title: Spring Security - how can I define intercept-url dynamically using Database?
body: <p>I've been working on a spring security recently and I need to know how I can define intercept-url (in Spring Security) dynamically using a Database.</p>
  
  <p>I've already dug deep the whole internet and I could not find any unique (and of course useful) tutorial in this area.</p>
  
  <p>So here is what I did:<br><hr>
  First I implemented FilterInvocationSecurityMetadataSource Abstract class:<br><br>
  <code></p>
  
  <pre><code>public class MyFilterSecurityMetadataSource implements FilterInvocationSecurityMetadataSource {
  
  
      public List&lt;ConfigAttribute&gt; getAttributes(Object object) {
          FilterInvocation fi = (FilterInvocation) object;
          String url = fi.getRequestUrl();
          List&lt;ConfigAttribute&gt; attributes = new ArrayList&lt;ConfigAttribute&gt;();
  
          attributes = getAttributesByURL(url);
  
          return attributes;
      }
  
      public Collection&lt;ConfigAttribute&gt; getAllConfigAttributes() {
          return null;
      }
  
      public boolean supports(Class&lt;?&gt; clazz) {
          return FilterInvocation.class.isAssignableFrom(clazz);
      }
  
      public List&lt;ConfigAttribute&gt; getAttributesByURL(String inputUrl)
      {
          List&lt;ConfigAttribute&gt; attributes = new ArrayList&lt;ConfigAttribute&gt;();
  
          Connection connection = null;
          String url = "jdbc:mysql://173.0.0.22:3306/";
          String dbName = "kheirkhahandb";
          String driverName = "com.mysql.jdbc.Driver";
          String userName = "kheirkhahan";
          String password = "kheirkhahan";
          try{
              Class.forName(driverName).newInstance();
              connection = DriverManager.getConnection(url+dbName, userName, password);
              try{
                  Statement stmt = connection.createStatement();
                  String selectquery = "select * from URL_ACCESS where URL = '" + inputUrl +"'";
                  ResultSet rs = stmt.executeQuery(selectquery);
                  while(rs.next()){
                      MyConfigAttribute temp = new MyConfigAttribute();
                      String attr = rs.getString("ACCESS").toString();
                      temp.setAttr(attr);
                      attributes.add(temp);
                  }
              }
              catch(SQLException s){
                  System.out.println(s);
              }
              connection.close();
          }
          catch (Exception e){
              e.printStackTrace();
          }
          return attributes;
      }
  </code></pre>
  
  <p></code><br><hr>
  and I set my security.xml as:<br><br>
  <code></p>
  
  <pre><code>&lt;bean id="springSecurityFilterChain" class="org.springframework.security.web.FilterChainProxy"&gt;
          &lt;sec:filter-chain-map path-type="ant"&gt;
              &lt;sec:filter-chain pattern="/css/**" filters="none" /&gt;
              &lt;sec:filter-chain pattern="/images/**" filters="none" /&gt;
              &lt;sec:filter-chain pattern="/login.jsp*" filters="none" /&gt;
              &lt;sec:filter-chain pattern="/**"
                  filters="
              securityContextPersistenceFilter,
              logoutFilter,
              authenticationProcessingFilter,
              exceptionTranslationFilter,
              filterSecurityInterceptor" /&gt;
          &lt;/sec:filter-chain-map&gt;
      &lt;/bean&gt;
  
      &lt;bean id="securityContextPersistenceFilter"
          class="org.springframework.security.web.context.SecurityContextPersistenceFilter"&gt;
      &lt;/bean&gt;
  
      &lt;bean id="exceptionTranslationFilter"
          class="org.springframework.security.web.access.ExceptionTranslationFilter"&gt;
          &lt;property name="authenticationEntryPoint" ref="authenticationEntryPoint" /&gt;
          &lt;property name="accessDeniedHandler" ref="accessDeniedHandler" /&gt;
      &lt;/bean&gt;
  
      &lt;bean id="authenticationEntryPoint"
          class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint"&gt;
          &lt;property name="loginFormUrl" value="/login.jsp?error=entryPoint" /&gt;
      &lt;/bean&gt;
  
      &lt;bean id="accessDeniedHandler"
          class="org.springframework.security.web.access.AccessDeniedHandlerImpl"&gt;
          &lt;property name="errorPage" value="/login.jsp?error=access_denied" /&gt;
      &lt;/bean&gt;
  
      &lt;bean id="authenticationProcessingFilter"
          class="org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter"&gt;
          &lt;property name="authenticationManager" ref="authenticationManager" /&gt;
      &lt;/bean&gt;
  
      &lt;bean id="filterSecurityInterceptor"
          class="org.springframework.security.web.access.intercept.FilterSecurityInterceptor"&gt;
          &lt;property name="authenticationManager" ref="authenticationManager" /&gt;
          &lt;property name="accessDecisionManager" ref="accessDecisionManager" /&gt;
          &lt;property name="securityMetadataSource" ref="myFilterInvocationSecurityMetadataSource" /&gt;
      &lt;/bean&gt;
  
      &lt;bean id="myFilterInvocationSecurityMetadataSource" class="com.datx.dao.MyFilterSecurityMetadataSource"&gt;
      &lt;/bean&gt;
  
      &lt;bean id="logoutFilter"
          class="org.springframework.security.web.authentication.logout.LogoutFilter"&gt;
          &lt;constructor-arg value="/login.jsp?error=logout" /&gt;
          &lt;constructor-arg ref="logoutHandler"&gt;
          &lt;/constructor-arg&gt;
      &lt;/bean&gt;
  
      &lt;bean id="logoutHandler"
          class="org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler"&gt;&lt;/bean&gt;
  &lt;sec:authentication-manager alias="authenticationManager"&gt;
          &lt;sec:authentication-provider&gt;
              &lt;sec:jdbc-user-service data-source-ref="dataSource"
                  group-authorities-by-username-query="
                                          SELECT acg.ID, acg.GROUP_NAME, a.AUTHORITY_NAME AS AUTHORITY 
                                          FROM ACCESS_GROUPS acg, ACCESS_GROUP_MEMBERSHIP agm, GROUP_AUTHORITIES ga, AUTHORITIES a
                                          WHERE agm.USERNAME = ? and acg.ID = ga.GROUP_ID and acg.ID = agm.GROUP_ID and ga.AUTHORITY_ID = a.ID
                                      "
                  users-by-username-query="SELECT USERNAME,PASSWORD,IS_ACTIVE FROM USER where USERNAME = ?"
                  authorities-by-username-query="
                                          SELECT ua.USERNAME, a.AUTHORITY_NAME AS AUTHORITY 
                                          FROM USER_AUTHORITIES ua, AUTHORITIES a 
                                          WHERE ua.USERNAME = ? and ua.AUTHORITY_ID = a.ID
                                      " /&gt;
          &lt;/sec:authentication-provider&gt;
      &lt;/sec:authentication-manager&gt;
  
      &lt;bean id="accessDecisionManager"
          class="org.springframework.security.access.vote.AffirmativeBased"&gt;
          &lt;property name="decisionVoters"&gt;
              &lt;list&gt;
                  &lt;ref bean="roleVoter" /&gt;
              &lt;/list&gt;
          &lt;/property&gt;
      &lt;/bean&gt;
      &lt;bean id="roleVoter"
          class="org.springframework.security.access.vote.RoleHierarchyVoter"&gt;
          &lt;property name="rolePrefix" value="" /&gt;
          &lt;constructor-arg ref="roleHierarchy" /&gt;
      &lt;/bean&gt;
  
  &lt;bean id="roleHierarchy" class="com.datx.dao.MyRoleHierarchyImpl"&gt;
          &lt;property name="roleHierarchyEntryDaoJdbc" ref="RoleHierarchyEntryDaoJdbc" /&gt;
      &lt;/bean&gt;
  
  &lt;/beans&gt;
  </code></pre>
  
  <p></code>
  <br><hr>
  There are some problems that I cannot find out:<br>
  1. I've inserted some pairs like &lt;"URL" , "ROLE"> into URL_ACCESS database. But I'm not sure whether getAttributes method is working fine or not<br>
  2. Do I have to implement all those filters that I used in <br></p>
  
  <p>
          
              
              
              
              
          
      </p>
  
  <p><br><br>
  3. I'm receiving exception when a user uses a wrong username/password or tries to access not-permitted-pages, instead of being redirected to login.jsp. Why is that?</p>
  
  <p>Thanks in advance</p>