Spring Security

Assuntos Gerais
#1

Não estou conseguindo configurar dá esse erro:Estou o dia inteiro quebrando a cabeça, mas não acho uma solução =(

ERROR ContextLoader:177 - Context initialization failed org.springframework.beans.factory.BeanDefinitionStoreException: Line 7 in XML document from ServletContext resource [/WEB-INF/applicationContext-security.xml] is invalid; nested exception is org.xml.sax.SAXParseException: Document root element "beans", must match DOCTYPE root "null". org.xml.sax.SAXParseException: Document root element "beans", must match DOCTYPE root "null".

Meu web.xml está assim:

[code]<?xml version="1.0" encoding="UTF-8"?>


…

contextConfigLocation /WEB-INF/applicationContext-security.xml 
<context-param>
    <param-name>log4jConfigLocation</param-name>
    <param-value>/WEB-INF/classes/log4j.properties</param-value>
</context-param>	

<filter>
    <filter-name>springSecurityFilterChain</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>

<filter-mapping>
  <filter-name>springSecurityFilterChain</filter-name>
  <url-pattern>/*</url-pattern>
</filter-mapping>

<!--
  - Loads the root application context of this web app at startup.
  - The application context is then available via
  - WebApplicationContextUtils.getWebApplicationContext(servletContext).
-->
<listener>
	<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>

<!--
  - Publishes events for session creation and destruction through the application
  - context. Optional unless concurrent session control is being used.
  -->
<listener>
  <listener-class>org.springframework.security.ui.session.HttpSessionEventPublisher</listener-class>
</listener>

<listener>
    <listener-class>org.springframework.web.util.Log4jConfigListener</listener-class>
</listener>

[/code]

applicationContext-security.xml

<?xml version="1.0" encoding="UTF-8"?>

<beans xmlns="http://www.springframework.org/schema/security"
    xmlns:beans="http://www.springframework.org/schema/beans"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.0.xsd
                        http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-2.0.1.xsd">


	<global-method-security secured-annotations="enabled">
		<!-- AspectJ pointcut expression that locates our "post" method and applies security that way
		<protect-pointcut expression="execution(* bigbank.*Service.post*(..))" access="ROLE_TELLER"/>
		-->
	</global-method-security>

    <http auto-config="true">
        <intercept-url pattern="/secure/extreme/**" access="ROLE_SUPERVISOR"/>
        <intercept-url pattern="/secure/**" access="IS_AUTHENTICATED_REMEMBERED" />
		<!-- Disable web URI authorization, as we're using <global-method-security> and have @Secured the services layer instead
        <intercept-url pattern="/listAccounts.html" access="IS_AUTHENTICATED_REMEMBERED" />
        <intercept-url pattern="/post.html" access="ROLE_TELLER" />
        -->
        <intercept-url pattern="/**" access="IS_AUTHENTICATED_ANONYMOUSLY" />
<!--
    Uncomment to enable X509 client authentication support
        <x509 /> 
-->

        <!-- All of this is unnecessary if auto-config="true"
        <form-login />
        <anonymous />
        <http-basic />
        <logout />
        <remember-me /> -->

        <!-- Uncomment to limit the number of sessions a user can have
        <concurrent-session-control max-sessions="1" exception-if-maximum-exceeded="true"/>
		-->		
    </http>

    <!--
    Usernames/Passwords are
        rod/koala
        dianne/emu
        scott/wombat
        peter/opal
    -->
    <authentication-provider>
        <password-encoder hash="md5"/>
        <user-service>
            <user name="rod" password="a564de63c2d0da68cf47586ee05984d7" authorities="ROLE_SUPERVISOR, ROLE_USER, ROLE_TELLER" />
	        <user name="dianne" password="65d15fe9156f9c4bbffd98085992a44e" authorities="ROLE_USER,ROLE_TELLER" />
            <user name="scott" password="2b58af6dddbd072ed27ffc86725d7d3a" authorities="ROLE_USER" />
            <user name="peter" password="22b5c9accc6e1ba628cedc63a72d57f8" authorities="ROLE_USER" />
	    </user-service>
	</authentication-provider>

</beans>
#2

Só para complementar, criei um novo projeto e funcionou então não acredito que sejam os xml’s e sim conflito entre jar’s, tinha lido em outro fórum que talvez tivesse jar’s que pudessem dar conflito com algo do xml.

Alguém sabe?Quais são eles?Ja tiveram problemas parecidos?Não sei qq faço =(

#3

Edit: esquece, viajei

#4

O que eu acho mais estranho é que eu criei um novo projeto com os mesmos jar’s e mesmas configurações e está funcionando…
Só que gostaria de saber o pq disso para se acontecer nesse novo ;D

#5

ao invés de “<beans …”, tente “><beans:beans …”.

o meu está assim e funcionando

veja[code]><?xml version="1.0" encoding="UTF-8"?>

<!–

  • Sample namespace-based configuration
  • $Id: applicationContext-security.xml,v 1.1 2008/11/05 12:56:25 rico Exp $
    –>

<beans:beans xmlns="http://www.springframework.org/schema/security"
xmlns:beans="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation=“http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.0.xsd
http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-2.0.1.xsd”>

&lt;global-method-security secured-annotations="enabled"&gt;
	&lt;!-- AspectJ pointcut expression that locates our "post" method and applies security that way
	&lt;protect-pointcut expression="execution(* bigbank.*Service.post*(..))" access="ROLE_TELLER"/&gt;
	--&gt;
&lt;/global-method-security&gt;

&lt;http auto-config="true"&gt;
    &lt;intercept-url pattern="/secure/extreme/**" access="ROLE_SUPERVISOR"/&gt;
    &lt;intercept-url pattern="/secure/**" access="IS_AUTHENTICATED_REMEMBERED" /&gt;
    &lt;intercept-url pattern="/cadastroo/**" access="IS_AUTHENTICATED_REMEMBERED" /&gt;
	&lt;!-- Disable web URI authorization, as we're using &lt;global-method-security&gt; and have @Secured the services layer instead
    &lt;intercept-url pattern="/listAccounts.html" access="IS_AUTHENTICATED_REMEMBERED" /&gt;
    &lt;intercept-url pattern="/post.html" access="ROLE_TELLER" /&gt;
    --&gt;
    &lt;intercept-url pattern="/**" access="IS_AUTHENTICATED_ANONYMOUSLY" /&gt;

<!–
Uncomment to enable X509 client authentication support
<x509 />
–>

    &lt;!-- All of this is unnecessary if auto-config="true"
    &lt;form-login /&gt;
    &lt;anonymous /&gt;
    &lt;http-basic /&gt;
    &lt;logout /&gt;
    &lt;remember-me /&gt; --&gt;

    &lt;!-- Uncomment to limit the number of sessions a user can have
    &lt;concurrent-session-control max-sessions="1" exception-if-maximum-exceeded="true"/&gt;
	--&gt;		
	&lt;form-login login-page="/login.zul"/&gt;
&lt;/http&gt;

&lt;!--
Usernames/Passwords are
    rod/koala
    dianne/emu
    scott/wombat
    peter/opal
--&gt;
&lt;authentication-provider&gt;
    &lt;password-encoder hash="md5"/&gt;
    &lt;user-service&gt;
        &lt;user name="rod" password="a564de63c2d0da68cf47586ee05984d7" authorities="ROLE_SUPERVISOR, ROLE_USER, ROLE_TELLER" /&gt;
        &lt;user name="dianne" password="65d15fe9156f9c4bbffd98085992a44e" authorities="ROLE_USER,ROLE_TELLER" /&gt;
        &lt;user name="scott" password="2b58af6dddbd072ed27ffc86725d7d3a" authorities="ROLE_USER" /&gt;
        &lt;user name="peter" password="22b5c9accc6e1ba628cedc63a72d57f8" authorities="ROLE_USER" /&gt;
    &lt;/user-service&gt;
&lt;/authentication-provider&gt;

</beans:beans>[/code]

e não esqueça de fechar o root devidamente: "</beans:beans> "

#6