Custom AuthenticationProcessingFilter for spring security to perform actions on login

February 16th, 2009 | Tags: Spring, spring security, web security

Question like this one popup on the spring security forum all the time. The question is almost always the same. The system must perform some custom action after a user logs in or out of the system. And almost always this action has to be performed on the session like setting an attribute or removing one. Sometimes user’s also want to put their own User object in the session for later use in the application. All these actions can be performed by writing a custom AuthenticationProcessingFilter and replacing the default instance on the filter chain with your implementation.

Before I show you how to write your very own filter, let me just say that you don’t necessarily need to do all this work just to put your user’s details in the session. You can instead write a custom UserDetailsService which returns an extended User object (or your own implementation of UserDetails) which contains your user details. I have written an article showing you how to do the same.

Now onto our filter. First the implementation :

public class MyAuthenticationProcessingFilter extends AuthenticationProcessingFilter {

	@Override
	protected void onSuccessfulAuthentication(HttpServletRequest request,
			HttpServletResponse response, Authentication authResult)
			throws IOException {
		super.onSuccessfulAuthentication(request, response, authResult);
		request.getSession().setAttribute("myValue", "My value is set");
	}
}

Our filter simply sets a session attribute after a user successfully logs into the system.

This filter now needs to be plugged in. If you haven’t yet read the section on adding your own filters to spring security, I seriously suggest that you do, we’re going to use the information provided there to make spring security use our filter instead of the default one. To plug this filter in the following goes into your security-applicationContext.xml :

<bean id="authenticationProcessingFilter" class="com.codercorp.security.MyAuthenticationProcessingFilter">
		<security:custom-filter position="AUTHENTICATION_PROCESSING_FILTER" />
		<property name="defaultTargetUrl" value="/main.html" />
		<property name="authenticationManager" ref="authenticationManager" />
</bean>

You also need to define an AuthenticationProcessingFilterEntryPoint since we’re going to break the default filter chain.

<bean id="authenticationProcessingFilterEntryPoint"
		class="org.springframework.security.ui.webapp.AuthenticationProcessingFilterEntryPoint">
		<property name="loginFormUrl" value="/index.jsp" />
		<property name="forceHttps" value="false" />
	</bean>

And configure an AuthenticationManager as well :

<security:authentication-manager alias="authenticationManager" />

Your security-applicationContext.xml should look something like this :

<security:global-method-security />

<security:http auto-config="false" entry-point-ref="authenticationProcessingFilterEntryPoint">
	<security:intercept-url pattern="/index.jsp" filters="none" />
	<security:intercept-url pattern="/**" access="ROLE_USER" />
</security:http>

<security:authentication-provider user-service-ref="customUserDetailsService" />

<bean id="customUserDetailsService" class="com.codercorp.security.CustomUserDetailsService" />

<bean id="authenticationProcessingFilter" class="com.codercorp.security.MyAuthenticationProcessingFilter">
	<security:custom-filter position="AUTHENTICATION_PROCESSING_FILTER" />
	<property name="defaultTargetUrl" value="/main.html" />
	<property name="authenticationManager" ref="authenticationManager" />
</bean>

<security:authentication-manager alias="authenticationManager" />

<bean id="authenticationProcessingFilterEntryPoint" class="org.springframework.security.ui.webapp.AuthenticationProcessingFilterEntryPoint">
	<property name="loginFormUrl" value="/index.jsp" />
	<property name="forceHttps" value="false" />
</bean>

Remember to switch off auto configuration of spring security by setting auto-config property of the http element to false. If you don’t you’ll get an exception :

Caused by: org.springframework.security.config.SecurityConfigurationException: Filters 'com.codercorp.security.MyAuthenticationProcessingFilter[ order=700; ]' and 'org.springframework.security.ui.webapp.AuthenticationProcessingFilter[ order=700; ]' have the same 'order' value. When using custom filters, please make sure the positions do not conflict with default filters. Alternatively you can disable the default filters by removing the corresponding child elements from <http> and avoiding the use of <http auto-config='true'>.

Your custom AuthenticationProcessingFilter is now ready for use and you can perform actions whenever a user logs in.

Be Sociable, Share!