How to inherit OAuth2AuthenticationProcessingFilter or add custom filter

Question

I am using OAuth2 token in rest based API. I wanted to override OAuth2AuthenticationProcessingFilter so that I can extract token if not provider in header attribute as Authorization(This could be provided as accessToken attribute in header long story don't ask why). Or if not then can anyone tell me how to add another filter after the OAuth2AuthenticationProcessingFilter ?

Did you try .addFilterAfter(yourFilter, OAuth2AuthenticationProcessingFilter.class) in configure(HttpSecurity)? — Roman Puchkovskiy
– Roman Puchkovskiy, Commented Apr 14, 2017 at 18:25
I am using xml namespace configuration how to do this in that config style. — Asad Khan
– Asad Khan, Commented Apr 16, 2017 at 2:40

Roman Puchkovskiy · Accepted Answer · 2017-04-16 11:01:02Z

3

Basically, in XML, to use the defaults, you add resource-server

<oauth:resource-server id="resourceServerFilter"
        token-services-ref="tokenServices"
        resource-id="myId" />

which adds OAuth2AuthenticationManager and OAuth2AuthenticationProcessingFilter (see https://github.com/spring-projects/spring-security-oauth/blob/ec215f79f4f73f8bb5d4b8a3ff9abe15b3335866/spring-security-oauth2/src/main/java/org/springframework/security/oauth2/config/xml/ResourceServerBeanDefinitionParser.java for details)

Then you add that filter into your <sec:http> element:

<sec:custom-filter ref="resourceServerFilter" position="PRE_AUTH_FILTER" />

But if you need to use OAuth2AuthenticationProcessingFilter specialization instead of OAuth2AuthenticationProcessingFilter itself, you could do the following:

I. Add OAuth2AuthenticationManager manually:

<bean id="authenticationManager" class="org.springframework.security.oauth2.config.xml.OAuth2AuthenticationManager">
    <property name="tokenServices" ref="tokenServices"/>
    <property name="resourceId" value="myId"/>
</bean>

II. Add your filter replacement manually:

<bean id="resourceServerFilter"class="YourFilterImplementationClass">
    <property name="authenticationManager" ref="authenticationManager"/>
</bean>

III. Insert the filter to filter chain, as usual:

<sec:custom-filter ref="resourceServerFilter" position="PRE_AUTH_FILTER" />

answered Apr 16, 2017 at 11:01

Roman Puchkovskiy

12k6 gold badges48 silver badges79 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Asad Khan Over a year ago

<property name="resourceId" value="myId"/> why valye is myId here ? Tell me what should be the correct value for resourceId.

Roman Puchkovskiy Over a year ago

Any value you choose, but it has to be the same in <resource-server> and authenticationManager definition at server, and in the client definition (it's resourceIds): stackoverflow.com/questions/8598960/…

Nikhil · Accepted Answer · 2018-11-19 17:47:29Z

1

A better approach could have been to extend org.springframework.security.oauth2.provider.authentication.BearerTokenExtractor and create bean for same and ref it in

<oauth:resource-server id="resourceServerFilter"
        token-services-ref="tokenServices" token-extractor-ref="idofyourtokenextractionbeanhere" 
        resource-id="myId" />

answered Nov 19, 2018 at 17:47

Nikhil

1,04912 silver badges14 bronze badges

1 Comment

veritas Over a year ago

I was able to extract token in spring mvc doing this. thanks

Collectives™ on Stack Overflow

How to inherit OAuth2AuthenticationProcessingFilter or add custom filter

2 Answers 2

2 Comments

1 Comment

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Linked

Related