title: Sample of implementing Spring-security on Struts2 does not work
body: <p>My application is supposed to show secret.jsp page to users with ROLE_ADMIN access only, but it does not.</p>
  
  <p>I have defined two users, one with ROLE_ADMIN access and the other with ROLE_USER access. I have two issues first issue is that the login page does not work I can access the application with any dummy username and password. </p>
  
  <p>The other issue is that, the secret.jsp page is not visible to ROLE_ADMIN users. Once I open the login.jsp page and enter user's credentials, it goes to register page but when I click on secret link it redirects to login.jsp page rather than opening the secret.jsp page.</p>
  
  <p>I am implementing SpringSecurity on Struts2.</p>
  
  <p><strong>Web.xml</strong></p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;web-app version="3.0" xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"&gt;
      &lt;listener&gt;
          &lt;listener-class&gt;org.springframework.web.context.ContextLoaderListener&lt;/listener-class&gt;  
      &lt;/listener&gt;
      &lt;context-param&gt; 
          &lt;param-name&gt;contextConfigLocation&lt;/param-name&gt; 
          &lt;param-value&gt;
              /WEB-INF/applicationContext.xml
              /WEB-INF/medics-security.xml 
              /WEB-INF/login-service.xml
          &lt;/param-value&gt; 
      &lt;/context-param&gt; 
      &lt;filter&gt; 
          &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt; 
          &lt;filter-class&gt; 
              org.springframework.web.filter.DelegatingFilterProxy 
          &lt;/filter-class&gt; 
      &lt;/filter&gt; 
  
      &lt;filter-mapping&gt; 
          &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt; 
          &lt;url-pattern&gt;/*&lt;/url-pattern&gt; 
      &lt;/filter-mapping&gt;
  
      &lt;filter&gt;
          &lt;filter-name&gt;struts2&lt;/filter-name&gt;
          &lt;filter-class&gt;org.apache.struts2.dispatcher.FilterDispatcher&lt;/filter-class&gt;
      &lt;/filter&gt;
  
      &lt;filter-mapping&gt;
          &lt;filter-name&gt;struts2&lt;/filter-name&gt;
          &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
      &lt;/filter-mapping&gt;
      &lt;session-config&gt;
          &lt;session-timeout&gt;
              30
          &lt;/session-timeout&gt;
      &lt;/session-config&gt;
      &lt;welcome-file-list&gt;
          &lt;welcome-file&gt;index.jsp&lt;/welcome-file&gt;
      &lt;/welcome-file-list&gt;
  &lt;/web-app&gt;
  </code></pre>
  
  <p><strong>medics-security.xml</strong></p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;beans:beans xmlns='http://www.springframework.org/schema/security' 
          xmlns:beans='http://www.springframework.org/schema/beans' 
              xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance' 
              xsi:schemaLocation='http://www.springframework.org/schema/beans 
      http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
      http://www.springframework.org/schema/security
      http://www.springframework.org/schema/security/spring-security-3.0.xsd'&gt;
  &lt;beans:import resource='login-service.xml'/&gt; 
  &lt;http auto-config="true" access-denied-page="/error.jsp"&gt;
      &lt;intercept-url pattern="/" access="IS_AUTHENTICATED_ANONYMOUSLY"/&gt;
      &lt;intercept-url pattern="/register*" access="ROLE_ADMIN" /&gt;
      &lt;intercept-url pattern="/secret*" access="ROLE_ADMIN" /&gt;
      &lt;form-login login-page="/login.jsp" authentication-failure-url="/login?error=true"/&gt; 
      &lt;remember-me/&gt;
      &lt;logout/&gt;
  &lt;/http&gt; 
  
  &lt;authentication-manager&gt; 
      &lt;authentication-provider&gt; 
          &lt;user-service&gt;
              &lt;user name="admin" password="secret" authorities="ROLE_ADMIN"/&gt;
              &lt;user name="user" password="secret" authorities="ROLE_USER"/&gt;
          &lt;/user-service&gt;   
      &lt;/authentication-provider&gt; 
  &lt;/authentication-manager&gt; 
  &lt;/beans:beans&gt;
  </code></pre>
  
  <p><strong>login-service.xml</strong></p>
  
  <pre><code>&lt;beans xmlns='http://www.springframework.org/schema/beans' 
           xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance' 
           xsi:schemaLocation='http://www.springframework.org/schema/beans 
  
      http://www.springframework.org/schema/beans/spring-beans-3.0.xsd'&gt;
  
  
  &lt;/beans&gt;
  </code></pre>
  
  <p><strong>applicationContext.xml</strong></p>
  
  <pre><code>&lt;?xml version='1.0' encoding='UTF-8'?&gt; 
  &lt;beans xmlns='http://www.springframework.org/schema/beans' 
                  xmlns:context='http://www.springframework.org/schema/context' 
                  xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance' 
                  xsi:schemaLocation='http://www.springframework.org/schema/beans
          http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
          http://www.springframework.org/schema/context    
      http://www.springframework.org/schema/context/spring-context-3.0.xsd'&gt;
  
      &lt;context:component-scan base-package='com.myproject'/&gt; 
      &lt;bean id='internalResourceResolver' 
                   class='org.springframework.web.servlet.view.InternalResourceViewResolver'&gt; 
          &lt;property name='prefix' value='/Web Pages/'/&gt; 
          &lt;property name='suffix' value='.jsp'/&gt; 
      &lt;/bean&gt; 
      &lt;bean 
      class='org.springframework.web.servlet.mvc.annotation.DefaultAnnotationHandlerMapping'/&gt;
      &lt;bean class='org.springframework.web.servlet.mvc.annotation.AnnotationMethodHandlerAdapter'/&gt; 
      &lt;bean id='placeholderConfig' 
                   class='org.springframework.beans.factory.config.PropertyPlaceholderConfigurer'/&gt; 
     &lt;/beans&gt;
  </code></pre>
  
  <p><strong>struts.xml</strong></p>
  
  <pre><code>&lt;!DOCTYPE struts PUBLIC
  "-//Apache Software Foundation//DTD Struts Configuration 2.0//EN"
  "http://struts.apache.org/dtds/struts-2.0.dtd"&gt;
  &lt;struts&gt;
      &lt;!-- Configuration for the default package. --&gt;
      &lt;constant name="struts.action.extension" value="html"/&gt; 
      &lt;constant name="struts.enable.SlashesInActionNames" value="true"/&gt;
  </code></pre>
  
  <p></p>
  
  <pre><code>&lt;action name="Login" class="com.myproject.struts.Login"&gt;
  &lt;result name="SUCCESS"&gt;login.jsp&lt;/result&gt;
  &lt;/action&gt;
  
  &lt;action name="Register" class="com.myproject.struts.Register"&gt;
  &lt;result name="SUCCESS"&gt;register.jsp&lt;/result&gt;
  &lt;/action&gt;
  
  &lt;action name="j_spring_security_check" class="com.myproject.struts.j_spring_security_check"&gt;
      &lt;result name="SUCCESS"&gt;register.jsp&lt;/result&gt;
  &lt;/action&gt;
  </code></pre>
  
  <p></p>
  
  <p></p>
  
  <p><strong>register.jsp</strong></p>
  
  <pre><code>&lt;%@page contentType="text/html" pageEncoding="UTF-8"%&gt;
  &lt;!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
      "http://www.w3.org/TR/html4/loose.dtd"&gt;
  &lt;%@ taglib prefix="s" uri="/struts-tags" %&gt;
  &lt;html&gt;
      &lt;head&gt;
          &lt;meta http-equiv="Content-Type" content="text/html; charset=UTF-8"&gt;
          &lt;title&gt;secret page&lt;/title&gt;
      &lt;/head&gt;
      &lt;body&gt;
          &lt;p&gt;register&lt;/p&gt;
          &lt;a href="secret.jsp"&gt;secret&lt;/a&gt;
      &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  
  <p><strong>login.jsp</strong></p>
  
  <pre><code>&lt;html&gt;
      &lt;head&gt;
  
      &lt;/head&gt;
      &lt;body&gt;
          &lt;form action="j_spring_security_check.html" method="post"&gt; 
              &lt;label for="j_username"&gt;Username&lt;/label&gt;
              &lt;input type="text" name="j_username" id="j_username"/&gt;&lt;br/&gt; 
              &lt;label for="j_password"&gt;Password&lt;/label&gt;
              &lt;input type="password" name="j_password" id="j_password"/&gt;&lt;br/&gt; 
              &lt;input type='checkbox' name='_spring_security_remember_me'/&gt; Remember me&lt;br/&gt;   
              &lt;input type="submit" value="Login"/&gt;
              &lt;input type="reset" value="Reset"/&gt;
          &lt;/form&gt;
      &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>