title: Spring Security: forward to original page after login with admin user after access was denied
body: <p>I use Spring security to authenticate users. If a user requests a secured page, he has to authenticate over a login page. If the user is always authenticated, he will be redirected to the requested page immediatly. Moreover some pages need special access rights, and so I setup an access-denied-page temporarily. So far so good.</p>
  
  <p><strong>The scenario:</strong>
  The scenario definies, that the user will get a login-form instead of a static access-denied page, so that a different user can authenticate and if authentication is successful the requested page that needs the higher privileges will open.</p>
  
  <p>The actual spring configuration reads:</p>
  
  <pre><code>&lt;security:http auto-config="true" use-expressions="true" disable-url-rewriting="true"&gt;
      &lt;security:intercept-url pattern="/index.jsp" access="permitAll" /&gt;
      &lt;security:intercept-url pattern="/loginView" access="permitAll" /&gt;
      &lt;security:intercept-url pattern="/accessDenied" access="permitAll"/&gt;
      &lt;security:intercept-url pattern="/user" access="hasRole('ROLE_USER')" /&gt;
      &lt;security:intercept-url pattern="/admin" access="hasRole('ROLE_ADMIN')" /&gt;
      &lt;security:intercept-url pattern="/**" access="denyAll"/&gt;
  
      &lt;security:form-login login-page="/loginView"
          authentication-failure-url="/loginView"
          default-target-url="/dirView" /&gt;
  
      &lt;security:logout /&gt;
      &lt;security:access-denied-handler ref="accessDeniedHandler" /&gt;
  &lt;/security:http&gt;
  </code></pre>
  
  <p>The accessDeniedHandler-Bean:</p>
  
  <pre><code>public class AccessDeniedServletRequestHandler implements AccessDeniedHandler {
  
  /** {@inheritDoc} */
  @Override
  public void handle(HttpServletRequest req, HttpServletResponse resp,
          AccessDeniedException accessDeniedException) throws IOException,
          ServletException {
  
      RequestDispatcher d = req.getRequestDispatcher("/loginView");
      d.forward(req, resp);
  }
  }
  </code></pre>
  
  <p>But that implementation of AccessDeniedHandler only forwards to the loginView. After authentication of an admin the default-success-page is openend and not the original requested page. I also tried to save the original request by calling HttpServletRequest#getAttribute("javax.servlet.forward.servlet_path"), but I don't understand how to force spring security to use that original request instead of the default target url.</p>
  
  <p>Besides I read about org.springframework.security.web.savedrequest.SavedRequest that is used inside spring authentication to remember the original request if an unauthenticated user requests a page. But I don't find a valid way how to use the SavedRequest in the same manner for my access denied scenario.</p>
  
  <p>Thanks in advance for suggestions and solutions.</p>