForbidden());
     }