Thursday, April 2, 2015

Spring Security - If you will not use a login page, how to use it?

@If you use other authentication system like OpenID Connect on Spring Security,
@I recommend the following code. Because it doesn't need the login processing.

try {
    // Must be called from request filtered by Spring Security, 
    // otherwise SecurityContextHolder is not updated
    UsernamePasswordAuthenticationToken token = 
     new UsernamePasswordAuthenticationToken("userId", "password");
    token.setDetails(new WebAuthenticationDetails(request));
    Authentication authentication = defaultAuthenticationProvider.authenticate(token);
    logger.debug("Logging in with [{}]", authentication.getPrincipal());
    SecurityContextHolder.getContext().setAuthentication(authentication);
} catch (Exception e) {
    SecurityContextHolder.getContext().setAuthentication(null);
    logger.error("Failure in autoLogin", e);
}


@I will post a full sample coding in the near future.
I referred to the Stackoverflow.
http://stackoverflow.com/questions/4664893/how-to-manually-set-an-authenticated-user-in-spring-security-springmvc Thank you to Kevin Stembridge

No comments:

Post a Comment