Teja Kantamneni: Spring Security - Using custom Authentication Processing Filter

Saturday, August 23, 2008

Spring Security - Using custom Authentication Processing Filter

Recently I got a chance working with Spring security, formerly known as Acegi Security for spring. While working with the framework, I heard comments from friends and colleagues saying that spring security lacks proper documentation. So thought of sharing a little knowledge. By the way, this is first ever blog posting and kindly excuse me and let me know any errors and improvements.

Spring security offers a simple configuration based security for your web applications helping you secure your web application with out littering your business logic with any security code. It provides securing URL's based on the Role (Authorities), securing your business methods based on the ACL's.

The first step in hooking up the spring security to your web application is by specifying the DelegatingFilterProxy in your web.xml.

<!--Spring security filter-->

<filter>

        <filter-name>springSecurityFilterChain</filter-name>

        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>

</filter

 <filter-mapping>

        <filter-name>springSecurityFilterChain</filter-name>

        <url-pattern>/*</url-pattern>

        <dispatcher>REQUEST</dispatcher>

        <dispatcher>INCLUDE</dispatcher>

        <dispatcher>FORWARD</dispatcher>

</filter-mapping>

<!--End spring security filter-->

If you want to externalize all of your security related configuration into a separate file, you can do so and add that to your context location param.

<context-param>

        <param-name>contextConfigLocation</param-name>

        <param-value>

                /WEB-INF/beans.xml , /WEB-INF/springSecurity.xml </param-value>

</context-param>

Now comes the part of security configuration for your application, Adding the URL security patterns is pretty simple and straight forward. Add all the URL patterns which you want to secure and add the wild card pattern at the end. You need to have some default principal and role even for non logged in users as you need to give access to pages like log in, register and forgot password kind of functionality even to non logged in users.

I tried to add comments to pretty much every element which I am using here.
As an example I added just a wild card intercept url which make every page of my application secure. You need to exclude different urls based on the roles.

 <security:http entry-point-ref="myAuthenticationEntryPoint" session-fixation-protection="newSession" >

         <!--add any of your cusotom url patterns to protect-->
         <security:intercept-url pattern="/login/**" access="ROLE_ANONYMOUS"/>
         <security:intercept-url pattern="/register/**" access="ROLE_ANONYMOUS"/>

         <security:intercept-url pattern="/**" access="ROLE_USER"/>

         <security:logout logout-success-url="/home.htm"/>

         <security:anonymous username="guest" granted-authority="ROLE_ANONYMOUS"/>

 </security:http>

 <!--name of my authenticationManager is authenticationManager-->

 <security:authentication-manager alias="authenticationManager"/>

 <!--Cutom login filter which replaces the default AUTHENTICATION_PROCESSING_FILTER -->

 <bean id="customizedFormLoginFilter" class="org.springframework.security.ui.webapp.AuthenticationProcessingFilter" >

         <security:custom-filter position="AUTHENTICATION_PROCESSING_FILTER"/><!--replace the default one-->

         <property name="defaultTargetUrl" value="/main.htm"/><!--After a successful login, the user will be taken to this page-->

         <property name="authenticationFailureUrl" value="/home.htm?error=true" /><!--Authentication failed? take him to error page-->

         <property name="authenticationManager" ref="myAuthenticationManager"/> <!--Here it is the custom authenticationManager, login magic goes here -->

         <property name="allowSessionCreation" value="true" /> <!--Allow the application to create sessions-->

 </bean>

 <!--My custom auth manager-->

 <bean id="myAuthenticationManager" class="com.teja.security.CustomAuthunticationManager" />

 <!-- Automatically receives AuthenticationEvent messages -->

 <bean id="loggerListener" class="org.springframework.security.event.authentication.LoggerListener"/>

 <!--My authuntication entry point, can be replaced easily if we are doing custom commence of invalid auths.-->

 <bean id="myAuthenticationEntryPoint"

 class="com.teja.security.CustomAuthenticationEntryPoint" >

         <property name="loginFormUrl" value="/home.htm"/>

 </bean>

Following is my custom implementation of AuthenticationEntryPoint, which currently is not doing any thing except leveraging the commence to its super class which is the spring implementation of AuthenticationProcessingFilterEntryPoint. I hooked it to add any custom logic.

public class CustomAuthenticationEntryPoint extends AuthenticationProcessingFilterEntryPoint {

 private static final Log logger = LogFactory.getLog(CustomAuthenticationEntryPoint.class);

 @Override

 public void commence(ServletRequest request, ServletResponse response, AuthenticationException authException) throws IOException, ServletException {

 super.commence(request, response, authException);

 }

}

This is my custom authentication manager which actually does the custom login of the user. It will throw an BadCredentialsException in case of invalid credentials or thorws a AuthenticationServiceException in case of a service error (Database error, SQL error or any other error).

public class CustomAuthunticationManager implements AuthenticationManager {

 @Autowired

 UserManagerService userManagerService;

 public Authentication authenticate(Authentication authentication) throws AuthenticationException {

 if(StringUtils.isBlank((String) authentication.getPrincipal()) || StringUtils.isBlank((String) authentication.getCredentials())){

 throw new BadCredentialsException("Invalid username/password");

 }

 User user = null;

 GrantedAuthority[] grantedAuthorities = null;

 try{

 user = userManagerService.getUser((String) authentication.getPrincipal(), (String) authentication.getCredentials());

 }

 catch(InvalidCredentialsException ex){

 throw new BadCredentialsException(ex.getMessage());

 }

 catch(Exception e){

 throw new AuthenticationServiceException("Currently we are unable to process your request. Kindly try again later.");

 }

 if (user != null) {

 List<Role> roles = user.getAssociatedRoles();

 grantedAuthorities = new GrantedAuthority[roles.size()];

 for (int i = 0; i &lt; roles.size(); i++) {

 Role role = roles.get(i);

 GrantedAuthority authority = new GrantedAuthorityImpl(role.getRoleCode());

 grantedAuthorities[i] = authority;

 }

 }

 else{

 throw new BadCredentialsException("Invalid username/password");

 }

 return new UsernamePasswordAuthenticationToken(user, authentication.getCredentials(), grantedAuthorities);

 }

}

At the client side (jsp), the simple configuration you need to do is post the request to"/j_spring_security_check" with parameters "j_username" and "j_password".

That's pretty much all you need to do for enabling spring security to your existing web application. I will try to explain about doing the method security using ACL's and configuring the view using spring security tags in another post.