How do you customize the UsernamePasswordAuthenticationFilter usernameParameter (j_username) and passwordParameter (j_password) properties when using the <http ... /> Spring Security 3 namespace? It's my understanding the <http ... /> creates the filter, but I don't see how to customize it.
-
1I submitted a feature request for this: jira.springframework.org/browse/SEC-1445Taylor Leese– Taylor Leese2010-03-20 18:04:07 +00:00Commented Mar 20, 2010 at 18:04
Add a comment
|
3 Answers
Here is the solution I created based on axtavt's suggestion:
Spring configuration:
<beans:bean id="userPassAuthFilterBeanPostProcessor"
class="com.my.package.UserPassAuthFilterBeanPostProcessor">
<beans:property name="usernameParameter" value="username" />
<beans:property name="passwordParameter" value="password" />
</beans:bean>
Java class:
package com.my.package;
import org.springframework.beans.factory.config.BeanPostProcessor;
import org.springframework.security.web.authentication.
UsernamePasswordAuthenticationFilter;
public class UserPassAuthFilterBeanPostProcessor implements BeanPostProcessor {
private String usernameParameter;
private String passwordParameter;
@Override
public final Object postProcessAfterInitialization(final Object bean,
final String beanName) {
return bean;
}
@Override
public final Object postProcessBeforeInitialization(final Object bean,
final String beanName) {
if (bean instanceof UsernamePasswordAuthenticationFilter) {
final UsernamePasswordAuthenticationFilter filter =
(UsernamePasswordAuthenticationFilter) bean;
filter.setUsernameParameter(getUsernameParameter());
filter.setPasswordParameter(getPasswordParameter());
}
return bean;
}
public final void setUsernameParameter(final String usernameParameter) {
this.usernameParameter = usernameParameter;
}
public final String getUsernameParameter() {
return usernameParameter;
}
public final void setPasswordParameter(final String passwordParameter) {
this.passwordParameter = passwordParameter;
}
public final String getPasswordParameter() {
return passwordParameter;
}
}
Comments
Filter is configured using form-login element, but that element doesn't provide ability to set custom names for username and password.
You can configure directly, as describe in Spring Reference
7 Comments
Taylor Leese
I'm using the <http ... /> namespace for almost all of my configuration so I don't want to move away from using it. I was hoping there was some clean way to configure it and still use the <http .. /> configuration.
uthark
You can report bug in spring JIRA to add required configuration.
Taylor Leese
Sounds like that is what I need to do. I'll submit a feature request.
axtavt
@Taylor: There is a little workaround for configuring features missing in
<http ... /> configuration - you can declare a BeanPostProcessor to apply a custom configuration to the beans being created.Taylor Leese
Thanks. Posted solution based on your suggestion.
|
For those who are using http XML directive spring configuration the required configuration is below
<form-login
username-parameter="userId" password-parameter="password" authentication-success-handler-ref="userAuthenticationSuccessHandler"
authentication-failure-handler-ref="userAuthenticationFailureHandler" />