Trying to figure out preauthentication

[John Eric Hamacher]

0 down vote favorite
share [g+] share [fb] share [tw]


I am wondering how the PreAuthenticatedAuthenticationToken gets its authorities. I have a UserDetails implementation, but :

@Override
public Collection<GrantedAuthority> getAuthorities() {

return grantedAuthorities;
}

never gets called. This is important because Spring Security (3.1) is basically ignoring the fact that I am trying to limit this URL to a certain role. Without a role in the token, it is letting everything through. Using the UserDetailsByNameServiceWrapper doesn't work for me. Spring complains. I really could use some help. Thanks Eric

public class XXXAuthenticationUserDetailsService implements AuthenticationUserDetailsService, UserDetailsService {

private XXXService xxxService = null;

@Override
public UserDetails loadUserDetails(PreAuthenticatedAuthenticationToken token) throws UsernameNotFoundException {
    String userID = asmService.getAuthorizedUserId((String) token.getPrincipal());
    AidsBankingUser user = new AidsBankingUser();
    Collection<Delegation> delegations = findRoles(userID);     
    user.setGrantedAuthroitiesAndAgency(delegations);
    user.setUsername(userID);
    return user;
}

private Collection<Delegation> findRoles(String userID) {

    Collection<Delegation> delegations;
    try {
        delegations = xxService.getDelegationsByAppUser(Constants.APP_NAME_IN_XXX, userID, Constants.DO_NOT_INCLUDE_GUI_ROLES_FROM_XXX);

        if (delegations == null || delegations.isEmpty()) {
            Log.getGeneralLogger().fatal("No delegations returned by XXX");
            throw new AccessDeniedException("User is authenticated but unauthorized.  Please contact DPI.");
        }
        return delegations;
    } 
    catch (DataAccessException e) {
        Log.getGeneralLogger().fatal("XXX encountered a problem while retrieving delegations", e);
        throw new AccessDeniedException("Internal problem.  Please contact DPI.", e);
    }

}

public void setXxxService(XXXService asmService) {
    this.asmService = asmService;
}

@Override
public UserDetails loadUserByUsername(String arg0)
        throws UsernameNotFoundException {
    // TODO Auto-generated method stub
    return null;
}

}

My UserDetails:

public class XXXUser implements UserDetails {

private static final long serialVersionUID = 6930680558235002724L;
private Collection<GrantedAuthority> grantedAuthorities = null;
private String userID = null;
private Agency agency = null;

@Override
public Collection<GrantedAuthority> getAuthorities() {

    return grantedAuthorities;
}

@Override
public String getPassword() {
    return "b";
}

@Override
public String getUsername() {
    return userID;
}

@Override
public boolean isAccountNonExpired() {
    return false;
}

@Override
public boolean isAccountNonLocked() {
    return false;
}

My context file:
<http security="none" pattern="/images/**" /> <http realm="Spring Security Application" use-expressions="true" entry-point-ref="preAuthenticatedProcessingFilterEntryPoint"> <intercept-url pattern="/context/index" access="permitAll"/> <intercept-url pattern="/context/entry/**" access="ROLE_ENTRY"/> <intercept-url pattern="/context/verify/**" access="hasRole('ROLE_VERIFY')"/> <intercept-url pattern="/context/admin/**" access="hasRole('ROLE_ADMIN')"/> <intercept-url pattern="/context/aaaaa/**" access="hasRole('ROLE_AAAAA')"/> <custom-filter position="PRE_AUTH_FILTER" ref="BBBPreAuthenticationFilter" /> <access-denied-handler ref="accessDeniedHandler"/> <logout success-handler-ref="xxxLogoutSuccessHandler"/> </http> <beans:bean id="accessDeniedHandler" class="yyy.zzz.XXXAccessDeniedHandler"/> <beans:bean id="xxxLogoutSuccessHandler" class="yyy.zzz.XXXLogoutSuccessHandler"/> <beans:bean id="preAuthenticatedProcessingFilterEntryPoint" class="org.springframework.security.web.authentication.Http403ForbiddenEntryPoint"/> <beans:bean id="BBBPreAuthenticationFilter" class="yyy.zzz.BBBPreAuthenticationFilter"> <beans:property name="authenticationManager" ref="authenticationManager" /> <beans:property name="continueFilterChainOnUnsuccessfulAuthentication" value="true" /> <beans:property name="checkForPrincipalChanges" value="true" /> </beans:bean> <beans:bean id="preauthAuthProvider" class="org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationProvider"> <beans:property name="preAuthenticatedUserDetailsService" ref="xxxAuthenticationUserDetailsService"/> </beans:bean> <authentication-manager alias="authenticationManager" > <authentication-provider ref="preauthAuthProvider" /> </authentication-manager> <beans:bean name="asmService" class="yyy.zzz.XXXServiceImpl"/> <beans:bean id="userDetailsServiceWrapper" class="org.springframework.security.core.userdetails.UserDetailsByNameServiceWrapper"> <beans:property name="userDetailsService" ref="xxxAuthenticationUserDetailsService"/> </beans:bean> <beans:bean id="xxxAuthenticationUserDetailsService" class=yyy.zzz.XXXAuthenticationUserDetailsService"> <beans:property name="xxxService" ref="xxxService"/> </beans:bean>

</beans:beans>

[John Eric Hamacher]

Here is my entire XXXUser class

   public class XXXUser implements UserDetails {  
      
    private static final long serialVersionUID = 6930680558235002724L;  
    private Collection<GrantedAuthority> grantedAuthorities = null;  
    private String userID = null;  
    private Agency agency = null;  
      
    @Override  
    public Collection<GrantedAuthority> getAuthorities() {  
      
        return grantedAuthorities;  
    }  
      
    @Override  
    public String getPassword() {  
        return "b";  
    }  
      
    @Override  
    public String getUsername() {  
        return userID;  
    }  
      
    @Override  
    public boolean isAccountNonExpired() {  
        return false;  
    }  
      
    @Override  
    public boolean isAccountNonLocked() {  
        return false;  
    }  

	@Override
	public boolean isCredentialsNonExpired() {
		return false;
	}

	@Override
	public boolean isEnabled() {
		return false;
	}
	
	public Agency getAgency() {
		return agency;
	}
	
	public void setAgency(Agency agency) {
		this.agency = agency;
	}
	
	public void setUserID(String userID) {
		this.userID = userID;
	}
	
	public void setUsername(String userID) {
		this.userID = userID;
	}

	public void setGrantedAuthroitiesAndAgency(Collection<Delegation> delegations) {

		grantedAuthorities = new ArrayList<GrantedAuthority>();
		for (Delegation d: delegations) {
			grantedAuthorities.add(new SimpleGrantedAuthority("ROLE_" + d.getRole().getId().toUpperCase()));
			agency = d.getAgency();
		}
		if (grantedAuthorities.isEmpty()) {
			grantedAuthorities.add(new SimpleGrantedAuthority(RoleEnum.ROLE_NOROLE.toString()));
		}
}

[John Eric Hamacher]

Figure it out! Four of the setting in my Useradetials were wrong