Authentication manager

As explained in Spring Security in Action, Second Edition

ReactiveAuthenticationManager is a Spring Security contract that performs authentication asynchronously in a reactive application.

In a reactive Spring Security application, ReactiveAuthenticationManager performs authentication asynchronously. AuthenticationWebFilter intercepts a request, delegates authentication to the manager, and receives the resulting Authentication object. section 17.2

A reactive authentication flow typically works as follows:

• AuthenticationWebFilter intercepts the HTTP request and delegates authentication to ReactiveAuthenticationManager. section 17.2
• ReactiveAuthenticationManager implements the authentication logic directly; reactive applications do not use authentication providers. section 17.2
• When credentials are involved, the manager uses ReactiveUserDetailsService to obtain user details and PasswordEncoder to verify the password. section 17.2
• After successful authentication, the filter stores the Authentication object in the SecurityContext. section 17.2

Reactive username-and-password application

Configure a ReactiveUserDetailsService with the user john, password 12345, and read authority, plus a PasswordEncoder. Calling /hello with curl -u john:12345 authenticates successfully and can produce “Hello john”. To create custom authentication behavior, implement ReactiveAuthenticationManager directly. section 17.2

Figure 17.5 An AuthenticationWebFilter intercepts the request and delegates the authentication responsibility to a ReactiveAuthenticationManager. If the authentication logic involves users and passwords, the ReactiveAuthenticationManager uses a ReactiveUserDetailsService to find the user details and a PasswordEncoder to verify the password.

Shows AuthenticationWebFilter delegating to ReactiveAuthenticationManager, which uses ReactiveUserDetailsService and PasswordEncoder for username-and-password authentication. section 17.2

How Spring Security in Action, Second Edition covers it

How deep it goes

Explains delegation, direct authentication logic, supporting services, and security-context storage, but does not detail the contract methods.

Examples

Uses a WebFlux endpoint with user john, password 12345, curl authentication, and a Hello john response.

What it assumes

Assumes basic Spring and Java knowledge while demonstrating ReactiveUserDetailsService and reactive Authentication access.

What you can do after

Build it from scratch by implementing ReactiveAuthenticationManager for custom reactive authentication logic.

How it connects

Connects AuthenticationWebFilter, ReactiveUserDetailsService, PasswordEncoder, Authentication, and SecurityContext.

liveBookmanning.com

Read Spring Security in Action, Second Edition on liveBook Get the book at manning.com

Related concepts

• AuthenticationProvideruses · AuthenticationProvider is a Spring Security interface or component that encapsulates a specific authentication mechanism and returns an authentication result.
• authentication filterused by · An authentication filter is a request-processing component that intercepts authentication requests and delegates them to an authentication mechanism.
• authentication manager resolverused by · An authentication manager resolver is a component that selects an authentication manager for a request or contextual authentication scenario.

This explainer was generated by Manning's knowledge graph from the text of Spring Security in Action, Second Edition. The section links point to the parts of the book it draws on.