[FIXED] Spring Security custom FORM_LOGIN_FILTER does not work

Issue

I am trying to add a custom filter to the spring security configuration. But the problem is that whenever I try to add the filter using xml I am getting an exception saying that

"Configuration problem: Filter beans '< subdomainFilter >' and '< org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter#1 >' have the same 'order' value. When using custom filters, please make sure the positions do not conflict with default filters. Alternatively you can disable the default filters by removing the corresponding child elements from and avoiding the use of < http auto-config='true' >."

I am adding my spring security configuration below

<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security"
    xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.springframework.org/schema/beans
           http://www.springframework.org/schema/beans/spring-beans-3.2.xsd
           http://www.springframework.org/schema/security
           http://www.springframework.org/schema/security/spring-security-3.2.xsd">

    <beans:bean id="subdomainFilter" class="com.testbudha.security.authentication.UsernamePasswordAuthenticationFilterWithSubdomain"/>
    <http pattern="/**" auto-config='false' use-expressions='true'>
        <custom-filter position="FORM_LOGIN_FILTER" ref="subdomainFilter" />
        .......
    </http>
    ........
</beans:beans>

Solution

Spring Security maintains a chain of filters in order to apply its services. The order of the filters is always strictly enforced when using the namespace. When the application context is being created, the filter beans are sorted by the namespace handling code and the standard Spring Security filters each have an alias in the namespace and a well-known position.

Your <form-login> is using a filter with alias FORM_LOGIN_FILTER. And also you are adding another filter with the same position (position="FORM_LOGIN_FILTER" ref="subdomainFilter"). So you're getting the error message

Try using

<custom-filter after="FORM_LOGIN_FILTER" ref="subdomainFilter" />

or

<custom-filter before="FORM_LOGIN_FILTER" ref="subdomainFilter" />

Answered By - Rockstar
Answer Checked By - Marilyn (JavaFixing Volunteer)