Spring Security Authentication Provider

1. Overview

This tutorial will show how to set up an Authentication Provider in Spring Security to allow for additional flexibility compared to the standard scenario using a simple UserDetailsService.

2. The Authentication Provider

Spring Security provides a variety of options for performing authentication. These follow a simple contract – an Authentication request is processed by an AuthenticationProvider and a fully authenticated object with full credentials is returned.

The standard and most common implementation is the DaoAuthenticationProvider – which retrieves the user details from a simple, read-only user DAO – the UserDetailsService. This User Details Service only has access to the username in order to retrieve the full user entity. This is enough for most scenarios.

More custom scenarios will still need to access the full Authentication request to be able to perform the authentication process. For example, when authenticating against some external, third party service (such as Crowd) – both the username and the password from the authentication request will be necessary.

For these, more advanced scenarios, we’ll need to define a custom Authentication Provider:

@Component
public class CustomAuthenticationProvider implements AuthenticationProvider {

    @Override
    public Authentication authenticate(Authentication authentication) 
      throws AuthenticationException {
 
        String name = authentication.getName();
        String password = authentication.getCredentials().toString();
        
        if (shouldAuthenticateAgainstThirdPartySystem()) {
 
            // use the credentials
            // and authenticate against the third-party system
            return new UsernamePasswordAuthenticationToken(
              name, password, new ArrayList<>());
        } else {
            return null;
        }
    }

    @Override
    public boolean supports(Class<?> authentication) {
        return authentication.equals(UsernamePasswordAuthenticationToken.class);
    }
}

Notice that the granted authorities set on the returned Authentication object are empty. This is because authorities are of course application specific.

3. Register the Auth Provider

Now that we’ve defined the Authentication Provider, we need to specify it in the XML Security Configuration, using the available namespace support:

[prismatic_encoded class=%%language-xml%%]Jmx0O2h0dHAgdXNlLWV4cHJlc3Npb25zPSJ0cnVlIiZndDsNCiAgICAmbHQ7aW50ZXJjZXB0LXVybCBwYXR0ZXJuPSIvKioiIGFjY2Vzcz0iaXNBdXRoZW50aWNhdGVkKCkiLyZndDsNCiAgICAmbHQ7aHR0cC1iYXNpYy8mZ3Q7DQombHQ7L2h0dHAmZ3Q7DQoNCiZsdDthdXRoZW50aWNhdGlvbi1tYW5hZ2VyJmd0Ow0KICAgICZsdDthdXRoZW50aWNhdGlvbi1wcm92aWRlcg0KICAgICAgcmVmPSJjdXN0b21BdXRoZW50aWNhdGlvblByb3ZpZGVyIiAvJmd0Ow0KJmx0Oy9hdXRoZW50aWNhdGlvbi1tYW5hZ2VyJmd0Ow==[/prismatic_encoded]

4. Java Configuration

Next, let’s take a look at the corresponding Java configuration:

@Configuration
@EnableWebSecurity
@ComponentScan("com.maixuanviet.security")
public class SecurityConfig extends WebSecurityConfigurerAdapter {
 
    @Autowired
    private CustomAuthenticationProvider authProvider;

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.authenticationProvider(authProvider);
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests().anyRequest().authenticated()
            .and().httpBasic();
    }
}

5. Performing Authentication

Requesting Authentication from the Client is basically the same with or without this custom authentication provider on the back end.

Let’s use a simple curl command to send an authenticated request:

[prismatic_encoded class=%%language-bash%%]Y3VybCAtLWhlYWRlciAiQWNjZXB0OmFwcGxpY2F0aW9uL2pzb24iIC1pIC0tdXNlciB1c2VyMTp1c2VyMVBhc3MgDQogICAgaHR0cDovL2xvY2FsaG9zdDo4MDgwL3NwcmluZy1zZWN1cml0eS1jdXN0b20vYXBpL2Zvby8x[/prismatic_encoded]

For the purposes of this example, we’ve secured the REST API with Basic Authentication.

And we get back the expected 200 OK from the server:

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=B8F0EFA81B78DE968088EBB9AFD85A60; Path=/spring-security-custom/; HttpOnly
Content-Type: application/json;charset=UTF-8
Transfer-Encoding: chunked
Date: Sun, 02 Jun 2013 17:50:40 GMT

6. Conclusion

In this article, we discussed an example of a custom authentication provider for Spring Security.

The full implementation of this tutorial can be found in the GitHub project.

Related posts:

Spring Boot - Zuul Proxy Server and Routing
Guide to the Volatile Keyword in Java
Using a Custom Spring MVC’s Handler Interceptor to Manage Sessions
Spring Boot - Interceptor
Immutable Map Implementations in Java
Removing all Nulls from a List in Java
Guide to the Java Queue Interface
Java Program to Find Transitive Closure of a Graph
Intro to Inversion of Control and Dependency Injection with Spring
Java Program to implement Bit Matrix
Java Program to Find the Connected Components of an UnDirected Graph
Java Program to Generate All Possible Combinations Out of a, b, c, d, e
Check if a String is a Palindrome in Java
HashMap trong Java hoạt động như thế nào?
Java Program to Generate Random Numbers Using Middle Square Method
Spring JDBC
Spring Boot - Runners
Spring Boot: Customize the Jackson ObjectMapper
Java Program to Find kth Smallest Element by the Method of Partitioning the Array
Java Program to Perform Inorder Non-Recursive Traversal of a Given Binary Tree
Request Method Not Supported (405) in Spring
ClassNotFoundException vs NoClassDefFoundError
Java Program to Find the Shortest Path Between Two Vertices Using Dijkstra’s Algorithm
Using Spring @ResponseStatus to Set HTTP Status Code
Spring Cloud AWS – Messaging Support
Java Program to Implement Insertion Sort
Java Program to Check for balanced parenthesis by using Stacks
Setting a Request Timeout for a Spring REST API
Setting the Java Version in Maven
Java Program to Find the Longest Subsequence Common to All Sequences in a Set of Sequences
Registration with Spring Security – Password Encoding
Java – Delete a File