CODEWITHSUNDEEP
springservletshttp-redirectfilterspring-boot
Gianluca Di Vincenzo
Gianluca Di Vincenzo

Reputation: 31

Redirect in a filter with Spring Boot

In my configuration Spring Boot WebSecurityConfig have a filter that I need to see if the user has the expired password, if it is enabled on the application ..

@Configuration
@EnableWebMvcSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    IdentityService userDetailsService;

    @Autowired
    AccountFilter accountFilter;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
                .csrf()
                .and()
                .authorizeRequests()
                .antMatchers("/login", "/recover-credntial",
                        "/logout", "/resources/**").permitAll()
                .and()
                .formLogin()
                .loginPage("/login").failureUrl("/login?error")
                .usernameParameter("username")
                .passwordParameter("password")
                .permitAll()
                .and()
                .logout()
                .logoutSuccessUrl("/login?logout")
                .permitAll()
                .and()
                .exceptionHandling()
                .accessDeniedPage("/403")
                .and().addFilterAfter(accountFilter, UsernamePasswordAuthenticationFilter.class);
    }

    @Override
    protected void configure(AuthenticationManagerBuilder authManagerBuilder)
            throws Exception {
        authManagerBuilder.userDetailsService(userDetailsService).passwordEncoder(passwordEncoder());
    }

    @Bean
    @Override
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        PasswordEncoder encoder = new BCryptPasswordEncoder();
        return encoder;
    }

}

As you see I have .and().addFilterAfter(Account Filter, UsernamePasswordAuthenticationFilter.class); in the HTTP configuration.
How do I define my filter so that it can perform a redirect to the URL of some of my controller? I'm using in Java Web Application 'Spring Boot' with Java Configuration, not file xml!

Upvotes: 1

Views: 6781

Answers (1)

ArunM
ArunM

Reputation: 2314

One approach would be as follows using ExceptionMappingAuthenticationFailureHandler. This will mean not using the servlet though.

Configuration

@Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .authorizeRequests()
                .antMatchers("/", "/home").permitAll()
                .anyRequest().authenticated()
                .and()
            .formLogin()
                .loginPage("/login")
                .permitAll()
                .failureHandler(authenticationFailureHandler())
                .and()
            .logout()
                .permitAll();
    }

Authentication Failure Handler

 @Bean
    public AuthenticationFailureHandler authenticationFailureHandler() {
        ExceptionMappingAuthenticationFailureHandler exceptionMappingAuthenticationFailureHandler = new ExceptionMappingAuthenticationFailureHandler();
        Map<String, String> exMap = new HashMap<String, String>();
        exMap.put("org.springframework.security.authentication.CredentialsExpiredException","/loginerror/credentialsexpired.htm");
        exceptionMappingAuthenticationFailureHandler.setExceptionMappings(exMap);
        return exceptionMappingAuthenticationFailureHandler;
    }

Custom User Details Service

@Service
public class CustomUserDetailsService implements UserDetailsService {

    @Autowired
    private UserRepository userRepository; 

    @Override
    public UserDetails loadUserByUsername(String username)
            throws UsernameNotFoundException {
        // Check if Password Expired then throw 
        throw new CredentialsExpiredException("Expired");
    }

}

Upvotes: 1

Related Questions