Verify Spring Security Login Credentials

My web application is using Spring Security but it returning a BadCredentialsException when processing a form based login. The credentials entered by the user match exactly whats in the database and I don't see the Spring code that compares the j_password value against that of the Users.getPassword from the db, any ideas on how to troubleshoot this? I want to see what its comparing to throw the BadCredentialsException. When I use a hardcoded Below is an outline of my implementation hoping someone can spot my error. Tha开发者_运维百科nks for the assistance!

public static Users getLoggedInUser() {
    Users user = null;
    Authentication auth = SecurityContextHolder.getContext().getAuthentication();
    if (auth != null && auth.isAuthenticated()) {
        Object principal = auth.getPrincipal();
        if (principal instanceof Users) {
            user = (Users) principal;
        }
    }
    return user;
}

security context file(removed the xml and schema definitions):

<global-method-security secured-annotations="enabled">
</global-method-security>
<http security="none" pattern="/services/rest-api/1.0/**" />
<http security="none" pattern="/preregistered/**" />
<http access-denied-page="/auth/denied.html">
    <intercept-url
        pattern="/**/*.xhtml"
        access="ROLE_NONE_GETS_ACCESS" />
    <intercept-url
        pattern="/auth/**"
        access="ROLE_ANONYMOUS,ROLE_USER" />
    <intercept-url
        pattern="/auth/*"
        access="ROLE_ANONYMOUS" />
     <intercept-url
        pattern="/**"
        access="ROLE_USER" />
    <form-login
        login-processing-url="/j_spring_security_check.html"
        login-page="/auth/login.html"
        default-target-url="/registered/home.html"
        authentication-failure-url="/auth/login.html?_dc=45" />
    <logout logout-url="/auth/logout.html"
            logout-success-url="/" />
    <anonymous username="guest" granted-authority="ROLE_ANONYMOUS"/>
    <remember-me user-service-ref="userManager" key="valid key here"/>
</http>
<!-- Configure the authentication provider -->
<authentication-manager>
    <authentication-provider user-service-ref="userManager">
            <password-encoder ref="passwordEncoder" />
    </authentication-provider>
</authentication-manager>

UserDetails Implementation (Users.java):

public class Users implements Serializable, UserDetails {
    public Collection<GrantedAuthority> getAuthorities() {
     List<GrantedAuthority> auth = new ArrayList<GrantedAuthority>();
    auth.add(new GrantedAuthorityImpl("ROLE_USER"));
    return auth;
}

}

user-service-ref="userManager" (UserManagerImpl.java):

 public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException, DataAccessException {
    Users user = null;
    try {
        user = userDAO.findByUsername(username);
    } catch (DataAccessException ex) {
        throw new UsernameNotFoundException("Invalid login", ex);
    }
    if (user == null) {
        throw new UsernameNotFoundException("User not found.");
    }
    return user;
}

---

It looks like you are storing cleartext password in the database, but using a passwordEncoder in spring-security configuration, which encodes the received password before comparing against the stored one.

---

it seems for me that you are just starting with Spring Security. Since your question is really generic I cannot say exactly where is your problem. It could be wrong configuration. Maybe something is wrong with database. Or anything else.

I would suggest you to start fixing your problem in the following way:

1. Simplify your configs as much as you can.
2. Try to check how you app works with simplest Spring Security configuration.
3. If it works add features step by step and always check it for problems.

Simple Spring security config could something like this:

<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xmlns:beans="http://www.springframework.org/schema/beans"
         xsi:schemaLocation="
         http://www.springframework.org/schema/beans
         http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
         http://www.springframework.org/schema/security
         http://www.springframework.org/schema/security/spring-security-3.0.xsd">

<http auto-config="true">
    <session-management session-fixation-protection="none"/>
    <intercept-url pattern="/login.jsp" filters="none"/>
    <intercept-url pattern="/**" access="ROLE_USER" />
    <form-login login-page="/login.jsp" always-use-default-target="true"/>
</http>

<authentication-manager alias="authenticationManager">
    <authentication-provider>
        <user-service>
            <user name="admin" password="pass1" authorities="ROLE_ADMIN, ROLE_USER"/>
            <user name="user" password="pass2" authorities="ROLE_USER"/>
        </user-service>
    </authentication-provider>
</authentication-manager>

</beans:beans>