i've got code seems working ok.
filter
public class jsonauthenticationfilter extends abstractauthenticationprocessingfilter { private final objectmapper objectmapper; private final validator validator; protected jsonauthenticationfilter( final requestmatcher matcher, final objectmapper objectmapper, final validator validator ) { super( matcher ); this.objectmapper = objectmapper; this.validator = validator; } @override public authentication attemptauthentication( final httpservletrequest request, final httpservletresponse response ) throws authenticationexception, ioexception, servletexception { passwordcredentials credentials; try { credentials = objectmapper.readvalue( request.getreader(), passwordcredentials.class ); databinder databinder = new databinder( credentials ); databinder.setvalidator( validator ); databinder.validate(); } catch ( final exception e ) { throw new badrequestexception( "bad request", e ); } abstractauthenticationtoken authrequest = credentials.toauthenticationtoken(); setdetails( request, authrequest ); return this.getauthenticationmanager().authenticate( authrequest ); } protected void setdetails( httpservletrequest request, abstractauthenticationtoken authrequest ) { authrequest.setdetails( authenticationdetailssource.builddetails( request ) ); } @override @autowired public void setauthenticationmanager( final authenticationmanager authenticationmanager ) { super.setauthenticationmanager( authenticationmanager ); } }
filter config
@configuration class filterconfig { @bean authenticationsuccesshandler successhandler() { return new mysavedrequestawareauthenticationsuccesshandler(); } @bean authenticationfailurehandler failurehandler() { return new simpleurlauthenticationfailurehandler(); } @bean jsonauthenticationfilter authenticationfilter( final objectmapper mapper, final validator validator ) { requestmatcher matcher = new andrequestmatcher( arrays.aslist( new antpathrequestmatcher( "/authentication/password", "post" ), new mediatyperequestmatcher( new contenttypecontentnegotiationstrategy(), mediatype.application_json, mediatype.application_json_utf8 ) ) ); jsonauthenticationfilter filter = new jsonauthenticationfilter( matcher, mapper, validator ); filter.setauthenticationsuccesshandler( successhandler() ); filter.setauthenticationfailurehandler( failurehandler() ); return filter; } }
security config
@configuration @order( securityconstants.web_security_config + 2 ) class websecurityconfig extends websecurityconfigureradapter { private final jsonauthenticationfilter authenticationfilter; websecurityconfig( final jsonauthenticationfilter authenticationfilter ) { this.authenticationfilter = authenticationfilter; } @bean sessionrepository<expiringsession> sessionrepository() { return new mapsessionrepository(); } @override protected void configure( final httpsecurity http ) throws exception { http .exceptionhandling() .authenticationentrypoint( ( request, response, authexception ) -> { response.senderror( httpservletresponse.sc_unauthorized ); } ) .and() .addfilterat( authenticationfilter, usernamepasswordauthenticationfilter.class ) .formlogin() .and() .csrf().disable(); }
i'm using test verify login has done of appropriate things, failing on missing set-cookie
header.
@springboottest @autoconfiguremockmvc @runwith( springrunner.class ) public class authenticationtest extends abstractsecuritytest { @autowired private mockmvc mvc; @autowired private gson gson; @test public void validlogin() throws exception { log.debug( "posting password" ); string json = gson.tojson( new passwordcredentials( name, pass ) ); this.mvc.perform( post( "/authentication/password" ) .contenttype( mediatype.application_json ) .content( json ) ) .andexpect( header().string( "set-cookie", startswith( "session" ) ) ) .andexpect( status().is2xxsuccessful() ); }
it not go on create session, or presumably, many other things if doing form login. i've tried number of things outside of i've shown here, current iteration. note: using spring boot versions in spring platform athens rc1.
what need add/remove continue doing same things if were using formlogin
?
Comments
Post a Comment