title: How to securize Struts2 Rest services with Spring Security Oauth
body: <p>I struggle with configuration of spring security Oauth to use it on a Struts2 Application to secure rest webservices.
  I already use spring security for a long time.</p>
  
  <p>The issue, if I have well understantood, is that Spring security Oauth need spring mvc dispatcher set on root. And this is conflicting with Struts2.</p>
  
  <p>Here are my attempts </p>
  
  <p>2) Struts2 on root and Spring MVC on /oauth/*</p>
  
  <pre><code>&lt;!-- Struts 2 --&gt;
      &lt;filter&gt;
          &lt;filter-name&gt;struts2&lt;/filter-name&gt;
          &lt;filter-class&gt;org.apache.struts2.dispatcher.ng.filter.StrutsPrepareAndExecuteFilter&lt;/filter-class&gt;
      &lt;/filter&gt;
      &lt;filter-mapping&gt;
          &lt;filter-name&gt;struts2&lt;/filter-name&gt;
          &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
      &lt;/filter-mapping&gt;
      &lt;filter-mapping&gt;
          &lt;filter-name&gt;struts2&lt;/filter-name&gt;
          &lt;url-pattern&gt;/struts/*&lt;/url-pattern&gt;
      &lt;/filter-mapping&gt;
  
  &lt;servlet&gt;
          &lt;servlet-name&gt;mvc-dispatcher&lt;/servlet-name&gt;
          &lt;servlet-class&gt;org.springframework.web.servlet.DispatcherServlet&lt;/servlet-class&gt;
          &lt;load-on-startup&gt;1&lt;/load-on-startup&gt;
      &lt;/servlet&gt;
  
      &lt;servlet-mapping&gt;
          &lt;servlet-name&gt;mvc-dispatcher&lt;/servlet-name&gt;
          &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
      &lt;/servlet-mapping&gt;
  </code></pre>
  
  <p>This is OK for Oauth but Struts2 doesn't work anymore.</p>
  
  <p>1) Struts2 and Spring MVC on root</p>
  
  <pre><code>&lt;!-- Struts 2 --&gt;
      &lt;filter&gt;
          &lt;filter-name&gt;struts2&lt;/filter-name&gt;
          &lt;filter-class&gt;org.apache.struts2.dispatcher.ng.filter.StrutsPrepareAndExecuteFilter&lt;/filter-class&gt;
      &lt;/filter&gt;
      &lt;filter-mapping&gt;
          &lt;filter-name&gt;struts2&lt;/filter-name&gt;
          &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
      &lt;/filter-mapping&gt;
      &lt;filter-mapping&gt;
          &lt;filter-name&gt;struts2&lt;/filter-name&gt;
          &lt;url-pattern&gt;/struts/*&lt;/url-pattern&gt;
      &lt;/filter-mapping&gt;
  
  &lt;servlet&gt;
          &lt;servlet-name&gt;mvc-dispatcher&lt;/servlet-name&gt;
          &lt;servlet-class&gt;org.springframework.web.servlet.DispatcherServlet&lt;/servlet-class&gt;
          &lt;load-on-startup&gt;1&lt;/load-on-startup&gt;
      &lt;/servlet&gt;
  
      &lt;servlet-mapping&gt;
          &lt;servlet-name&gt;mvc-dispatcher&lt;/servlet-name&gt;
          &lt;url-pattern&gt;/oauth/*&lt;/url-pattern&gt;
      &lt;/servlet-mapping&gt;
  </code></pre>
  
  <p>Struts2, oauth is recognizing rights but the response is made on /token instead of /oauth/token and so I get a 404 error.</p>
  
  <p>The extract of spring-security.xml is here:</p>
  
  <pre><code>&lt;http pattern="/oauth/token" create-session="stateless"
          authentication-manager-ref="clientAuthenticationManager"
          xmlns="http://www.springframework.org/schema/security"&gt;
          &lt;intercept-url pattern="/oauth/token" access="IS_AUTHENTICATED_FULLY" /&gt;
          &lt;anonymous enabled="false" /&gt;
          &lt;http-basic entry-point-ref="clientAuthenticationEntryPoint" /&gt;
          &lt;!-- include this only if you need to authenticate clients via request 
              parameters --&gt;
          &lt;custom-filter ref="clientCredentialsTokenEndpointFilter" after="BASIC_AUTH_FILTER" /&gt;
          &lt;access-denied-handler ref="oauthAccessDeniedHandler" /&gt;
  
  &lt;/http&gt;
  
  &lt;!-- This is where we tells spring security what URL should be protected 
      and what roles have access to them --&gt;
  &lt;http pattern="/api/**.api" create-session="never"
      entry-point-ref="oauthAuthenticationEntryPoint"
      access-decision-manager-ref="accessDecisionManager"
      xmlns="http://www.springframework.org/schema/security"&gt;
      &lt;anonymous enabled="false" /&gt;
      &lt;intercept-url pattern="/api/**.api" access="ROLE_API" /&gt;
      &lt;custom-filter ref="resourceServerFilter" before="PRE_AUTH_FILTER" /&gt;
      &lt;access-denied-handler ref="oauthAccessDeniedHandler" /&gt;
  &lt;/http&gt;
  </code></pre>