CODEWITHSUNDEEP
spring-security
Sandy
Sandy

Reputation: 1012

Does Spring Security gives any such API where I can pass username & password and get the Authentication Object?

Does Spring Security gives any such API where I can pass username & password and it will return either Authentication Object for successful authentication or AuthenticationCredentialsNotFoundException for unsuccessful authentication?

Let me elaborate my requirements:

Our application has a HTTP API(say, /createXXX.do) and the client is hitting this with username, password & other parameters.

Now I want to authenticate + authorize this access (coming from HTTP Hits to my application).

My planned design is like below: a) I will not restrict access of my HTTP API context(i.e. /createXXX.do)

b) Once the request reached my doGet()/doPost(), I will retrieve the username & password from request and want to use some spring security API like below:

Authentication validateXXXXX(String username, String password) throws AuthenticationCredentialsNotFoundException;

c) so that this above API internally push these username/password to the existing spring security chain and return me the Authentication Object for successful authentication or AuthenticationCredentialsNotFoundException for unsuccessful authentication.

d) For unsuccessful authentication, I will catch AuthenticationCredentialsNotFoundException and return the HttpServletResponse with AUTHENTICATION_ERROR code.

e) and for successful authetication, based on authiories from Authentication Object, I will allow or return the HttpServletResponse with AUTHORIZATION_ERROR code.

Can anyone know about such spring security API? Any pointers/suggestion will be highly appreciated.

Thanks.

Upvotes: 0

Views: 227

Answers (1)

Maksym Demidas
Maksym Demidas

Reputation: 7817

If you have just one authentication source (only LDAP or only DB) you can configure some implementation of org.springframework.security.authentication.AuthenticationProvider in your security context. Then you can use it:

User user = new User(login, password, true, true, true, true, new ArrayList<GrantedAuthority>());
Authentication auth = new UsernamePasswordAuthenticationToken(user, password,new ArrayList<GrantedAuthority>());
try {
    auth = authenticationProvider.authenticate(auth);
} catch (BadCredentialsException e) {
    throw new CustomBadCredentialsException(e.getMessage(), e);
}

// but your need to push authorization object manually
SecurityContext sc = new SecurityContextImpl();
sc.setAuthentication(auth);
SecurityContextHolder.setContext(sc);

It is "low level" manipulation. You can use element from Spring Security namespace. It can provide login controller, even login form for you (and it can handle this situation automatically).

Upvotes: 1

Related Questions