How to represent the Spring Security "custom-filter" using Java configuration?

Question

What is the equivalent Java configuration for the Spring Security <custom-filter> tag?

<http>   <custom-filter position="FORM_LOGIN_FILTER" ref="myFilter"/> </http> 

I tried

http.addFilter( new MyUsernamePasswordAuthenticationFilter() ) 

where the class extends the default filter, but it always employs the formLogin default.

My filter:

import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse;  import org.springframework.security.authentication.AuthenticationServiceException; import org.springframework.security.authentication.UsernamePasswordAuthenticationToken; import org.springframework.security.core.Authentication;  import org.springframework.security.core.AuthenticationException; import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;  public class MyUsernamePasswordAuthenticationFilter extends UsernamePasswordAuthenticationFilter{      // proof of concept of how the http.addFilter() works      @Override     public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response)             throws AuthenticationException {         if (!request.getMethod().equals("POST")) {             throw new AuthenticationServiceException("Authentication method not supported: " + request.getMethod());         }          System.out.println("running my own version of UsernmePasswordFilter ... ");          String username = obtainUsername(request);         String password = obtainPassword(request);          if (username == null) {             username = "";         }          if (password == null) {             password = "";         }          username = username.trim();          UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(username, password);          // Allow subclasses to set the "details" property         setDetails(request, authRequest);          return this.getAuthenticationManager().authenticate(authRequest);     } } 

The relevant configuration piece:

@Configuration @EnableWebMvcSecurity  // annotate class configuring AuthenticationManagerBuilder @ComponentScan("com.kayjed") public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter {      @Override     protected void configure(HttpSecurity http) throws Exception {        http         .authorizeRequests()             .antMatchers("/resources/**","/signup").permitAll()             .anyRequest().authenticated()             .and()         .formLogin()             .loginPage("/login")             .permitAll()             .and()         .logout()             .permitAll();        http.addFilter(new MyUsernamePasswordAuthenticationFilter());     }      ... } 

Running the MVC app in the debugger always shows the login attempts authentication from the default UsernamePasswordAuthenticationFilter instead of my intention of employing the MyUsernamePasswordAuthenticationFilter class.

Anyways, I am not trying to get someone to debug code; rather, I would love to see a good example using Java configuration that performs the equivalent of the custom-filter element in the XML approach. The documentation is a bit terse.

Answer 1

A few issues you may need to keep in mind:

1. Your filter needs to be added before the standard UsernamePasswordAuthenticationFilter

    http.addFilterBefore(customUsernamePasswordAuthenticationFilter(),         UsernamePasswordAuthenticationFilter.class) 

2. If you extend UsernamePasswordAuthenticationFilter your filter will return immediately without doing anything unless you set a RequestMatcher

    myAuthFilter.setRequiresAuthenticationRequestMatcher(     new AntPathRequestMatcher("/login","POST")); 

3. All the configuration you do in http.formLogin().x().y().z() is applied to the standard UsernamePasswordAuthenticationFilter not the custom filter you build. You will need to configure it manually yourself. My auth filter initialization looks like this:

    @Bean public MyAuthenticationFilter authenticationFilter() {     MyAuthenticationFilter authFilter = new MyAuthenticationFilter();     authFilter.setRequiresAuthenticationRequestMatcher(new AntPathRequestMatcher("/login","POST"));     authFilter.setAuthenticationManager(authenticationManager);     authFilter.setAuthenticationSuccessHandler(new MySuccessHandler("/app"));     authFilter.setAuthenticationFailureHandler(new MyFailureHandler("/login?error=1"));     authFilter.setUsernameParameter("username");     authFilter.setPasswordParameter("password");     return authFilter; }