Differences between AuthenticationProvider and AuthenticationEntryPoint

Question

Sorry guys, maybe a silly question.

But I need to implement some additional logic for authentication and authorization in my web app and I've not clear in mind where AuthenticationProvider and AuthenticationEntryPoint must be used.

Looking for some examples I somethimes find that an AuthenticationEntryPoint is omitted in security:http section.

But there are situations where also AuthenticationProvider is omitted (a default instance is provided by the framework?) and only a UserDetailsService implementation is needed.

Please, can you clarify some basic concepts?

Answer 1

Short answer:

1. Implement AuthenticationProvider in order to integrate your custom authentication scheme into Spring Security.
2. Implement AccessDecisionVoter in order to integrate your custom authorization scheme into Spring Security. You might also need to implement a custom AccessDecisionManager in some particular cases, altough the bundled ones are typically enough.

Note that neither of those is web-specific, in contrast with AuthenticationEntryPoint, that is a part of Spring Security Web and not Spring Security Core. The main function of AuthenticationEntryPoint is to allow the framework to send some sort of "to access this resource you must authenticate first" notification from application server to web client. Most standard notifications are already implemented in Spring Security Web. For example:

• BasicAuthenticationEntryPoint: This is used with Basic authentication. The "notification" is a HTTP 401 response.
• LoginUrlAuthenticationEntryPoint: Your typical "redirect to login page" behaviour.
• CasAuthenticationEntryPoint: Similar to the former, redirects to an enterprise-wide login page to perform SSO via CAS.
• Http403ForbiddenEntryPoint: The notification is just an HTTP 403 response. This is useful when you use pre-authentication (such as client X.509 certificates) and the user credentials do not provide access.
• ...

As you can see, unless your required behaviour is too specific, you should not need to provide your own implementation of AuthenticationEntryPoint.