Add filter before OAuth2AuthenticationProcessingFilter

Question

I am using spring-security-oauth2 in IDP mode and spring-boot. I need to do some work before the oauth token is extracted from the request. How do I add a filter before OAuth2AuthenticationProcessingFilter?

I have tried:

@Configuration
@EnableResourceServer
public class OAuth2ResourceServerConfigurerAdapter extends ResourceServerConfigurerAdapter {

    @Override
    public void configure(HttpSecurity http) throws Exception {

        http.authorizeRequests().anyRequest().authenticated().and()
                .addFilterBefore(new MyFilter(), OAuth2AuthenticationProcessingFilter.class);
    }

}

But I get the following exception:

java.lang.IllegalArgumentException: Cannot register after unregistered Filter class org.springframework.security.oauth2.provider.authentication.OAuth2AuthenticationProcessingFilter

I guess this might be because @EnableResourceServer is executed after configure(HttpSecurity http).

I am using these filters in multiple WebSecurityConfigs. As long as Interceptors allow this I should be able to use them. I also need to control the order in which the filter runs (TenantFilter runs before JwtFilter which in turn runs before WebAsyncManagerIntegrationFilter etc.). I also need to be able to selectively use different Interceptors for different WebSecurityConfigs. Is this possible with Interceptors? Can you provide an example? — jax
– jax, Commented Oct 18, 2017 at 5:21
This may be help for you. stackoverflow.com/q/11586757/4423636 — Ataur Rahman Munna
– Ataur Rahman Munna, Commented Oct 18, 2017 at 6:36
@jax Did you solve this? I have the exact same problem, and it only ends up with anti-patterns and ugly stuff :( I'd like to be able to add a filter, once the filterchain has been created by @EnableResourceServer. — sjahan
– sjahan, Commented Nov 6, 2018 at 16:52

Olegdelone · Accepted Answer · 2019-02-01 13:25:55Z

6

I achieved desired functional by doing this

                .addFilterBefore(new MyTokenFilter(), AbstractPreAuthenticatedProcessingFilter.class)

answered Feb 1, 2019 at 13:25

Olegdelone

1991 gold badge4 silver badges16 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Apollo917 Sep 21 at 19:37

Hi, why does it works?

Diego Patiño · Accepted Answer · 2019-08-23 19:41:42Z

2

The following worked for me

   @Override
   public void configure(HttpSecurity http) throws Exception {
       http
         .addFilterBefore(new MyFilter(), AbstractPreAuthenticatedProcessingFilter.class)
         .authorizeRequests().anyRequest().fullyAuthenticated()
       ;
   }

Result

Security filter chain: [
  WebAsyncManagerIntegrationFilter
  SecurityContextPersistenceFilter
  HeaderWriterFilter
  LogoutFilter
  MyFilter
  OAuth2AuthenticationProcessingFilter
  RequestCacheAwareFilter
  SecurityContextHolderAwareRequestFilter
  AnonymousAuthenticationFilter
  SessionManagementFilter
  ExceptionTranslationFilter
  FilterSecurityInterceptor
]

answered Aug 23, 2019 at 19:41

Diego Patiño

612 bronze badges

Collectives™ on Stack Overflow

Add filter before OAuth2AuthenticationProcessingFilter

2 Answers 2

1 Comment

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related