CODEWITHSUNDEEP
authenticationspring-securityx509certificateclient-certificatesx509
Czar
Czar

Reputation: 1713

Spring Security X.509 authentication without user-service

I'm using Spring Security (v3.1.3) for X.509 authentication in my web-application. Users and roles are stored in the Database, but I don't actually need to do it, as CNs of client certificates conform to "[ROLE] - [USERNAME]" schema, which means I already have username and role from the certificate itself. So how to eliminate the database without too much effort? Should I write my own implementation of user-service, which will populate UserDetails, or is there more graceful method?

Upvotes: 5

Views: 3720

Answers (1)

Shaun the Sheep
Shaun the Sheep

Reputation: 22762

Yes, the simplest option is probably to write a custom AuthenticationUserDetailsService<PreAuthenticatedAuthenticationToken>. The implementations would be something like this:

UserDetails loadUserDetails(PreAuthenticatedAuthenticationToken token) {
    X509Certificate certificate = (X509Certificate[)token.getCredentials();

    // Extract what you want from the certificate
    ...

    // Create the user information
    UserDetails user = ...

    return user;
}

You should be able to use a reference to this bean directly in the user-service-ref namespace attribute <x509 user-service-ref='yourUserServiceBean' />.

Upvotes: 6

Related Questions