Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

SEC-1269: Combining <form-login> and <open-id> fails to find entry point. Fixed entry point choice conditions when using openID and/or form-login

Browse Source
This commit is contained in:
Luke Taylor
2009-10-14 00:30:28 +00:00
parent 12d825e557
commit 799b96520b
3 changed files with 69 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
config/src/main/java/org/springframework/security/config/http/AuthenticationConfigBuilder.java
View File

@@ -331,10 +331,6 @@ final class AuthenticationConfigBuilder {
void createLoginPageFilterIfNeeded() {
boolean needLoginPage = formFilter != null || openIDFilter != null;
String formLoginPage = getLoginFormUrl(formEntryPoint);
// If the login URL is the default one, then it is assumed not to have been set explicitly
if (DefaultLoginPageGeneratingFilter.DEFAULT_LOGIN_PAGE_URL == formLoginPage) {
formLoginPage = null;
}
String openIDLoginPage = getLoginFormUrl(openIDEntryPoint);
// If no login page has been defined, add in the default page generator.
@@ -498,15 +494,21 @@ final class AuthenticationConfigBuilder {
}
// If formLogin has been enabled either through an element or auto-config, then it is used if no openID login page
// has been set
// has been set.
String formLoginPage = getLoginFormUrl(formEntryPoint);
String openIDLoginPage = getLoginFormUrl(openIDEntryPoint);
if (formLoginPage != null && openIDLoginPage != null) {
pc.getReaderContext().error("Only one login-page can be defined, either for OpenID or form-login, " +
"but not both.", pc.extractSource(openIDLoginElt));
}
if (formFilter != null && openIDLoginPage == null) {
return formEntryPoint;
}
// Otherwise use OpenID if enabled
if (openIDFilter != null && formFilter == null) {
if (openIDFilter != null) {
return openIDEntryPoint;
}
@@ -533,6 +535,11 @@ final class AuthenticationConfigBuilder {
return null;
}
// If the login URL is the default one, then it is assumed not to have been set explicitly
if (DefaultLoginPageGeneratingFilter.DEFAULT_LOGIN_PAGE_URL.equals(pv.getValue())) {
return null;
}
return (String) pv.getValue();
}