Configure a custom AuthenticationFailureHandler using Java configuration

Question

How can I configure a custom AuthenticationFailureHandler in Spring Security using Java-based configuration? I already have a SecurityConfig class which extends WebSecurityConfigurerAdapter and configures HTTP Basic Authentication using httpBasic(), but I can't figure out how to set the AuthenticationFailureHandler.

My real goal is to redirect to an external URL (login page) instead of returning a 401 response for some requests only (GET requests to certain URLs), so if there's another or better way to do that I'd like to know!

rocky · Accepted Answer · 2014-10-16 06:39:47Z

2

You have to pass it in failureHandler method.. chain can looks like this:

http.formLogin().failureHandler()

Seems that class provided by spring can help you with simple redirect:

http://docs.spring.io/autorepo/docs/spring-security/4.0.0.M2/apidocs/org/springframework/security/web/authentication/SimpleUrlAuthenticationFailureHandler.html

Hope it helps.

answered Oct 16, 2014 at 6:39

rocky

5,0144 gold badges37 silver badges55 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

bsa Over a year ago

Thanks freakman, and your answer is correct for formLogin() so I'm giving you an up-vote. Unfortunately, I didn't mention that I'm actually using HTTP Basic Authentication using httpBasic(). Really sorry for not mentioning that before. I will update my question.

rocky Over a year ago

not tried that before.. but take a look at http.httpBasic().authenticationEntryPoint(authEntryPoint). AuthEntryPoint example is BasicAuthenticationEntryPoint class - it's commence method returns unathorized http response. You can try to provide your class and use sendRedirect method from HttpServletResponse.

Alex Bitek · Accepted Answer · 2015-06-21 16:38:07Z

I used freakman's suggestion of creating a custom BasicAuthenticationEntryPoint class. Here is my code in case anyone else needs to do something similar:

// See https://github.com/spring-projects/spring-security/blob/3.2.x/web/src/main/java/org/springframework/security/web/authentication/www/BasicAuthenticationEntryPoint.java
public class CustomBasicAuthenticationEntryPoint extends BasicAuthenticationEntryPoint {
    private static Logger logger = loggerFactory.getLogger(CustomBasicAuthenticationEntryPoint.class);

    @Value("${crm.integration.sso.login.form.url}")
    private String loginFormUrl;

    /**
     * This method is called when authentication fails.
     */
    @Override
    public void commence(HttpServletRequest request,
            HttpServletResponse response, AuthenticationException authException)
            throws IOException, ServletException {
        String path = request.getRequestURI().substring(request.getContextPath().length());
        logger.info(String.format("CustomBasicAuthenticationEntryPoint.commence() - %s", path));
        if ("GET".equals(request.getMethod().toUpperCase())
                && path.startsWith("/manage")
        ) {
            response.sendRedirect(loginFormUrl);
        } else {
            super.commence(request, response, authException);
        }
    }

}

Collectives™ on Stack Overflow

Configure a custom AuthenticationFailureHandler using Java configuration

2 Answers 2

2 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related