Implementing new CustomFilter In Spring Security

user_19741650 0
Viewed 53

As you all know, WebSecurityConfigurerAdapter class has become deprecated.

I'm trying to implement customFilter in my filterChain, but i faced an issue that's linked to new AuthenticationManager.

Here is the problem:

@Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http.cors().and().csrf().disable();
        http.sessionManagement().sessionCreationPolicy(STATELESS);
        http.authorizeRequests().anyRequest().permitAll();
        http.addFilter(new CustomAuthenticationFilter(authenticationManager()));
        return http.build();
    }

    @Bean
    public AuthenticationManager authenticationManager(AuthenticationConfiguration authenticationConfiguration) throws Exception {
        return authenticationConfiguration.getAuthenticationManager();
    }

As you can see Authentication Manager requires AuthenticationConfiguration class as a NotNull parameter, without it i can't create CustomAuthenticationFilter.

Did someone face this problem? Do I need to create a new @Bean for AuthenticationConfiguration?

Here is my CustomAuthenticationFilter Class:

@Slf4j
public class CustomAuthenticationFilter extends UsernamePasswordAuthenticationFilter {

    private final AuthenticationManager authenticationManager;

    public CustomAuthenticationFilter(AuthenticationManager authenticationManager) {
        this.authenticationManager = authenticationManager;
    }

    @Override
    public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException {
        String username  = request.getParameter("username");
        String password = request.getParameter("password");
        log.info("Userame is {}", username);
        log.info("passoword is {}", password);
        UsernamePasswordAuthenticationToken authenticationToken = new UsernamePasswordAuthenticationToken(username, password);
        return authenticationManager.authenticate(authenticationToken);
    }

    @Override
    protected void successfulAuthentication(HttpServletRequest request, HttpServletResponse response, FilterChain chain, Authentication authResult) throws IOException, ServletException {
        super.successfulAuthentication(request, response, chain, authResult);
    }
}
spring-security spring java
1 Answers

As AuthenticationConfiguration is registered as a bean by spring-boot automatically, you can inject it as a config class field instead of as an argument of the bean definition method, like this:

@RequiredArgsConstructor
@Configuration
public class AppSecurityConfig {

    private final AuthenticationConfiguration authenticationConfiguration;

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http.cors().and().csrf().disable();
        http.sessionManagement().sessionCreationPolicy(STATELESS);
        http.authorizeRequests().anyRequest().permitAll();
        http.addFilter(new CustomAuthenticationFilter(authenticationManager()));
        return http.build();
    }

    @Bean
    public AuthenticationManager authenticationManager() throws Exception {
        return this.authenticationConfiguration.getAuthenticationManager();
    }
}
user_194516330
Related