Crowd login error: java.lang.UnsupportedOperationException: Not giving you the password

Hi Community,

I want to add my Spring Security app to our Crowd System (w/o SSO in the first step).

I made the whole config as written in Atlassian documentation (step by step): https://confluence.atlassian.com/crowd/integrating-crowd-with-spring-security-174752019.html
The spring System was working well with local user list and passwords (only for testing).

My System configuration is:

  • Crowd 3.7.0
  • the application object is generated in Crowd

When I start the login (Spring default form) I see the follwing error message:

java.lang.UnsupportedOperationException: Not giving you the password
	com.atlassian.crowd.integration.springsecurity.user.CrowdUserDetails.getPassword(CrowdUserDetails.java:72)
	org.springframework.security.authentication.dao.DaoAuthenticationProvider.additionalAuthenticationChecks(DaoAuthenticationProvider.java:94)
	org.springframework.security.authentication.dao.AbstractUserDetailsAuthenticationProvider.authenticate(AbstractUserDetailsAuthenticationProvider.java:166)
	org.springframework.security.authentication.ProviderManager.authenticate(ProviderManager.java:174)
	org.springframework.security.authentication.ProviderManager.authenticate(ProviderManager.java:199)
	org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter.attemptAuthentication(UsernamePasswordAuthenticationFilter.java:94)
	org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:212)
	org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
	org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:116)
	org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
	org.springframework.security.web.csrf.CsrfFilter.doFilterInternal(CsrfFilter.java:124)
	org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
	org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
	org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:64)
	org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
	org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
	org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:56)
	org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
	org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
	org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:105)
	org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
	org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:214)
	org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:177)
	org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:347)
	org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:263)

My web search only shows me an article, that I should use the Atlassian documentation.

I tried it out with Spring 4.2.4 and also with Spring 5.2.1 release.
The error message is always the same.
Also I tried to register Crowd Provider seperate in security.xml, it want work too.

Here my configuration files:

spring-secruity.xml (Spring 4.2)

<b:beans xmlns="http://www.springframework.org/schema/security"
             xmlns:b="http://www.springframework.org/schema/beans"
             xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
             xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
						http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd">

    <global-method-security
            secured-annotations="enabled" pre-post-annotations="enabled" >
    </global-method-security>

    <http auto-config="true" />

    <b:bean id="crowdUserDetailsService" class="com.atlassian.crowd.integration.springsecurity.user.CrowdUserDetailsServiceImpl">
        <b:property name="crowdClient" ref="crowdClient"/>
        <b:property name="authorityPrefix" value="ROLE_"/>
    </b:bean>

    <b:bean id="crowdAuthenticationProvider" class="com.atlassian.crowd.integration.springsecurity.RemoteCrowdAuthenticationProvider">
        <b:constructor-arg ref="crowdClient"/>
        <b:constructor-arg ref="crowdHttpAuthenticator"/>
        <b:constructor-arg ref="crowdUserDetailsService"/>
    </b:bean>
</b:beans>

applicationContext-CrowdRestClient.xml (copied from Crowd.lib):

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xsi:schemaLocation="http://www.springframework.org/schema/beans
                           http://www.springframework.org/schema/beans/spring-beans.xsd">

    <bean id="resourceLocator" class="com.atlassian.crowd.service.client.ClientResourceLocator">
        <constructor-arg value="crowd.properties"/>
    </bean>

    <bean id="clientProperties" class="com.atlassian.crowd.service.client.ClientPropertiesImpl" factory-method="newInstanceFromResourceLocator">
        <constructor-arg type="com.atlassian.crowd.service.client.ResourceLocator" ref="resourceLocator"/>
    </bean>

    <bean id="crowdClientFactory" class="com.atlassian.crowd.integration.rest.service.factory.RestCrowdClientFactory"/>

    <bean id="crowdClient" factory-bean="crowdClientFactory" factory-method="newInstance">
        <constructor-arg ref="clientProperties"/>
    </bean>

    <bean id="validationFactorExtractor" class="com.atlassian.crowd.integration.http.util.CrowdHttpValidationFactorExtractorImpl" factory-method="getInstance"/>

    <bean id="tokenHelper" class="com.atlassian.crowd.integration.http.util.CrowdHttpTokenHelperImpl" factory-method="getInstance">
        <constructor-arg ref="validationFactorExtractor"/>
    </bean>

    <bean id="crowdHttpAuthenticator" class="com.atlassian.crowd.integration.http.CrowdHttpAuthenticatorImpl">
        <constructor-arg ref="crowdClient"/>
        <constructor-arg ref="tokenHelper"/>
        <constructor-arg ref="clientProperties"/>
    </bean>

    <bean id="crowdSecurityFilter" class="com.atlassian.crowd.integration.http.filter.CrowdSecurityFilter">
        <constructor-arg ref="crowdHttpAuthenticator"/>
        <constructor-arg ref="clientProperties"/>
    </bean>

</beans>

web.xml

	<context-param>
		<param-name>contextConfigLocation</param-name>
		<param-value>
			/WEB-INF/spring/applicationContext-CrowdRestClient.xml
			/WEB-INF/spring/spring-security.xml
		</param-value>
	</context-param>

	<filter>
		<filter-name>springSecurityFilterChain</filter-name>
		<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
	</filter>
	<filter>
		<filter-name>struts2</filter-name>
		<filter-class>org.apache.struts2.dispatcher.filter.StrutsPrepareAndExecuteFilter</filter-class>
	</filter>

	<filter-mapping>
		<filter-name>springSecurityFilterChain</filter-name>
		<url-pattern>/*</url-pattern>
	</filter-mapping>
	<filter-mapping>
		<filter-name>struts2</filter-name>
		<url-pattern>/*</url-pattern>
	</filter-mapping>

	<listener>
		<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
	</listener>

No errors were displayed when app starts in Tomcat debug mode. Spring seems to be initialized well.
Also no lib error´s are shown.

Do you have any idea how to fix it?

Regards
Uli