How I can implement a custom authentication?

Question

I have to integrate my system with third-party provider. This system is made with Spring and Angular.

Keep in mind that I need to create a custom login form instead redirecting to thirdy-party provider form like OAuth2.

He has created following endpoints:

Get token authentication

POST http://example.com/webapi/api/web/token

“username=972.344.780-00&password=123456&grant_type=password”

The response send me a token that I must use during all next requests.

Get user info

Authorization: Bearer V4SQRUucwbtxbt4lP2Ot_LpkpBUUAl5guvxAHXh7oJpyTCGcXVTT-yKbPrPDU9QII43RWt6zKcF5m0HAUSLSlrcyzOuJE7Bjgk48enIoawef5IyGhM_PUkMVmmdMg_1IdIb3Glipx88yZn3AWaneoWPIYI1yqZ9fYaxA-_QGP17Q-H2NZWCn2lfF57aHz8evrRXNt_tpOj_nPwwF5r86crEFoDTewmYhVREMQQjxo80

GET http://example.com/webapi/api/web/userInfo

That said, What I need to implement a custom authentication?

Could I use Spring OAuth2 in this case?

Answer 1

you can use Spring Security. The flow is the following. You authenticate against the Security token service. A cookie containing the authentication token is written to your browser. This token is sent on each subsequent request against the server.

On the rest server you will use Srping Security and more specifily you need to use AbstractPreAuthenticatedProcessingFilter in its implementation you will extract the token and associate it With the Security Context.

Here is example configuration of your spring Security

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {


  @Bean
  public AuthenticationManager authenticationManagerBean() throws Exception {
    // TODO Auto-generated method stub
    return super.authenticationManagerBean();
  }

  public void configure(WebSecurity web) throws Exception {
        // do some configuration here
  }

  @Override
  public void configure(HttpSecurity http) throws Exception {
       // configure your Security here 
       // you can add your implementation of AbstractPreAuthenticatedProcessingFilter here
  }

}

Here is your additional configuration

@Configuration
public class ExampleSpringSecurityConfig{


    @Bean
    public AuthenticationManager authenticationManager() {
        return authentication -> authProvider().authenticate(authentication);
    }

    private AuthenticationUserDetailsService<PreAuthenticatedAuthenticationToken> userdetailsService() {
       // Construct your AuthenticationUserDetailsService here
   }

    @Bean
    public PreAuthenticatedAuthenticationProvider authProvider() {
        PreAuthenticatedAuthenticationProvider authProvider = new PreAuthenticatedAuthenticationProvider();
        authProvider.setPreAuthenticatedUserDetailsService(userdetailsService());
        return authProvider;
    }





}