Solution, Geoserver bug with authenticated requests

Geoserver ships with a good list of helpful Demo requests -- however, the authenticated requests fail if you do not add the relevant URL path to a Filter Chain which includes a "form" authentication filter.

If you run any Demo request involving authentication without the relevant Filter Chain modification you will see the following message:

HTTP response: 401 No AuthenticationProvider found for org.springframework.security.authentication.UsernamePasswordAuthenticationToken

The same response is seen when running the request with curl, e.g.:

curl -u admin:geoserver "http://localhost:8080/geoserver/wfs?request=GetFeature&version=1.1.0&typeName=topp:states&outputFormat=GML2&FEATUREID=states.3"

You can resolve this issue by adding the relevant URL path suffix (e.g., /wcs*  or /wfs*) to the "web" Filter Chain, which includes the "form" Authentication Filter.

Access this dialog in the Web Administration interface under Security > Authentication > Filter Chains > web.

I've commented on the bug in the Geoserver project JIRA -- to resolve this bug this issue should be either noted or the underlying xml's changed -- otherwise the Demos fail.