chapter four

4 Implementing authentication

 

This chapter covers

  • Implementing the authentication logic using a custom AuthenticationProvider
  • Using the HTTP Basic authentication method and Form Login authentication method
  • Understanding and managing the SecurityContext
  • Putting in action everything you have learned until now about the authentication with Spring Security with an example

In chapter 3, we have covered a few of the components acting in the authentication flow. We have discussed the UserDetails and how to define the prototype to describe a user for Spring Security. We have then used the UserDetails in examples where you have learned how the UserDetailsService and UserDetailsManager contracts work and how could they be implemented. We have discussed and used, in examples, the leading implementations of these interfaces as well. Finally, we have learned how a PasswordEncoder manages the passwords and how to use one, as well as the Spring Security Crypto Module, with its encryptors and key generators.

However, the AuthenticationProvider level is the one to do the logic for authentication. The AuthenticationProvider is the place where you will find the conditions and instructions that decide to authenticate or not a request. The component that delegates this responsibility to the AuthenticationProvider is the AuthenticationManager, which receives the request from the HTTP filter itself. The authentication process can only have two possible results:

4.1   Understanding the AuthenticationProvider

4.2   Using the SecurityContext

4.2.1   Using the MODE_THREADLOCAL holding strategy for the security context

4.2.2   Using the MODE_INHERITABLETHREADLOCAL holding strategy for asynchronous calls

4.2.3   Using the MODE_GLOBAL holding strategy for standalone applications

4.2.4   Forwarding the security context with a DelegatingSecurityContextRunnable

4.2.5   Forwarding the security context with a DelegatingSecurityContextExecutorService

4.3   Understanding HTTP Basic and Form Login authentication methods

4.3.1   Using and configuring HTTP Basic

4.3.2   Implementing the authentication with the Form Login method

4.4   Hands-On - The smallest secured web application

4.4.1   Writing the setup and configuration of the project

4.4.2   Implementing user management

4.4.3   Implementing the custom authentication logic

4.4.4   Implementing the main page

4.4.5   Running and testing the application

4.5   Summary