Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

How to get a reference to SessionAuthenticationStrategy without configuring the strategy explicit?

In a Spring Security 3.2 based application I have a explicit configured UsernamePasswordAuthenticationFilter, that need an reference to the sessionAuthenticationStrategy (in order to invoke .onAuthentication).*

The sessionAuthenticationStrategy is the default one created by <security:http> (HttpSecurityBeanDefinitionParser).

My question: Is how can I get an reference to the SessionAuthenticationStrategy without configuring the complete SessionAuthenticationStrategy explicite, so that I can inject this reference in XML configuration?

<security:http auto-config="false" use-expressions="true"
    entry-point-ref="loginUrlAuthenticationEntryPoint" 
    access-decision-manager-ref="httpAccessDecisionManager">
    ...
    <security:custom-filter
             ref="usernamePasswordAuthenticationFilter"
             position="FORM_LOGIN_FILTER"/>
    ...
</security:http>

...

<bean id="usernamePasswordAuthenticationFilter"
    class=" o.s.scurity.web.authentication.UsernamePasswordAuthenticationFilter">

   <property name="sessionAuthenticationStrategy" ref="????">   <!-- ?? ->
   ...
</bean>

*my real UsernamePasswordAuthenticationFilter is a customized subclass, but that should not matter for this question

like image 652
Ralph Avatar asked Oct 17 '14 17:10

Ralph


People also ask

How Spring Security manages session?

By default, Spring Security will create a session when it needs one — this is “ifRequired“. For a more stateless application, the “never” option will ensure that Spring Security itself won't create any session. But if the application creates one, Spring Security will make use of it.

What is SessionAuthenticationStrategy?

Interface SessionAuthenticationStrategyAllows pluggable support for HttpSession-related behaviour when an authentication occurs. Typical use would be to make sure a session exists or to change the session Id to guard against session-fixation attacks.

What is SessionCreationPolicy?

Enum SessionCreationPolicySpecifies the various session creation policies for Spring Security.

How does Spring Boot generate session ID?

getSessionId(); This relies on Spring's RequestContextHolder , so it should be used with Spring MVC's DispatcherServlet or you should have a RequestContextListener declared. Also session will be created if not exists.


1 Answers

When working with JavaConfig (I'm afraid is not your case) you can get a reference by doing

        http.getConfigurer(SessionManagementConfigurer.class).init(http);
        http.getSharedObject(SessionAuthenticationStrategy.class);
like image 57
Jordi Avatar answered Oct 12 '22 01:10

Jordi