java - PreAuthenticatedAuthenticationProvider UsernameNotFound exception returns 401 instead of denied page -

i use spring 4.1.6.release , spring-security 4.0.1.release.

there requestheaderauthenticationfilter , preauthenticatedauthenticationprovider. want application show 'denied' page, if user service throws usernamenotfoundexception. actually, application shows basic http authorization form (simple browser popup credentials) , provides 401 response if cancelled.

here configuration:

<s:http auto-config="true" use-expressions="true">     <s:intercept-url pattern="/report/**" access="hasrole('role_user')"/>     <s:csrf disabled="true"/>     <s:custom-filter ref="preauthfilter" position="pre_auth_filter"/>     <s:form-login             authentication-failure-url="/denied.jsp"/> </s:http>  <b:bean id="preauthfilter" class="org.springframework.security.web.authentication.preauth.requestheaderauthenticationfilter">     <b:property name="principalrequestheader" value="remote_user"/>     <b:property name="authenticationmanager" ref="authmanager"/> </b:bean>  <s:authentication-manager id="authmanager">     <s:authentication-provider user-service-ref="userdetailsservice"/> </s:authentication-manager>  <b:bean id="userdetailsservice" class="com.db.dump.tool.security.userdetailsserviceimpl"/> 

class userdetailsserviceimpl checks user db , throws usernamenotfoundexception if user not found. maybe here problem? please, advise.

thanks in advance, alex

this behaviour due exceptiontranslationfilter translating final exception as:

access denied (user anonymous); redirecting authentication entry point

user anonymous because userdetailsservice threw exception. getting 401 response because has been implemented way in basicauthenticationentrypoint acts authentication entry point in case of non xmlhttprequest (your case) anonymous user principal.

in case wish show access denied page instead (not giving anonymous user chance authenticate), need plug in own authenticationentrypoint using entry-point-ref attribute on http element (and may let accessdeniedhandler come picture). resulting implmentation this:

import static javax.servlet.http.httpservletresponse.sc_forbidden; import java.io.ioexception; import javax.servlet.servletexception; import javax.servlet.http.httpservletrequest; import javax.servlet.http.httpservletresponse; import org.springframework.security.core.authenticationexception;  public class customauthentrypoint implements authenticationentrypoint {     @override     public void commence(httpservletrequest request, httpservletresponse response,         authenticationexception authexception) throws ioexception, servletexception {         response.setstatus(sc_forbidden); /* can call access denied handler here , let handle meaningful exception pass handle method. */     } } 

ps: of course you'll need configure new authentication entry point spring bean before starts working.