@RequestMapping(value = "/my_login", method = RequestMethod.GET)
public ModelAndView login(
@RequestParam(value = "error", required = false) String error,
@RequestParam(value = "logout", required = false) String logout) {
ModelAndView model = new ModelAndView();
if (error != null) {
model.addObject("error", "Invalid username and password!");
}
if (logout != null) {
model.addObject("msg", "You've been logged out successfully.");
}
model.setViewName("login");
return model;
}
<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core"%>
<html>
<body onload='document.loginForm.username.focus();'>
<h1>Spring Security Custom Login Form (XML)</h1>
<div>
<h2>Login with Username and Password</h2>
<c:if test="${not empty error}">
<div class="error">${error}</div>
</c:if>
<c:if test="${not empty msg}">
<div class="msg">${msg}</div>
</c:if>
<c:url var="loginProcessUrl" value="/where_to_process_login" />
<form name='loginForm' action="${loginProcessUrl}" method='POST'>
<table>
<tr>
<td>User:</td>
<td><input type='text' name='username' value=''></td>
</tr>
<tr>
<td>Password:</td>
<td><input type='password' name='password' /></td>
</tr>
<tr>
<td colspan='2'><input name="submit" type="submit"
value="submit" /></td>
</tr>
</table>
<input type="hidden" name="${_csrf.parameterName}" value="${_csrf.token}" />
</form>
</div>
</body>
</html>
<!-- AUTHORIZATION -->
<http pattern="/img/*" security="none" />
<http auto-config="true" use-expressions="true">
<intercept-url pattern="/img/*" access="permitAll" />
<intercept-url pattern="/app/**/*" access="isAuthenticated()" />
<intercept-url pattern="/**/*" access="permitAll" />
<form-login
login-page='/my_login' <--1-- How to get here: GET /<context>/my_login
username-parameter="username" <----- default "username"
password-parameter="password" <----- default "password"
login-processing-url="/where_to_process_login" <--2-- where to process?
authentication-failure-url="/my_login?error" <--3-- where to go if error?
default-target-url="/welcome" <--4-- where to go if success?
always-use-default-target="false" <--5-- where to go if success? (true)?
default-target-url|user-target-url
/>
<logout
logout-url="/where_to_process_logout" <--1-- where to process?
logout-success-url="/my_login?logout" <--2-- where to go if success?
/>
<!-- enable csrf protection -->
<csrf/>
</http>
<!-- AUTHENTICATION (LDAP) -->
<authentication-manager>
<authentication-provider ref="ldapActiveDirectoryAuthProvider"></authentication-provider>
</authentication-manager>
<beans:bean id="ldapActiveDirectoryAuthProvider"
class="org.springframework.security.ldap.authentication.ad.ActiveDirectoryLdapAuthenticationProvider">
<beans:constructor-arg value="abc.xyz.com"></beans:constructor-arg>
<beans:constructor-arg value="ldaps://ad.abc.xyz.com:636"></beans:constructor-arg>
</beans:bean>
