Spring Security authenticationmanager must be specified - for custom filter

Question

I’m trying to create a custom username password authentication filter since I need to validate passwords from two different sources. I’m using Spring Boot 1.2.1 and Java configuration. The error I get when deploying is

Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'customUsernamePasswordAuthenticationFilter' defined in file [/Users/rjmilitante/Documents/eclipse-workspace/login-service/bin/com/elsevier/eols/loginservice/CustomUsernamePasswordAuthenticationFilter.class]: Invocation of init method failed; nested exception is java.lang.IllegalArgumentException: authenticationManager must be specified
…
Caused by: java.lang.IllegalArgumentException: authenticationManager must be specified

I’m not sure what I’m missing. I have been trying to set authenticationManager for this filter in my SecurityConfig. My code looks like

my filter:

@Component
public class CustomUsernamePasswordAuthenticationFilter extends AbstractAuthenticationProcessingFilter {

    public CustomUsernamePasswordAuthenticationFilter(RequestMatcher requiresAuthenticationRequestMatcher) {
        super(requiresAuthenticationRequestMatcher);
        // TODO Auto-generated constructor stub
    }

    public CustomUsernamePasswordAuthenticationFilter() {
        super(new AntPathRequestMatcher("/login","POST"));
        // TODO Auto-generated constructor stub
    }

    public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response)
            throws AuthenticationException {
        // String dbValue = request.getParameter("dbParam");
        // request.getSession().setAttribute("dbValue", dbValue);
        System.out.println("attempting to authentificate");
        while (request.getAttributeNames().hasMoreElements()) {
            String e = (String) request.getAttributeNames().nextElement();
            System.out.println("param name : " + e + " and param value : " + request.getAttribute(e));
        }
        return null;
    }
}

my security config:

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class SecurityConfig extends WebSecurityConfigurerAdapter{

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Bean(name="loginService")
    public LoginService loginService(){
        return new LoginServiceImpl();
    }

    @Bean( name="myAuthenticationManager")
     @Override
     public AuthenticationManager authenticationManagerBean() throws Exception {
         return super.authenticationManagerBean();
     }

    @Bean
    CustomUsernamePasswordAuthenticationFilter customUsernamePasswordAuthenticationFilter() throws Exception {
        CustomUsernamePasswordAuthenticationFilter customUsernamePasswordAuthenticationFilter = new CustomUsernamePasswordAuthenticationFilter();
        customUsernamePasswordAuthenticationFilter.setAuthenticationManager(authenticationManagerBean());
      return customUsernamePasswordAuthenticationFilter;
    }


    @Autowired
    private myAuthenticationProvider myAuthenticationProvider;

    protected void configure(HttpSecurity http) throws Exception {
        http.csrf().disable()
        .authorizeRequests()
        .anyRequest().authenticated()
        .and()
        /*.addFilterBefore(customUsernamePasswordAuthenticationFilter(), UsernamePasswordAuthenticationFilter.class)*/;

    }

    public void configure(AuthenticationManagerBuilder auth)  throws Exception {

        auth.authenticationProvider(myAuthenticationProvider);
        }
}

Can anyone take a look? not sure what’s up with it.

Answer 1

I actually got past the error. I just had to remove the @Component annotation from my custom filter.

Answer 2

The documentation for AbstractAuthenticationProcessingFilter states that you must set an AuthenticationManager.

I suggest you try adding the following code inside your CustomUsernamePasswordAuthenticationFilter class:

@Override
@Autowired
public void setAuthenticationManager(AuthenticationManager authenticationManager) {
    super.setAuthenticationManager(authenticationManager);
}