title: Spring Security for REST
body: <p>I enabled Spring Security for my REST application but not getting authorized when using curl.</p>
  
  <p><strong>Security.xml</strong></p>
  
  <pre><code>&lt;sec:http use-expressions="true" entry-point-ref="restAuthenticationEntryPoint"&gt;
      &lt;sec:intercept-url pattern="/rest/**" access="hasRole('ROLE_USER')" /&gt;
  
      &lt;sec:form-login authentication-success-handler-ref="mySuccessHandler" /&gt;
  
      &lt;sec:logout /&gt;
  &lt;/sec:http&gt;
  
  &lt;beans:bean id="mySuccessHandler" class="net.himalay.security.MySavedRequestAwareAuthenticationSuccessHandler" /&gt;
  
  &lt;sec:authentication-manager alias="authenticationManager"&gt;
      &lt;sec:authentication-provider&gt;
          &lt;sec:user-service&gt;
              &lt;sec:user name="temporary" password="temporary" authorities="ROLE_ADMIN" /&gt;
              &lt;sec:user name="user" password="userPass" authorities="ROLE_USER" /&gt;
          &lt;/sec:user-service&gt;
      &lt;/sec:authentication-provider&gt;
  &lt;/sec:authentication-manager&gt;
  </code></pre>
  
  <p><strong>CustomEntryPoint</strong></p>
  
  <pre><code>@Component
  public final class RestAuthenticationEntryPoint implements AuthenticationEntryPoint {
  
      private static final Logger LOG = LoggerFactory.getLogger(RestAuthenticationEntryPoint.class);
  
      @Override
      public void commence(final HttpServletRequest request, final HttpServletResponse response, final AuthenticationException authException) throws IOException {
  
          LOG.info("---------RestAuthenticationEntryPoint----------");
          response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Unauthorized");
      }
  
  }
  </code></pre>
  
  <p><strong>Controller</strong></p>
  
  <pre><code>@Controller
  @RequestMapping("rest")
  public class MultitenantController {
  
      @Autowired
      private MultitenantService service;
  
      @RequestMapping(value = "/user/{id}", method = RequestMethod.GET)
      @ResponseBody
      public User getUserInfo(@PathVariable Long id) {
          return service.getUser(id);
      }
  
      @RequestMapping(value = "/user", method = RequestMethod.GET)
      @ResponseBody
      public List&lt;User&gt; getCustomers() {
          return service.getUsers();
      }
  
      @RequestMapping(value = "/user/{id}/todo", method = RequestMethod.GET)
      @ResponseBody
      public List&lt;TodoItem&gt; getTransactions(@PathVariable Long id) {
          HttpHeaders headers = addAccessControllAllowOrigin();
          return getUserInfo(id).getTodoItems();
      }
  }
  </code></pre>
  
  <p><strong>$curl -i -X -u user:userPass <code>http://localhost:8080/mt-rest/rest/user/1/todo</code></strong></p>
  
  <pre><code>curl: (6) Could not resolve host: user
  HTTP/1.1 401 Unauthorized
  Server: Apache-Coyote/1.1
  Set-Cookie: JSESSIONID=ADA11C09484E658C38D8385CABA0CFAE; Path=/mt-rest/; HttpOnly
  Content-Type: text/html;charset=utf-8
  Content-Language: en
  Content-Length: 975
  Date: Fri, 31 Jan 2014 17:14:45 GMT
  </code></pre>
  
  <p>After taking out security pattern from security.xml, it works fine. What exactly am I missing here?</p>