title: Providing security for Restful Web Services into existing Spring security 3.1
body: <p>Hi all I am going to integrate authentication for my restful web services in my web application. I already integrate Spring security 3.1 for my entire application and its working good; but I am confused and I really stuck, how to integrate security for web services in existing application?
  Here my existing security configuration for authentication and authorization.</p>
  
  <p><strong>securityApplicationContext.xml</strong>  :</p>
  
  <pre><code>&lt;beans:bean id="myAccessDecisionManager"
          class="com.security.repository.MyAccessDecisionManager"&gt;
          &lt;beans:property name="customAuthenticatiuonService" ref="customAuthenticatiuonServiceImpl"&gt; &lt;/beans:property&gt;
      &lt;/beans:bean&gt;
  
      &lt;http auto-config="true" once-per-request="true"
          access-decision-manager-ref="myAccessDecisionManager" access-denied-page="/jsp/errorPage.jsp"&gt;
  
          &lt;intercept-url pattern="/*.web" access="ROLE_ANONYMOUS" /&gt;
  &lt;intercept-url pattern="productsService/*.web" access="ROLE_ADMIN" /&gt;
  
          &lt;!-- Override default login and logout pages --&gt;
          &lt;form-login login-page="/login.works" login-processing-url="/j_spring_security_check"
              default-target-url="/login/validate.works"
              authentication-failure-url="/login.works?login_error=1" /&gt;
          &lt;logout logout-url="/j_spring_security_logout"
              logout-success-url="/login.works" invalidate-session="true" /&gt;
  
          &lt;session-management invalid-session-url="/login.works"
              session-fixation-protection="newSession"&gt;
              &lt;concurrency-control max-sessions="100"
                  error-if-maximum-exceeded="false" /&gt;
          &lt;/session-management&gt;
      &lt;/http&gt;
  
      &lt;authentication-manager&gt;
          &lt;authentication-provider ref="customAuthenticationProvider"&gt;&lt;/authentication-provider&gt;
      &lt;/authentication-manager&gt;
  
      &lt;beans:bean id="customAuthenticationProvider"
          class="com.security.repository.CustomAuthenticationProvider"&gt;
          &lt;beans:property name="customAuthenticatiuonService" ref="customAuthenticatiuonServiceImpl"&gt; &lt;/beans:property&gt;
      &lt;/beans:bean&gt;
  
      &lt;beans:bean id="customAuthenticatiuonServiceImpl"
          class="com.service.impl.CustomAuthenticatiuonServiceImpl"&gt;
          &lt;beans:property name="customAuthenticationDAO" ref="customAuthenticationDAOTarget"&gt; &lt;/beans:property&gt;
      &lt;/beans:bean&gt;
  
      &lt;beans:bean id="customAuthenticationDAOTarget" class="com.dao.impl.CustomAuthenticatiuonDAOImpl"&gt;
          &lt;beans:property name="hibernateTemplate" ref="cessHibernateTemplate"/&gt;
      &lt;/beans:bean&gt;
  </code></pre>
  
  <p>now I am looking to secure my web services which as follows:</p>
  
  <p><strong>My Web Service:</strong></p>
  
  <pre><code>@Component
  @Path("/productsService")
  //@RequestMapping("/productsService")
  @Scope("request")
  @Controller
  public class ProductsController {
  
      @Autowired
      private ProductsService products;
  
      @GET
      @Path("/getProductsList.lbt")
  //  @RequestMapping("/getProductsList.lbt")
      @Produces("text/plain")
      public String getProductsList() {
          return products.getProductsList();
      }
  }
  
  
  @Service("products")
  public class ProductsService {
  
      @Secured("ROLE_ADMIN")
      public String getProductsList() {       
          return "Test String for Rest Web Service";
      }
  }
  </code></pre>
  
  <p><strong>and last my Client class:</strong></p>
  
  <pre><code>public static void main(String[] args) {
          Client c = Client.create();
  
      // plain text
      WebResource r = c
              .resource("http://localhost:8080/productsService/getProductsList.web");
      c.addFilter(new HTTPBasicAuthFilter("admin", "admin"));
      c.setFollowRedirects(false);
      System.out.println("Plain Text=&gt;&gt; " + r.get(String.class));
  
  }
  </code></pre>
  
  <p>I am using customAuthenticationManager and myAccessDecisionManger for authentication and authorization of user.
  When I use @Path annotation on controller and debug it then debugger could not go to my controller and throws an error for 402 not found and when I use @RequestMapping then it goes properly but when returning from controller I get the error at client side 302 found.
  How to resolve this? Please help me.
  Thanks in advance.</p>