Spring Security - Choosing Authentication Provider at runtime

[Martijn Verburg]

Hi all,

I've had no luck over on the Spring forums.

I'm using Spring Security 2.0.5.RELEASE and was wonder if it was possible to have two authentication providers set-up and then have a runtime flag determining which one to use.

e.g. Swapping between LDAP authentication and basic DB authentication.

So for example I'd like to have the following configured:

<!-- No remember me functionality, so auto-config is set to false -->
<http access-denied-page="/accessDenied.jsp" auto-config='false'>

    <!-- The DB authentication provider, using SHA1 passwords -->
    <authentication-provider user-service-ref="userDetailsService">
        <password-encoder ref="sha1PasswordEncoder" />
    </authentication-provider>

    <!-- The custom LDAP Authentication provider -->
    <beans:bean id="ldapAuthenticationProvider" class="org.ikasan.console.security.service.authentication.LdapAuthenticationProvider">
        <beans:constructor-arg ref="userDetailsService" />
        <beans:property name="authenticator" ref="ldapAuthenticator" />
        <custom-authentication-provider />
    </beans:bean>

    <!-- More LDAP related beans follow -->

And have the DB authentication provider as a default, but be able to swap to the LDAP provider at runtime.

Has anyone tried this before?

[Jaikiran Pai]

I don't have much idea about Spring, but:

I'm using Spring Security 2.0.5.RELEASE and was wonder if it was possible to have two authentication providers set-up and then have a runtime flag determining which one to use.

Maybe you could have your custom authentication provider, backed by a LDAP authentication provider and a DB authentication provide, which uses a flag to dynamically switch between the two.

By the way, I would have thought that authentication providers do not change at runtime. i.e. I haven't seen applications where at runtime it would switch to a different authentication backend. They are usually configured during deployment time.

[Martijn Verburg]

Hi Jaikiran,

The Use Case is for a Web Console Administrator to choose between two authentication providers. So for example I'd like to be able to:

1.) Start with the DB authentication provider (supported by web pages that will allow them to change passwords etc)
2.) Swap to an Active Directory provider (which means that the change password etc functionality would be greyed out)

Your flag idea might just work, I probably can't get it to work purely dynamically (what would happen to users already logged in for example?), but it wouldn't be unreasonable to restart the web app after the config change.

I'll go and have a play

[Mark Spritzler]

Actually, it should be much more simpler.

Just add each provider to the list in the ProviderManager. You should have an equivalent in the security namespace. I just copied this from the Spring Security documentation.

  
<bean id="authenticationManager" class="org.springframework.security.authentication.ProviderManager">
    <property name="providers"> 
        <list>
            <ref local="daoAuthenticationProvider"/> 
            <ref local="anonymousAuthenticationProvider"/> 
            <ref local="ldapAuthenticationProvider"/>
        </list> 
    </property>
</bean>
  

Mark

[Martijn Verburg]

That definitely looks interesting, time for another serious perusal of those docs (you can never re-read security docs enough!)

[Mark Spritzler]

Martijn Verburg wrote:That definitely looks interesting, time for another serious perusal of those docs (you can never re-read security docs enough!)

Exactly. I must have read the whole thing at least 4-5 times already, and each time pick up something else.

Mark