Spring security and custom AuthenticationFilter with Spring boot

Question

I have custom authentication filter which creates PreAuthenticatedAuthenticationToken and stores it in security context. This all works fine. Here is the config:

@Configuration
@EnableWebMvcSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private SsoAuthenticationProvider authenticationProvider;

    @Autowired
    private SsoAuthenticationFilter ssoAuthenticationFilter;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.addFilterAfter(ssoAuthenticationFilter, SecurityContextPersistenceFilter.class);
    }
}

Now my ssoAuthenticationFilter is part of the FilterChainProxy, on the right position. Smooth.

But as the ssoAuthenticationFilter is Filter it gets picked up by Boot and included as a filter. So my filter chain really looks like:

• ssoAuthenticationFilter (included because being Filter)
• filterChainProxy (spring autoconfiguration)
  • ...
  • SecurityContextPersistenceFilter
  • ssoAuthenticationFilter (included by http.addFilterAfter(...))
  • ...
• some other filters

Obviously I would like to get rid of the autoregistration of the ssoAuthenticationFilter here (the first one listed).

Any tips much appreciated.

Answer 1

2 choices:

1. Add a FilterRegistrationBean @Bean with your filter bean as its target filter and mark it as enabled=false

2. Don't create a @Bean definition for your filter (normally that's what I do, but YMMV since you might depend on autowiring or something to get it working)