title: Is it the true way to implement spring security & CXF webservice
body: <p>i create a webservice as below:</p>
  
  <p>web.xml</p>
  
  <pre><code>&lt;display-name&gt;MyService&lt;/display-name&gt;
  
  &lt;context-param&gt;
      &lt;param-name&gt;contextConfigLocation&lt;/param-name&gt;
      &lt;param-value&gt;/WEB-INF/beans.xml,/WEB-INF/spring-security.xml&lt;/param-value&gt;
  &lt;/context-param&gt;
  
  &lt;listener&gt;
      &lt;listener-class&gt;org.springframework.web.context.ContextLoaderListener&lt;/listener-class&gt;
  &lt;/listener&gt;
  
  &lt;servlet&gt;
      &lt;servlet-name&gt;CXFServlet&lt;/servlet-name&gt;
      &lt;servlet-class&gt;org.apache.cxf.transport.servlet.CXFServlet&lt;/servlet-class&gt;
  &lt;/servlet&gt;
  &lt;servlet-mapping&gt;
      &lt;servlet-name&gt;CXFServlet&lt;/servlet-name&gt;
      &lt;url-pattern&gt;/rest/*&lt;/url-pattern&gt;
  &lt;/servlet-mapping&gt;
  
  &lt;!-- Spring Security Filter --&gt;
  &lt;filter&gt;
      &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
      &lt;filter-class&gt;org.springframework.web.filter.DelegatingFilterProxy&lt;/filter-class&gt;
  &lt;/filter&gt;
  
  &lt;filter-mapping&gt;
      &lt;filter-name&gt;springSecurityFilterChain&lt;/filter-name&gt;
      &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
  &lt;/filter-mapping&gt;
  </code></pre>
  
  <p>beans.xml</p>
  
  <pre><code>&lt;import resource="classpath:META-INF/cxf/cxf.xml" /&gt;
  &lt;import resource="classpath:META-INF/cxf/cxf-servlet.xml"/&gt; 
  
  &lt;context:component-scan base-package="com.*" /&gt;
  
  &lt;jaxrs:server id="employeeService" address="/employeeservices"&gt;
      &lt;jaxrs:providers&gt;
          &lt;bean class="org.codehaus.jackson.jaxrs.JacksonJsonProvider" /&gt;
      &lt;/jaxrs:providers&gt;
      &lt;jaxrs:serviceBeans&gt;
          &lt;ref bean="empService" /&gt;
      &lt;/jaxrs:serviceBeans&gt;
      &lt;jaxrs:extensionMappings&gt;
          &lt;entry key="xml" value="application/xml" /&gt;
          &lt;entry key="json" value="application/json" /&gt;
      &lt;/jaxrs:extensionMappings&gt;
  &lt;/jaxrs:server&gt;
  
  &lt;bean id="empService" class="com.service.impl.EmployeeServiceImpl"/&gt;
  &lt;bean id="employeeDao" class="com.dao.EmployeeDao"/&gt;
  </code></pre>
  
  <p>spring-security.xml</p>
  
  <pre><code>&lt;http auto-config="true" use-expressions="true" create-session="stateless" &gt;
      &lt;csrf disabled="true"/&gt;
      &lt;http-basic entry-point-ref="restAuthenticationEntryPoint"&gt;&lt;/http-basic&gt;
      &lt;intercept-url pattern="/**" access="hasRole('ROLE_USER')" /&gt;
  &lt;/http&gt;
  
  &lt;beans:bean id="userAuthorService" class="com.auth.UserAuthorService"/&gt;
  &lt;beans:bean id="restAuthenticationEntryPoint" class="com.auth.UserBasicAuthenticationEntryPoint"&gt;
      &lt;beans:property name="realmName" value="Name Of Your Realm"/&gt;
  &lt;/beans:bean&gt;
  
  &lt;authentication-manager&gt;
      &lt;authentication-provider user-service-ref="userAuthorService"&gt;
           &lt;password-encoder ref="bcryptPasswordEncoder"/&gt;
      &lt;/authentication-provider&gt;
  &lt;/authentication-manager&gt;
  
  &lt;beans:bean id="bcryptPasswordEncoder"
      class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder"&gt;
      &lt;beans:constructor-arg name="strength" value="5" /&gt;
  &lt;/beans:bean&gt;
  &lt;beans:bean id="loggerListener" class="org.springframework.security.authentication.event.LoggerListener"/&gt;
  </code></pre>
  
  <ol>
  <li><p>By this configuration, is it flow of request process? :
  request -> Spring security(check authentication) -> cxf -> response.</p></li>
  <li><p>Are there any issues in this configuration when I deploy it in the real sever? what is the standard configuration when using cxf and spring ?</p></li>
  <li><p>when i call right uri:<a href="http://localhost:8089/MyService/rest/employeeservices/getemployeedetals?employeeId=004" rel="nofollow">http://localhost:8089/MyService/rest/employeeservices/getemployeedetals?employeeId=004</a>. its ok.
  But call wrong uri: <a href="http://localhost:8089/MyService/rest/employeeservices/getemployeedetallll?employeeId=004" rel="nofollow">http://localhost:8089/MyService/rest/employeeservices/getemployeedetallll?employeeId=004</a>. It throw exception: </p></li>
  </ol>
  
  <blockquote>
    <p>WARNING: No operation matching request path "/MyService/rest/employeeservices/getemployeedetallll" is found, Relative Path: /getemployeedetal, HTTP Method: GET, ContentType: <em>/</em>, Accept: <em>/</em>,. Please enable FINE/TRACE log level for more details.
    Jun 07, 2016 1:55:17 PM org.apache.cxf.jaxrs.impl.WebApplicationExceptionMapper toResponse</p>
    
    <p>WARNING: javax.ws.rs.ClientErrorException
        at org.apache.cxf.jaxrs.utils.SpecExceptions.toHttpException(SpecExceptions.java:110)
        at org.apache.cxf.jaxrs.utils.ExceptionUtils.toHttpException(ExceptionUtils.java:149)
        at org.apache.cxf.jaxrs.utils.JAXRSUtils.findTargetMethod(JAXRSUtils.java:477)</p>
  </blockquote>
  
  <p>So how can i filter the right uri before access controller class.</p>
  
  <p>Please help me. Thank you.</p>