Spring-Security http-basic auth in addition to other authentication types

Question

I have a pretty standard existing webapp using spring security that requires a database-backed form login for user-specific paths (such as /user/**), and some completely open and public paths (such as /index.html).

However, as this webapp is still under development, I'd like to add a http-basic popup across all paths (/**) to add some privacy. Therefore, I'm trying to add a http-basic popup that asks for a universal user/pass combo (ex admin/foo) that would be required to view any path, but then still keep intact all of the other underlying authentication mechanisms.

I can't really do anything with the <http> tag, since that will confuse the "keep out the nosy crawlers" authentication with the "user login" authentication, and I'm not seeing any way to associate different paths with different authentication mechanisms.

Is there some way to do this with spring security? Alternatively, is there some kind of a dead simple filter that I can apply independently of spring-security's authentication mechanisms?

Raghuram · Accepted Answer · 2011-01-03 05:49:22Z

1

Or you can check out the upcoming spring security 3.1 (which is currently 3.1.0.M2), which supports multiple namespace elements.

answered Jan 3, 2011 at 5:49

Raghuram

52.8k11 gold badges114 silver badges124 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

mhaller · Accepted Answer · 2011-01-03 05:32:55Z

0

Yes, you can use multiple authentication filters in Spring Security. However, the best way I have found is to omit the <http> element of the Spring Security namespace and instead use the normal Spring Bean notation.

Specifying all the Spring Security beans 'by hand' brings you the needed flexibility to control the intercepted URLs and which filters will fire for which URL patterns.

The downside is that it requires specifying a lot of extra bean definitions, many of them are not as readable as the namespace-variant of course.

answered Jan 3, 2011 at 5:32

mhaller

14.2k2 gold badges44 silver badges62 bronze badges

1 Comment

Keith Over a year ago

I didn't know you could do it without the http tag - this would be a much better long term solution, but in my case I just needed a quick hack to avoid the additional complexity you describe. I'll stick with my solution, but your answer is better :D

Keith · Accepted Answer · 2011-01-03 03:08:05Z

0

I just ended up using a basic filter before spring security, as outlined here:

http://joomla.jcalfee.info/contact/2-java-authentication-filter

this works as a good temporary hack

answered Jan 3, 2011 at 3:08

Keith

3,0285 gold badges28 silver badges30 bronze badges

Collectives™ on Stack Overflow

Spring-Security http-basic auth in addition to other authentication types

3 Answers 3

Comments

1 Comment

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Related