Spring cannot redirect to secure page

Question

I am writing a Spring application which requires users to log in to access a page that has been secured using Spring security. When the user tries to access the secure page they are asked to log in. If the login is successful the user should be redirected straight to the secure page, otherwise the log in page should be reshown with an error message. Currently the unsuccessful scenario works but if the user does log in properly, the log in page is still reshown, albeit with no error message.

Here is the relevant Java code and Spring configuration:

UserCredentialsController:

//Methods omitted above.


@RequestMapping(value="/login", method = RequestMethod.GET)
public String login(Model model){
    System.out.println("In login() method");
    model.addAttribute("credentials", new User());
    return "login";
}
@RequestMapping(value="/checkcredentials", method = RequestMethod.POST)
public String checkCredentials(@ModelAttribute ("credentials") User user, Model model, HttpServletResponse response){
    if(userService.getUser(user)){
       //I am trying to redirect the user here in the event of a successful log in. Does not work at present. 
        return "redirect:/addincident"; 

        }
        else{
         model.addAttribute("message", "Username and/or password is/are not valid");
            //This works at the moment.
            return "login";
        }
}

spring-security.xml:

<beans:beans xmlns="http://www.springframework.org/schema/security"
       xmlns:beans="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xsi:schemaLocation="http://www.springframework.org/schema/beans
           http://www.springframework.org/schema/beans/spring-beans-3.2.xsd
           http://www.springframework.org/schema/security
           http://www.springframework.org/schema/security/spring-security-3.2.xsd">


 <http auto-config="true">
     <intercept-url pattern="/addincident" access="ROLE_USER, ROLE_ADMIN"/>
     <intercept-url pattern="/**" access="IS_AUTHENTICATED_ANONYMOUSLY"/>
     <form-login login-page="/login"/>
 </http>

<authentication-manager>
  <authentication-provider>
      <user-service>
            <user name="daj" password="123" authorities="ROLE_USER, ROLE_ADMIN" />
            <user name="eoj" password="123" authorities="ROLE_USER" />
      </user-service>
  </authentication-provider>
</authentication-manager>

My thoughts at the moment are that this is a security issue. This is because previously I used Spring's default login page which worked fine when I was using XML-based users. But now I save users in a database and I have my own login page and the navigation no longer works in the way I expect it to.

EDIT: Here is the addIncident method. It loads properly when I use the default Spring log in form.

GeneralIncidentController:

//Methods omitted above.
@RequestMapping(value = "/addincident", method = RequestMethod.GET)
public String addIncident(@RequestParam(value="name", required=false, defaultValue="World") String name, Model model){
    model.addAttribute("message", "Spring 3 MVC Hello World");
    model.addAttribute("name", name);
    model.addAttribute("details", new GeneralIncident());      //Need this to populate bean with submitted data for validation.
    return "myform";
}

Answer 1

You need to add a default-target-url attribute to <form-login login-page="/login"/>, the value will lead to the page the user should meet after successful login, if omitted (like in your case) it leads to the root of the app. So try something like

<security:form-login login-page="/admin/login" default-target-url="/loginsuccess"

UPDATE, to authenticate from service you can try like this

1. Register your custom provider with spring security

   <sec:authentication-manager alias="authenticationManager" erase-credentials="false">
     <sec:authentication-provider ref="customAuthenticationProvider"/>
   </sec:authentication-manager>
   <bean id="customAuthenticationProvider" class="your.package.CustomAuthenticationProvider"/>
   

2. Implement your CustomProvider

   public class CustomAuthenticationProvider implements AuthenticationProvider {
   
   @Autowired
   private YourUserService userService;
   
   
   @Override
   public boolean supports(Class<? extends Object> authentication) {
       return (authentication.equals(UsernamePasswordAuthenticationToken.class) || authentication.equals(UrlAuthenticationToken.class));
   }
   
   @Override
   public Authentication authenticate(Authentication authentication) throws AuthenticationServiceException {
       YourUser user = userService.loginByEmailAndPassword((String) authentication.getPrincipal(), (String) authentication.getCredentials());
       Collection<GrantedAuthority> grantedAuthorities = new ArrayList<>();
       grantedAuthorities.add(new SimpleGrantedAuthority("ROLE_ADMIN"));
       Authentication endUserAuth = new UsernamePasswordAuthenticationToken(user, user.getPassword(), grantedAuthorities);
       return endUserAuth;
   }
   

   }