title: Postman (Rest API Web Service, Spring Security) - Authentication without logging in
body: <p>I am using a Spring Security, Restful WebService and Postman Rest Clien. i want to test my Restful WebService using the Postman without logging in and I do put a <code>@Secured("AMIN_ROLE")</code> to my methods for Restful webservice in order to secured the method, and using the POSTMAN Authorization tab i also put a Digest Auth which is the username and password with already MD5 format. now my problem is I cannot test my restful webservice using the Postman it will prompt a UNAUTHORIZED. please help me for this stuff...</p>
  
  <p>security.xml</p>
  
  <pre><code>&lt;security:http 
          use-expressions="true" 
          entry-point-ref="authEntryPoint"&gt;
  
      &lt;security:intercept-url pattern="/" access="permitAll" /&gt;
      &lt;security:intercept-url pattern="/index.jsp" access="permitAll" /&gt;
      &lt;security:intercept-url pattern="/**" access="isAuthenticated()" /&gt;
  &lt;/security:http&gt;
  
  &lt;/security:http&gt;
  
  &lt;security:authentication-manager alias="authManager"&gt;
      &lt;security:authentication-provider ref="authProvider"/&gt;
  &lt;/security:authentication-manager&gt;
  
  &lt;bean id="authProvider" class="org.springframework.security.authentication.dao.DaoAuthenticationProvider"&gt;
      &lt;property name="userDetailsService" ref="userDetailsService"/&gt;
      &lt;property name="passwordEncoder" ref="md5Encoder"/&gt;
  &lt;/bean&gt;
  
  &lt;bean id="md5Encoder" class="org.springframework.security.authentication.encoding.Md5PasswordEncoder"/&gt;
  &lt;bean id="userDetailsService" class="com.shindi.ippan.service.UserAccountService"/&gt;
  </code></pre>
  
  <p>UserAccountService.java</p>
  
  <pre><code>@Service("userAccountService")
  </code></pre>
  
  <p>public class UserAccountService extends AbstractService implements UserDetailsService{</p>
  
  <pre><code>@Autowired
  @Qualifier("userAccountRepository")
  IRepository&lt;UserAccount&gt; repository;
  
  @Override
  protected IRepository&lt;UserAccount&gt; getRepository() {
      return repository;
  }
  
  @Override
  public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
      UserAccount userAccount = ((UserAccountRepository)repository).readByUsername(username);
  
      return userAccount;
  }
  </code></pre>
  
  <p>}</p>
  
  <p>UserAccount.java implements UserDetails</p>
  
  <p>ApplicationAuthenticationEntryPoint.java</p>
  
  <pre><code>@Component("authEntryPoint")
  </code></pre>
  
  <p>public class ApplicationAuthenticationEntryPoint implements AuthenticationEntryPoint {</p>
  
  <pre><code>@Override
  public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException ae) throws IOException, ServletException {
      response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "MENSAHE UNAUTHORIZED");
  }
  </code></pre>
  
  <p>}</p>
  
  <p>web.xml</p>
  
  <pre><code>&lt;filter&gt;
      &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
      &lt;filter-class&gt;org.springframework.web.filter.DelegatingFilterProxy&lt;/filter-class&gt;
  &lt;/filter&gt;
  &lt;filter-mapping&gt;
      &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
      &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
  &lt;/filter-mapping&gt;
  </code></pre>
  
  <p>UserAccountController.java</p>
  
  <pre><code>@Controller
  </code></pre>
  
  <p>@RequestMapping("/userAccount")
  public class UserAccountController extends AbstractController {</p>
  
  <pre><code>@Autowired
  @Qualifier("userAccountService")
  IService&lt;UserAccount&gt; service;
  
  @Override
  public IService&lt;UserAccount&gt; getService() {
      return service;
  }
  
  @RequestMapping(value="/login", method=RequestMethod.POST)
  public @ResponseBody UserAccount login( String username, String password ){
      UserAccount userAccount = ((UserAccountService)service).loadUserByUsername(username);
      return userAccount;
  }
  
  @Secured("ADMIN_ROLE")
  @RequestMapping(value="/test", method=RequestMethod.POST)
  public @ResponseBody String test(){
      return "test...";
  }
  
  @RequestMapping(value="/denied", method=RequestMethod.POST)
  public @ResponseBody String denied(){
      return "denied...";
  }
  </code></pre>
  
  <p>}</p>