【问题标题】：Spring Security with Struts 1 authentication failure error not getting displayedSpring Security with Struts 1 身份验证失败错误未显示
【发布时间】：2014-12-27 08:36:42
【问题描述】：

Spring Security with Struts 1 身份验证失败错误未显示。下面是我的配置和 login.jsp 页面。登录页面被显示并且成功流程工作正常，但在失败的情况下，我被重定向到登录页面，但没有显示错误。如果我使用标准身份验证失败，则会显示 url 错误，但使用 ExceptionMappingAuthenticationFailureHandler 时不会显示错误。

web.xml

 <listener>
    <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>

<context-param>
    <param-name>contextConfigLocation</param-name>
    <param-value>/WEB-INF/spring-security.xml</param-value>
</context-param>

<filter>
    <filter-name>springSecurityFilterChain</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>

<filter-mapping>
    <filter-name>springSecurityFilterChain</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>
<servlet>
    <servlet-name>action</servlet-name>
    <servlet-class>
        org.apache.struts.action.ActionServlet
    </servlet-class>
    <init-param>
        <param-name>config</param-name>
        <param-value>/WEB-INF/struts-config.xml</param-value>
    </init-param>
    <init-param>
        <param-name>debug</param-name>
        <param-value>2</param-value>
    </init-param>
    <init-param>
        <param-name>detail</param-name>
        <param-value>2</param-value>
    </init-param>
    <load-on-startup>2</load-on-startup>
</servlet>

<!-- Action Servlet Mapping -->
<servlet-mapping>
    <servlet-name>action</servlet-name>
    <url-pattern>*.do</url-pattern>
</servlet-mapping>

spring-security.xml

<http disable-url-rewriting="true">
    <!-- for the static resources, apply no security access filter -->
    <intercept-url pattern="/images/**" access="IS_AUTHENTICATED_ANONYMOUSLY" />
    <intercept-url pattern="/styles/**" access="IS_AUTHENTICATED_ANONYMOUSLY" />
    <intercept-url pattern="/scripts/**" access="IS_AUTHENTICATED_ANONYMOUSLY" />
    <intercept-url pattern="/login" access="ROLE_ANONYMOUS" />
    <intercept-url pattern="/jsp/login.jsp" access="ROLE_ANONYMOUS" />
    <intercept-url pattern="/loginAction.do" access="ROLE_ANONYMOUS" />
    <intercept-url pattern="/**" access="ROLE_ADMINISTRATOR" />
    <form-login login-processing-url="/j_spring_security_check" login-page="/jsp/login.jsp"
        authentication-success-handler-ref="successHandler" 
        authentication-failure-handler-ref="failureHandler"/>
</http>

<beans:bean id="successHandler" class="com.test.AuthenticationSuccessHandler">
    <beans:constructor-arg ref="userManagementService"></beans:constructor-arg>
    <beans:constructor-arg value="/forwardAction.do"></beans:constructor-arg>
</beans:bean>

<beans:bean id="failureHandler" class="org.springframework.security.web.authentication.ExceptionMappingAuthenticationFailureHandler">
    <beans:property name="exceptionMappings">
        <beans:map>
            <beans:entry>
                <beans:key>
                    <beans:value>org.springframework.security.authentication.BadCredentialsException</beans:value>
                </beans:key>
                <beans:value>/jsp/login.jsp?login_error=1</beans:value>
            </beans:entry>
        </beans:map>
    </beans:property>
</beans:bean>   

<authentication-manager alias="authenticationManager">
    <authentication-provider ref="authenticationProvider" />
</authentication-manager>

login.jsp

<%@ taglib uri="/WEB-INF/struts-bean.tld" prefix="bean"%>
<%@ taglib uri="/WEB-INF/struts-html.tld" prefix="html"%>
<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" %>
<html:html locale="true">
<head>
<html:base />
</head>
<body>
<form action="/admin/j_spring_security_check" method="POST">
    <bean:message key="login.userName" />
    <input type="text" name="j_username" />

    <bean:message key="login.password" />
    <input type="password" name="j_password" />

    <html:submit styleClass="button" titleKey="login.button.title">
            <bean:message key="login.button.title" />
    </html:submit>

    <p class="error"><c:out value="${SPRING_SECURITY_LAST_EXCEPTION.message}"/></p>
    <c:remove scope="session" var="SPRING_SECURITY_LAST_EXCEPTION"/>
</form>

【问题讨论】：

标签： java spring authentication spring-security struts-1

【解决方案1】：

尝试简单地使用跟随而不是使用 jstl 来实现

${sessionScope["SPRING_SECURITY_LAST_EXCEPTION"].message}

【讨论】：

用 ${sessionScope["SPRING_SECURITY_LAST_EXCEPTION"].message} 试过，但仍然没有显示错误。