Spring Security with CAS and Forms login

Question

I am writing an application that needs to use CAS authentication for employees, and a username/password form login (which validates against a database table) for customers.

The idea is the front page would have a link to send them to CAS for employees ("click here if you are an employee"), and below that username & password boxes for non-employees.

I have both of these working in separate test apps - based on the sample applications in Spring Security - but am not clear how to combine the two AuthenticationProviders into one.

Current config - mainly from the CAS config with Forms config added:

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xmlns:security="http://www.springframework.org/schema/security"

       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
                           http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.1.xsd">



  <!--Set up the url based security features-->
    <security:http entry-point-ref="casEntryPoint" use-expressions="true" >
        <security:custom-filter position="FORM_LOGIN_FILTER" ref="casFilter" />
        <security:logout logout-success-url="${cas.sso}/logout" />
        <security:access-denied-handler ref="accessDeniedHandler" />

<!-- Set up the form login -->
        <security:form-login login-page="/login.jsp" authentication-failure-     url="/login.jsp?login_error=1"/>

    </security:http>

    <!-- Specify a destinatation for 403 errors raised by the above URL patterns
        this is performed as a 'forward' internally    -->
    <bean id="accessDeniedHandler"
          class="org.springframework.security.web.access.AccessDeniedHandlerImpl">
        <property name="errorPage" value="/error/403.html"/>
    </bean>

    <!--Hook in the properties for the CAS-->
    <bean id="serviceProperties" class="org.springframework.security.cas.ServiceProperties">
        <property name="service" value="${cas.service}"/>
        <property name="sendRenew" value="true"/>
    </bean>

    <!--Set up the CAS filter-->
    <bean id="casFilter"
          class="org.springframework.security.cas.web.CasAuthenticationFilter">
        <property name="authenticationManager" ref="authenticationManager"/>
        <property name="authenticationFailureHandler" ref="accessFailureHandler" />
    </bean>

    <!-- Specify a destinatation for 401 errors raised by casFilter (and UserService) -->
    <bean id='accessFailureHandler'
          class="org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler">
        <property name="defaultFailureUrl" value="/error/401.html" />
        <property name="useForward" value='true' />
        <property name="allowSessionCreation" value="false" />
    </bean>

    <!--Set up the entry point for CAS-->
    <bean id="casEntryPoint"
          class="org.springframework.security.cas.web.CasAuthenticationEntryPoint">
        <property name="loginUrl" value="${cas.sso}"/>
        <property name="serviceProperties" ref="serviceProperties"/>
        <property name="encodeServiceUrlWithSessionId" value="false"/>
    </bean>

    <!--Setup authentication managers-->
    <security:authentication-manager alias="authenticationManager">
        <security:authentication-provider ref="casAuthenticationProvider"/>
        <security:authentication-provider ref="customAuthenticationProvider"/>
    </security:authentication-manager>

    <!-- Our own user details service, which hooks in to the database -->
    <bean id='userService' class='test.security.UserDetailsServiceImpl' />

    <!-- Enable annotations -->
     <security:global-method-security pre-post-annotations="enabled"/>

    <!--    Customise an auth provider with the local specifics-->
    <bean id="casAuthenticationProvider"
          class="org.springframework.security.cas.authentication.CasAuthenticationProvider">
        <property name="userDetailsService" ref="userService"/>
        <property name="serviceProperties" ref="serviceProperties"/>
        <property name="ticketValidator">
            <bean class="org.jasig.cas.client.validation.Cas20ServiceTicketValidator">
                <constructor-arg index="0" value="${cas.sso}"/>
            </bean>
        </property>
        <property name="key" value="testSSO"/>
    </bean>

<!-- Custom auth provider that validates usernames&pwds against DB -->
    <bean id="customAuthenticationProvider" class="test.security.CustomAuthenticationProvider" />    

</beans>

This gives the error message:

Filter beans '<casFilter>' and '<org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter#0>' have the same 'order' value.

How can I put both filters into the chain? Or do I need to write my own filter that (somehow?) knows which method is being chosen and then delegates the relevant specific filter?

I am new to Spring Security so is there a better way of doing this entirely?

Thanks!

Answer 1

casFilter must be placed at position=CAS_FILTER