Thursday, 27 September 2012

Spring MVC Customized User Login Logout Implementation Example

This post describes how to  implement a customized user access to an Spring MVC web application (login logout). As a prerequisite, readers are advised to read this post which introduces several Spring Security concepts.

The code example is available from Github in the Spring-MVC-Login-Logout directory. It is derived from the Spring MVC with annotations example.

Customized Authentication Provider

In order to implement our own way of accepting user login requests, we need to implement an authentication provider. The following lets users in if their id is identical to their passwords:
public class MyAuthenticationProvider implements AuthenticationProvider {

    private static final List<GrantedAuthority> AUTHORITIES
        = new ArrayList<GrantedAuthority>();

    static {
        AUTHORITIES.add(new SimpleGrantedAuthority("ROLE_USER"));
        AUTHORITIES.add(new SimpleGrantedAuthority("ROLE_ANONYMOUS"));

    public Authentication authenticate(Authentication auth)
        throws AuthenticationException {

        if (auth.getName().equals(auth.getCredentials())) {
            return new UsernamePasswordAuthenticationToken(auth.getName(),
                auth.getCredentials(), AUTHORITIES);

        throw new BadCredentialsException("Bad Credentials");


    public boolean supports(Class<?> authentication) {
        if ( authentication == null ) return false;

        return Authentication.class.isAssignableFrom(authentication);



We need to create a security.xml file:
<beans:beans xmlns=""

        <intercept-url pattern="/*" access="ROLE_ANONYMOUS"/>
            always-use-default-target="true" />
        <anonymous />
        <logout />

    <authentication-manager alias="authenticationManager">
      <authentication-provider ref="myAuthenticationProvider" />

    <beans:bean id="myAuthenticationProvider"
      class="com.jverstry.LoginLogout.Authentication.MyAuthenticationProvider" />
The above makes sure all users have the anonymous role to access any page. Once logged in, they are redirected to the main page. If they don't log in, they are automatically considered as anonymous users. A logout function is also declared. Rather than re-implementing the wheel, we use items delivered by Spring itself.

Main Page

We implement a main page displaying the name of the currently logged in user, together with login and logout links:
<%@ taglib prefix="c" uri="" %>
<!doctype html>
<html lang="en">
  <meta charset="utf-8">
  <title>Welcome To MVC Customized Login Logout!!!</title>
    <h1>Spring MVC Customized Login Logout !!!</h1>
    Who is currently logged in? <c:out value="${CurrPrincipal}" /> !<br />
    <a href="<c:url value='/spring_security_login'/>">Login</a>&nbsp;
    <a href="<c:url value='/j_spring_security_logout'/>">Logout</a>


We need to provide the currently logged in user name to the view:
public class MyController {

    @RequestMapping(value = "/")
    public String home(Model model) {


        return "index";



Running The Example

Once compiled, one can start the example by browsing: http://localhost:9292/spring-mvc-login-logout/. It will display the following:

Srping Customized Login Logout

Log in using the same id and password:

The application returns to the main and displays:

More Spring related posts here.


  1. Hi ,
    Great blog! Is there an email address I can contact you in private?

  2. can you show us the project tree view ?? thanks before, this is great...

    1. The project can be downloaded from the link provided at the begining of the post...

  3. Your domain is a magnificent source of ample data! Do you mind if I pingback a couple of of your articles on my personal website?

    1. I am OK if you put a link to the original article.

  4. Great Site - very helpful! Thanks for you time an effort.