Spring Security pass URL parameters to Authentication Provider

Question

Is there a way to pass URL parameters to an authentication provider in Spring Security 3?

Our login page will need to receive an email token as a parameter that the authentication system will need to be aware of when it sets the status of the user. Specifically, it will let a user with a correct token log in that would not otherwise be able to.

I have a custom class extending the DaoAuthenticationProvider class. My authentication logic is in that class's authenticate method.

I'm hoping there is some way to pass this data into the authenticate method.

aquaraga · Accepted Answer · 2013-08-28 19:11:13Z

7

You could inject the HttpServletRequest object on your authentication provider class:

private @Autowired HttpServletRequest request;

Now, you should be able to access the request parameters with APIs such as request.getParameterValues(paramName)

answered Aug 28, 2013 at 19:11

aquaraga

4,18826 silver badges29 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

Nixx Over a year ago

The other option is probably the spring way to do it, but this was so simple.

JackB Over a year ago

Why is this the selected answer? HttpServletRequest is not available within the AuthenticationProvider. Trying to access it will yeild "No thread-bound request found" error.

Nixx Over a year ago

Dunno the issue you're experiencing. It worked for me.

Kalyan Pradhan Over a year ago

This worked for me, @JackB probably you are not including the HTTPServletRequest in the spring security context. Spring context and spring security context are two different concepts

axtavt · Accepted Answer · 2013-08-28 19:21:30Z

4

You need to override UsernamePasswordAuthenticationFilter.setDetails() and pass extra information to your custom authentication provider via details property of UsernamePasswordAuthenticationToken.

answered Aug 28, 2013 at 19:21

axtavt

243k42 gold badges518 silver badges486 bronze badges

2 Comments

Ritesh Over a year ago

Other way, which I would recommend, is to inject a custom authenticationDetailsSource in the default login filter.

Trace Over a year ago

Makes more sense than the accepted reply.

Collectives™ on Stack Overflow

Spring Security pass URL parameters to Authentication Provider

2 Answers 2

4 Comments

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

4 Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related