title: Spring Security - Remember Me Authentication Error
body: <p>We are using Spring MVC and are encountering the following issue related to Remember Me authentication:</p>
  
  <ol>
  <li>User logs in with "Remember Me" checked, works properly, persistent_login table is updated as expected</li>
  <li>We restart the app server, perhaps after a deploy, etc</li>
  <li>User refreshes page, we see the error msg in Figure 1, user is redirected to login page (does not see error)</li>
  <li>Despite error, persistent_login entry token has updated (series remains the same as prior to refresh), spring Remember Me token remains same as well.</li>
  <li>User refreshes page a second time, they are logged in like nothing ever happened</li>
  </ol>
  
  <p><strong>Figure 1 -- The error message</strong></p>
  
  <pre><code>Apr 24, 2014 9:29:15 AM org.apache.catalina.core.StandardWrapperValve invoke
  SEVERE: Servlet.service() for servlet [workmarket] in context with path [] threw exception
  java.lang.ClassCastException: org.springframework.security.web.firewall.FirewalledResponse cannot be cast to org.springframework.security.web.context.SaveContextOnUpdateOrErrorResponseWrapper
  at org.springframework.security.web.context.HttpSessionSecurityContextRepository.saveContext(HttpSessionSecurityContextRepository.java:99)
  at org.springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.java:87)
  at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:323)
  at org.springframework.security.web.authentication.AnonymousAuthenticationFilter.doFilter(AnonymousAuthenticationFilter.java:113)
  at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:323)
  at org.springframework.security.web.authentication.rememberme.RememberMeAuthenticationFilter.doFilter(RememberMeAuthenticationFilter.java:139)
  at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:323)
  at org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter.doFilter(SecurityContextHolderAwareRequestFilter.java:54)
  at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:323)
  at org.springframework.security.web.savedrequest.RequestCacheAwareFilter.doFilter(RequestCacheAwareFilter.java:45)
  at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:323)
  at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:167)
  at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:323)
  at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:182)
  at com.workmarket.web.authentication.CustomLinkedInLoginFilter.doFilter(CustomLinkedInLoginFilter.java:100)
  at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:323)
  at com.workmarket.web.authentication.CustomLoginFilter.doFilter(CustomLoginFilter.java:100)
  at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:323)
  at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:105)
  at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:323)
  at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:87)
  at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:323)
  at org.springframework.security.saml.metadata.MetadataGeneratorFilter.doFilter(MetadataGeneratorFilter.java:86)
  at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:323)
  at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:173)
  at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:343)
  at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:260)
  at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:243)
  at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
  at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:222)
  at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:123)
  at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:472)
  at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:171)
  at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:99)
  at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:936)
  at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:118)
  at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:407)
  at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1004)
  at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:589)
  at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:310)
  at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
  at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
  at java.lang.Thread.run(Thread.java:744)
  </code></pre>
  
  <p><strong>Figure 2 -- Security filters</strong></p>
  
  <pre><code>&lt;sec:custom-filter before="FIRST" ref="metadataGeneratorFilter"/&gt;
  &lt;sec:custom-filter after="BASIC_AUTH_FILTER" ref="samlFilter"/&gt;
  &lt;sec:custom-filter ref="customLoginFilter" position="FORM_LOGIN_FILTER"/&gt;
  &lt;sec:custom-filter ref="customLinkedInLoginFilter" after="FORM_LOGIN_FILTER"/&gt;
  &lt;sec:custom-filter ref="rememberMeFilter" position="REMEMBER_ME_FILTER"/&gt;
  &lt;sec:custom-filter ref="switchUserProcessingFilter" position="SWITCH_USER_FILTER"/&gt;
  &lt;sec:custom-filter ref="authenticatedUserInitializer" before="FILTER_SECURITY_INTERCEPTOR"/&gt;
  &lt;sec:custom-filter ref="publicWorkRequestFilter" after="FILTER_SECURITY_INTERCEPTOR"/&gt;
  &lt;sec:custom-filter ref="securityContextCleanupFilter" after="SESSION_MANAGEMENT_FILTER"/&gt;
  &lt;sec:custom-filter ref="customLogoutFilter" position="LOGOUT_FILTER"/&gt;
  </code></pre>
  
  <p><strong>Figure 3 -- Remember Me setup</strong></p>
  
  <pre><code>&lt;!-- Remember me --&gt;
  &lt;bean id="rememberMeFilter" class="org.springframework.security.web.authentication.rememberme.RememberMeAuthenticationFilter"&gt;
      &lt;constructor-arg index="0" ref="org.springframework.security.authenticationManager"/&gt;
      &lt;constructor-arg index="1" ref="rememberMeServices"/&gt;
  &lt;/bean&gt;
  
  &lt;bean id="rememberMeAuthenticationProvider" class="org.springframework.security.authentication.RememberMeAuthenticationProvider"&gt;
      &lt;constructor-arg index="0" value="[REMOVED]"/&gt;
  &lt;/bean&gt;
  
  &lt;bean id="rememberMeServices" class="org.springframework.security.web.authentication.rememberme.PersistentTokenBasedRememberMeServices"&gt;
      &lt;constructor-arg index="0" value="[REMOVED]"/&gt;
      &lt;constructor-arg index="1" ref="userDetailsService"/&gt;
      &lt;constructor-arg index="2" ref="persistentTokenRepository"/&gt;
  &lt;/bean&gt;
  </code></pre>
  
  <p><strong>Versions</strong></p>
  
  <ol>
  <li>spring framework -- 3.2.4.RELEASE</li>
  <li>spring security -- 3.1.0.RELEASE</li>
  <li>spring-security-saml2-core -- 1.0.0.RC2</li>
  <li>opensaml -- 2.5.3</li>
  </ol>
  
  <p><strong>====== UPDATE ======</strong></p>
  
  <p>We have observed that removing these two SAML-related filters resolves this issue, however we do need these to work...</p>
  
  <pre><code>&lt;sec:custom-filter before="FIRST" ref="metadataGeneratorFilter"/&gt;
  &lt;sec:custom-filter after="BASIC_AUTH_FILTER" ref="samlFilter"/&gt;
  </code></pre>
  
  <p><strong>====== UPDATE 2 ======</strong></p>
  
  <p>Details of the samlFilter definition.</p>
  
  <pre><code>&lt;bean id="samlFilter" class="org.springframework.security.web.FilterChainProxy"&gt;
    &lt;security:filter-chain-map request-matcher="ant"&gt;
    &lt;security:filter-chain pattern="/saml/login/**" filters="samlEntryPoint"/&gt;
    &lt;security:filter-chain pattern="/saml/SSO/**" filters="samlWebSSOProcessingFilter"/&gt;
    &lt;/security:filter-chain-map&gt;
  &lt;/bean&gt;
  
  &lt;bean id="samlEntryPoint" class="org.springframework.security.saml.SAMLEntryPoint"&gt;
    &lt;property name="defaultProfileOptions"&gt;
      &lt;bean class="org.springframework.security.saml.websso.WebSSOProfileOptions"&gt;
        &lt;property name="includeScoping" value="false"/&gt;
      &lt;/bean&gt;
    &lt;/property&gt;
  &lt;/bean&gt;
  
  &lt;bean id="samlWebSSOProcessingFilter" class="org.springframework.security.saml.SAMLProcessingFilter"&gt;
    &lt;property name="authenticationManager" ref="samlAuthenticationManager"/&gt;
    &lt;property name="authenticationSuccessHandler"&gt;
      &lt;bean class="org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler"&gt;
        &lt;property name="defaultTargetUrl" value="/"/&gt;
      &lt;/bean&gt;
    &lt;/property&gt;
  &lt;/bean&gt;
  </code></pre>
  
  <p>Thanks in advance.</p>