title: Spring security - how come I cannot login into my application?
body: <p>I'm having a somewhat embarrassing problem trying to login to my application.</p>
  
  <p>My Spring security <code>protected void configure(HttpSecurity http) throws Exception</code> is defined as:</p>
  
  <pre><code>protected void configure(HttpSecurity http) throws Exception {
      System.out.println(http);
      http
          .formLogin()
              .loginPage("/login")
              .usernameParameter("ssoId")
              .passwordParameter("password")
              .and()
  
          .authorizeRequests()
              // I admit that this section needs some work
              .antMatchers("/", "/home/*", "/alert/*", "/scheduler/*", "/agent/*", "/ftp/*", "/smtp/*", "/sql/*").access("hasRole('USER')")
              .antMatchers("/benefit/*", "/client/*", "/contract/*", "/role/*", "/structure/*", "/term/*").access("hasRole('USER')")
              .antMatchers("/", "/home/*", "/alert/*", "/scheduler/*", "/agent/*", "/ftp/*", "/smtp/*", "/sql/*").access("hasRole('ADMIN')")
              .antMatchers("/benefit/*", "/client/*", "/contract/*", "/role/*", "/structure/*", "/term/*").access("hasRole('ADMIN')")
              .antMatchers("/admin/**").access("hasRole('ADMIN')")
              .antMatchers("/db/**").access("hasRole('ADMIN') and hasRole('DBA')")
  
              .and()
                  .rememberMe().rememberMeParameter("remember-me").tokenRepository(persistentTokenRepository()).tokenValiditySeconds(86400)
              .and()
                  .csrf()
              .and()
                  .exceptionHandling().accessDeniedPage("/accessDenied");
  }
  </code></pre>
  
  <p>The application loads up nicely and goes to the <code>/login</code> page. But when I try to log with the user <code>master</code> and provide the correct password, it simply returns to the <code>/login</code> page.</p>
  
  <p>My login controller is:</p>
  
  <pre><code>@Controller
  public class LoginController {
  
      @Autowired
      UserProfileService userProfileService;
  
      @Autowired
      UserService userService;
  
      @RequestMapping(value = { "/", "/home", "/welcome" }, method = RequestMethod.GET)
      public String index(Principal principal) {
          return principal != null ? "home/homeSignedIn" : "home/homeNotSignedIn";
      }
  
      @RequestMapping(value = "/login")
      public String loginPage() {
          return "login";
      }
  
      @RequestMapping(value="/logout", method = RequestMethod.GET)
      public String logoutPage (HttpServletRequest request, HttpServletResponse response) {
          Authentication auth = SecurityContextHolder.getContext().getAuthentication();
          if (auth != null){    
              new SecurityContextLogoutHandler().logout(request, response, auth);
          }
          return "redirect:/login?logout";
      }
  
      private String getPrincipal(){
          String userName = null;
          Object principal = SecurityContextHolder.getContext().getAuthentication().getPrincipal();
  
          if (principal instanceof UserDetails) {
              userName = ((UserDetails)principal).getUsername();
          } else {
              userName = principal.toString();
          }
          return userName;
      }
  
      @ModelAttribute("roles")
      public List&lt;UserProfile&gt; initializeProfiles() {
          return userProfileService.findAll();
      }
  }
  </code></pre>
  
  <p><code>User</code></p>
  
  <pre><code>@Entity
  @Table(name="user")
  public class User extends BasePojo {
  
      @NotEmpty
      @Column(name="sso_id", unique=true, nullable=false)
      private String ssoId;
  
      @NotEmpty
      @Column(name="password", nullable=false)
      private String password;
  
      @NotEmpty
      @Column(name="first_name")
      private String firstName;
  
      @NotEmpty
      @Column(name="last_name")
      private String lastName;
  
      @Column(name="email", nullable=false)
      private String email;
  
      @Column(name="state", nullable=false)
      private String state=UserState.ACTIVE.getState();
  
      @ManyToMany(fetch = FetchType.EAGER)
      @Fetch(FetchMode.SELECT)
      @JoinTable(name = "hrm_user_user_profile", 
          joinColumns = { @JoinColumn(name = "id_user", referencedColumnName="id") },
          inverseJoinColumns = { @JoinColumn(name = "id_profile", referencedColumnName="id") })
      @Cascade(org.hibernate.annotations.CascadeType.ALL)
      private Set&lt;UserProfile&gt; userProfiles;
  </code></pre>
  
  <p><code>UserProfile</code>:</p>
  
  <pre><code>@Entity
  @Table(name="user_profile")
  public class UserProfile extends BasePojo {
  
  private static final long serialVersionUID = 1L;
  
      @Column(name="type", length=15, unique=true, nullable=false)
      private String type = UserProfileType.USER.getUserProfileType();
  
      // Constructor used only for initial data loading, not used after
      public UserProfile() {
      }
  
      // Constructor used only for initial data loading, not used after
      public UserProfile(String type) {
          super();
          this.type = type;
      }
  
      public String getType() {
          return type;
      }
  
      public void setType(String type) {
          this.type = type;
      }
  }
  </code></pre>
  
  <p><code>UserState</code>:</p>
  
  <pre><code>public enum UserState {
  
      LOCKED("state.locked"),
      INACTIVE("state.inactive"),
      ACTIVE("state.active");
  
      String state;
  
      private UserState(final String state){
          this.state = state;
      }
  
      public String getState(){
          return state;
      }
  </code></pre>
  
  <p>I'm lost here. Can I get some help?</p>