[Acegisecurity-developer] Help with HTTP Session Authentication

[Thompson Marzagao]

Hi all,
I am having a problem with HTTP Session authentication where the 
Authentication object somehow seems like is being cached even across 
sessions it seems. This causes user A to be immediately successfully 
authenticated as user B when caling a protected URL, if user B logged in 
a few moments earlier. Terrible. If user A then calls the same or any 
other protected URL again, only then is he required to login.

Does anybody know what might be causing this?
I am running Tomcat 5.0.25, Hibernate 2.1.6, Spring 1.1 and this is how 
I am wiring my authentication related objects:

applicationContext.xml excerpt:
---------------------------------------------------------------
  <bean id="userDao" 
class="com.mycompany.security.dao.impl.hibernate.UserDaoImpl">
      <property name="sessionFactory"><ref 
local="sessionFactory"/></property>
  </bean>

  <bean id="daoAuthenticationProvider"
      
class="net.sf.acegisecurity.providers.dao.DaoAuthenticationProvider">
      <property name="authenticationDao">
          <ref bean="userDao"/>
      </property>
      <property name="passwordEncoder">
          <ref bean="passwordEncoder"/>
      </property>
  </bean>
    <bean id="authenticationManager"
      class="net.sf.acegisecurity.providers.ProviderManager">
      <property name="providers">
          <list>
              <ref bean="daoAuthenticationProvider"/>
          </list>
      </property>
  </bean>

  <bean id="authenticationEntryPoint" 
class="net.sf.acegisecurity.ui.webapp.AuthenticationProcessingFilterEntryPoint"> 

      <property 
name="loginFormUrl"><value>/action/security/login/form</value></property>
      <property name="forceHttps"><value>false</value></property>
  </bean>
    <bean id="securityEnforcementFilter" 
class="net.sf.acegisecurity.intercept.web.SecurityEnforcementFilter">
      <property name="filterSecurityInterceptor"><ref 
bean="filterInvocationInterceptor"/></property>
      <property name="authenticationEntryPoint"><ref 
bean="authenticationEntryPoint"/></property>
  </bean>
    <bean id="authenticationProcessingFilter"
      
class="net.sf.acegisecurity.ui.webapp.AuthenticationProcessingFilter">
      <property name="authenticationManager">
          <ref bean="authenticationManager"/>
      </property>
      <property name="authenticationFailureUrl">
          <value>/action/security/login/form</value>
      </property>
      <property name="defaultTargetUrl">
          <value>/action/project/homepage</value>
      </property>
      <property name="filterProcessesUrl">
          <value>/j_acegi_security_check</value>
      </property>
  </bean>

  <bean id="securityEnforcementFilter" 
class="net.sf.acegisecurity.intercept.web.SecurityEnforcementFilter">
      <property name="filterSecurityInterceptor"><ref 
bean="filterInvocationInterceptor"/></property>
      <property name="authenticationEntryPoint"><ref 
bean="authenticationEntryPoint"/></property>
  </bean>
    <bean id="viewAccessDecisionManager"
      class="net.sf.acegisecurity.vote.AffirmativeBased">
      <property name="allowIfAllAbstainDecisions">
          <value>false</value>
      </property>
      <property name="decisionVoters">
          <list>
              <ref bean="roleVoter"/>
          </list>
      </property>
  </bean>

  <bean id="filterInvocationInterceptor" 
class="net.sf.acegisecurity.intercept.web.FilterSecurityInterceptor">
      <property name="authenticationManager"><ref 
bean="authenticationManager"/></property>
      <property name="accessDecisionManager"><ref 
bean="viewAccessDecisionManager"/></property>
      <property name="objectDefinitionSource">
          <value>
              CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON
              \A/action/project/.*\Z=LEVEL_ANY
          </value>
      </property>
  </bean>

---------------------------------------------------------------
This is how my filters are setup:
web.xml excerpt:
---------------------------------------------------------------
  <filter>
    <filter-name>Acegi Authentication Processing Filter</filter-name>
    
<filter-class>net.sf.acegisecurity.util.FilterToBeanProxy</filter-class>
    <init-param>
      <param-name>targetClass</param-name>
      
<param-value>net.sf.acegisecurity.ui.webapp.AuthenticationProcessingFilter</param-value> 

    </init-param>
  </filter>
  <filter>
    <filter-name>Acegi Security System for Spring Auto Integration 
Filter</filter-name>
    
<filter-class>net.sf.acegisecurity.ui.AutoIntegrationFilter</filter-class>
  </filter>

  <filter>
      <filter-name>Acegi HTTP Request Security Filter</filter-name>
      
<filter-class>net.sf.acegisecurity.util.FilterToBeanProxy</filter-class>
      <init-param>
          <param-name>targetClass</param-name>
          
<param-value>net.sf.acegisecurity.intercept.web.SecurityEnforcementFilter</param-value> 

      </init-param>
  </filter>
  <filter-mapping>
      <filter-name>Acegi Authentication Processing Filter</filter-name>
      <url-pattern>/*</url-pattern>
  </filter-mapping>
  <filter-mapping>
      <filter-name>Acegi Security System for Spring Auto Integration 
Filter</filter-name>
      <url-pattern>/*</url-pattern>
  </filter-mapping>

  <filter-mapping>
      <filter-name>Acegi HTTP Request Security Filter</filter-name>
      <url-pattern>/*</url-pattern>
  </filter-mapping>
---------------------------------------------------------------

-------------------------------------------------------
This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
Project Admins to receive an Apple iPod Mini FREE for your judgement on
who ports your project to Linux PPC the best. Sponsored by IBM.
Deadline: Sept. 24. Go here: http://sf.net/ppc_contest.php
_______________________________________________
Acegisecurity-developer mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/acegisecurity-developer