How to log error for password mismatch in JWT authentication?

Viewed 12

My AuthSecurityConfiguration class has SecurityFilterChain method ->

public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {

    http
            .authorizeHttpRequests((authorize) -> .. my auth path
            .csrf((csrf) -> csrf.ignoringAntMatchers(path))
            .httpBasic(Customizer.withDefaults())
            .oauth2ResourceServer(OAuth2ResourceServerConfigurer::jwt)
            .sessionManagement((session) -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
            .exceptionHandling((exceptions) -> 
            exceptions
                                       .authenticationEntryPoint(jwtAuthenticationSecurityError)
                                       .accessDeniedHandler(jwtAuthenticationSecurityError)
                              );
    return http.build();
}

I have a separate class which implements AuthenticationEntryPoint , AccessDeniedHandler interfaces and I have logged error there.

@Override
public void commence(HttpServletRequest request, HttpServletResponse response,
        AuthenticationException authException) throws IOException, ServletException {
    
    log.error("Unauthorized Request commence.");
    resolver.resolveException(request, response, null, authException);
    
}

@Override
public void handle(HttpServletRequest request, HttpServletResponse response,
        AccessDeniedException accessDeniedException) throws IOException, ServletException {

    log.error("Unauthorized Request handle.");
    response.sendError(401, "Unauthorized cred");
    
}

Below is my InMemoryUserDetailsManager

@Bean
public InMemoryUserDetailsManager tempDetailsManager() {

    PasswordEncoder encoder = PasswordEncoderFactories.createDelegatingPasswordEncoder();

    List<com.asite.iotpoc.configuration.AuthUser.User> userList = authUser.getUsers();

    List<UserDetails> userDetails = userList.stream().map(user ->
                                                                  User
                                                                          .withUsername(user.getName())
                                                                          .password(user.getPassword())
                                                                          .passwordEncoder(encoder::encode)
                                                                          .authorities(user.getAuthority())
                                                                          .build()
                                                         ).collect(Collectors.toList());

    return new InMemoryUserDetailsManager(userDetails);
}

I want to log error in case of password mismatch during authorization. I want to know how username and passwords are compared and how can I log error if username/password mismatch is there. Also I have tried implementing AuthenticationFailureHandler but that also didn't work, So if this is the right was how do I implement this?

0 Answers
Related