SEC-33: Support for multiple login pages about spring-security

[spring-projects-issues]

pascal gehl said:

I’ll take it.

[spring-projects-issues]

pascal gehl said:

Here is the code and the unit tests for the multiple login form url feature.
The folder hierarchy reflects the one in the snapshot I downloaded.

[spring-projects-issues]

pascal gehl said:

It’s a simple and small user guide.

[spring-projects-issues]

Andreas Brenk said:

I’d really like to see this as a part of 0.9.0. Are there any reasons why the code is still not part of CVS HEAD?

[spring-projects-issues]

Ben Alex said:

I think it would be of more general-purpose usefulness if the objectDefinitionSource values were not URIs but bean names of AuthenticationEntryPoints. Thus /ws/=basicAuthenticationEntryPoint, /admin/=adminAuthEntryPoint, **=generalAuthEntryPoint. You’d still get the benefit of different AuthenticationProcessingFilterEntryPoints, but need to define them as separate beans.

What do others think? Please comment on this task.

[spring-projects-issues]

Ben Alex said:

I do not believe the use case of having different login form URLs for different failure URLs would be a general requirement and thus should belong in the framework.

The use case of having different AuthenticationEntryPoints for different URLs is quite reasonable, though, but it is possible to achieve that by configuring the FilterChainProxy accordingly. Indeed FilterChainProxy is a more appropriate configuration mechanism in this scenerio, for it allows alternate bean definitions to be weaved into the web request, such as using a HttpSessionContextIntegrationFilter that does not create HTTP sessions if BASIC authentication is being used.