How can I define a custom Authentication provider by using Spring Security with Java Configurations? I would like to perform a login checking credentials on my own database.
1
-
spring security documentations gives you all the info you need - how to configure your configuration' XML and endpoints. in addition, you will have to support flows like "create account", "forgot password", etc, which you can use this open source: github.com/OhadR/oAuth2-sample/tree/master/authentication-flowsOhadR– OhadR2014-03-24 10:37:39 +00:00Commented Mar 24, 2014 at 10:37
Add a comment
|
2 Answers
The following does what you need (CustomAuthenticationProvider is your implementation which needs to be managed by Spring)
@Configuration
@EnableWebMvcSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
@Autowired
private CustomAuthenticationProvider customAuthenticationProvider;
@Override
protected void configure(HttpSecurity http) throws Exception {
/**
* Do your stuff here
*/
}
@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.authenticationProvider(customAuthenticationProvider);
}
}
3 Comments
Display name
Is it possible to register a custom authentication provider in addition to the existing ones?
Christoph Grimmer
According to the Spring Docu,
auth.authenticationProvider() will "Add authentication based upon the custom AuthenticationProvider that is passed in." I'd guess that you get a stack of providers in this way.As shown on baeldung.com, define your authentication provider as follow:
@Component
public class CustomAuthenticationProvider implements AuthenticationProvider {
@Override
public Authentication authenticate(Authentication authentication)
throws AuthenticationException {
String name = authentication.getName();
String password = authentication.getCredentials().toString();
if (shouldAuthenticateAgainstThirdPartySystem(username, password)) {
// use the credentials
// and authenticate against the third-party system
return new UsernamePasswordAuthenticationToken(
name, password, new ArrayList<>());
} else {
return null;
}
}
@Override
public boolean supports(Class<?> authentication) {
return authentication.equals(
UsernamePasswordAuthenticationToken.class);
}
}
and following code is corresponding java config:
@Configuration
@EnableWebSecurity
@ComponentScan("org.project.security")
public class SecurityConfig extends WebSecurityConfigurerAdapter {
@Autowired
private CustomAuthenticationProvider authProvider;
@Override
protected void configure(
AuthenticationManagerBuilder auth) throws Exception {
auth.authenticationProvider(authProvider);
}
@Override
protected void configure(HttpSecurity http) throws Exception {
http.authorizeRequests().anyRequest().authenticated()
.and()
.httpBasic();
}
}
1 Comment
moritz
You just copied that straight from baeldung.com/spring-security-authentication-provider . While the answer is certainly helpful, attributing sources is necessary as well.