Why isn't my custom login page displayed with Spring Security 4?

Question

I can use a custom login page with Spring Security 3.2.4, but after migrating using the code below using 4.0.0, I see a general login form instead of my custom one:

<beans:bean id="authSuccessHandler" class="com.company.web.RoleBasedAuthenticationSuccessHandler" /> <http disable-url-rewriting="false" use-expressions="true"> <form-login login-page="/login" username-parameter="j_username" password-parameter="j_password" login-processing-url="/j_spring_security_check" authentication-failure-url="/login?login_error=true" authentication-success-handler-ref="authSuccessHandler"/> <!-- SOME INTERCEPT-URLs (redacted) --> <intercept-url pattern="/login" access="permitAll"/> <remember-me remember-me-parameter="_spring_security_remember_me" remember-me-cookie="SPRING_SECURITY_REMEMBER_ME_COOKIE"/> <logout logout-url="/j_spring_security_logout" logout-success-url="/index" /> </http> 

I also tried to enable debug logging in various Spring classes. I installed it on my own authSuccessHandler, but I do not see any output from it. No luck with a search on SO or Google.

Is there something incompatible in this configuration?

Update:

I also use Apache Tiles:

  <definition name="login" extends="scrollableLayout"> <put-attribute name="header" value="/WEB-INF/jsp/heading_blue.jsp"/> <put-attribute name="body" value="/WEB-INF/jsp/login.jsp"/> </definition> 

And using the following:

  <mvc:view-controller path="/login" /> 

Answer 1

Spring Security 3.x is used as the default login URL ( source : official documentation ) spring_security_login . This can be configured to a user value as <security:form-login login-page="/login"> and mapped to a controller to display the user page.

Spring Security 4.x abandoned spring_security_login and switched to login as the default login URL ( source : official Spring 4.x security transition guide ). Thus, the login URL now goes to Spring's default security infrastructure, which displays the automatically generated login page.

The tool is simple if you use JSP as a presentation rendering technology. Just rename your login page to login.jsp , put it in the root folder of the page hierarchy and Spring. Security will automatically pick it up. If you are not using JSP, you will have to use a different login-page value (perhaps signin instead of login ), and then change the controller mapping as well.

Note that the default exit URL also changed to 4.x. If you have custom logic written for exit URLs, be sure to check this out.

Check out the official migration guide as much has changed in 4.x.