Spring Security 3 - MVC Integration: Using A Custom Authentication Manager

In this tutorial we will create a simple Spring 3 MVC application with authentication and authorization support using Spring Security 3. We will implement a custom authentication manager for our custom requirement. This tutorial is a variation of the Spring Security - MVC Integration Tutorial (Part 2). It's highly recommended that you read that first before you read further. This tutorial will focus on the differences from the previous tutorial. Most of the code are still exactly the same in both tutorials.

Note: I suggest reading the following tutorial as well which uses the latest Spring Security 3.1
Spring Security 3.1 - Implement UserDetailsService with Spring Data JPA

What is Spring Security?

Spring Security provides comprehensive security services for J2EE-based enterprise software applications. There is a particular emphasis on supporting projects built using The Spring Framework, which is the leading J2EE solution for enterprise software development. If you're not using Spring for developing enterprise applications, we warmly encourage you to take a closer look at it. Some familiarity with Spring - and in particular dependency injection principles - will help you get up to speed with Spring Security more easily.

Source: http://static.springsource.org/spring-security/site/docs/3.1.x/reference/introduction.html#what-is-acegi-security

Let's start by showing the contents of our modified spring-security.xml file

spring-security.xml

Half of this configuration file is still the same as with our previous spring-security.xml.

Here are the notable changes:
1. The auto-config tag is now set to false.


This is set to false so that we can assign custom filters.

2. The form-login tag and its attributes are removed.


This element had been removed because we will provide a custom authentication manager.

3. The child elements of authentication-manager are removed.


The child elements had been removed because we will provide a custom authentication manager.

4. We declared a custom AuthenticationEntryPoint bean and reference that in the http tag:

5. We declared a custom-filter tag inside the http tag:

The FORM_LOGIN_FILTER is an alias among the Spring-Security filter chain. For a thorough treatment of this subject, please read Spring Security Reference for Security Namespace Configuration and Table 2.1. Standard Filter Aliases and Ordering for the actual ordering and filter classes associated for each alias.

6. Declare the authenticationFilter bean:

UsernamePasswordAuthenticationFilter is the default class for the FORM_LOGIN_FILTER alias. We're reusing this implementation, and provide our extension points in its properties.

7. Declare the required bean properties:

CustomAuthenticationManager is our custom authentication manager. SimpleUrlAuthenticationFailureHandler and SimpleUrlAuthenticationSuccessHandler are standard classes uses by the UsernamePasswordAuthenticationFilter. We declared these two beans so that we can assign a custom failure url and a default target url. Remember we have removed the form-login tag which provides a convenient way of declaring special urls. They don't exist now so must provide it.

Let's examine the contents of CustomAuthenticationManager:

CustomAuthenticationManager

CustomAuthenticationManager implements the authenticate method to provide a custom authentication process. To retrieve the users from the database, it communicates through the UserDAO. Then it compares the results retrieved from the database to the entries received from the login form. If the username and password are the same, we throw a BadCredentialsException.

Here's another filter.

If you examine closely the spring-security.xml file, I've declared another filter named BlacklistFilter:

This filter is executed before the alias FILTER_SECURITY_INTERCEPTOR. This filter will deny web access if the username is equal to 'mike'. Sorry mike :)

BlacklistFilter

Please read the comments within the class for an explanation of this filter.

Besides the files we discussed here, everything else is still the same as with the previous tutorial Spring Security - MVC Integration Tutorial (Part 2)

Our application is now finished. We managed to setup a simple Spring 3 MVC application with authentication and authorization support using Spring Security 3. In addition, we've managed to create a custom authentication manager. We've also leveraged Spring's MVC programming model via annotation.

The best way to learn further is to try the actual application.

Download the project
You can access the project site at Google's Project Hosting at http://code.google.com/p/spring3-security-mvc-integration-tutorial/

You can download the project as a Maven build. Look for the spring-security-custom-auth-manager.zip in the Download sections.

You can run the project directly using an embedded server via Maven.
For Tomcat: mvn tomcat:run
For Jetty: mvn jetty:run

If you want to learn more about Spring MVC and Spring Security, feel free to read my other tutorials in the Tutorials section.

References:
Spring Security 3.1.0.M2 API
Spring Security Reference Documentation

---

Share the joy: blogger tutorials Social Bookmarking Blogger Widget I'm reading: Spring Security 3 - MVC Integration: Using A Custom Authentication Manager ~

Subscribe by reader Subscribe by email Share