Spring security and custom AuthenticationFilter with Spring boot

Question

I have custom authentication filter which creates PreAuthenticatedAuthenticationToken and stores it in security context. This all works fine. Here is the config:

@Configuration
@EnableWebMvcSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private SsoAuthenticationProvider authenticationProvider;

    @Autowired
    private SsoAuthenticationFilter ssoAuthenticationFilter;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.addFilterAfter(ssoAuthenticationFilter, SecurityContextPersistenceFilter.class);
    }
}

Now my ssoAuthenticationFilter is part of the FilterChainProxy, on the right position. Smooth.

But as the ssoAuthenticationFilter is Filter it gets picked up by Boot and included as a filter. So my filter chain really looks like:

ssoAuthenticationFilter (included because being Filter)
filterChainProxy (spring autoconfiguration)
- ...
- SecurityContextPersistenceFilter
- ssoAuthenticationFilter (included by http.addFilterAfter(...))
- ...
some other filters

Obviously I would like to get rid of the autoregistration of the ssoAuthenticationFilter here (the first one listed).

Any tips much appreciated.

Dave Syer · Accepted Answer · 2014-08-29 13:00:40Z

11

2 choices:

Add a FilterRegistrationBean @Bean with your filter bean as its target filter and mark it as enabled=false
Don't create a @Bean definition for your filter (normally that's what I do, but YMMV since you might depend on autowiring or something to get it working)

answered Aug 29, 2014 at 13:00

Dave Syer

58.3k10 gold badges161 silver badges147 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Adam Over a year ago

Are there any plans to converge the Spring Security filter configuration with the Spring Boot way of doing it? I'd love to be able to set the order of my servlet filters, including being able to put one before the security filters without having to mess with the HttpSecurity

Dave Syer Over a year ago

Don't think I understand that one (and it doesn't seem to add anything to the answer). Anyway, you can't do security filters as ordered beans because there can be multiple filter chains in one context.

Collectives™ on Stack Overflow

Spring security and custom AuthenticationFilter with Spring boot

1 Answer 1

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related