Spring security: pass additional parameter when performing login

[Pavel Kazlou]

Hi.
In my application the first page the user gets is the login form. I handle the login action using spring 2 security. After the successful login user is directed to struts 2 action.
In this struts 2 action I have property which I would like to populate with user input (additional field inside login form).
To be able to populate this property of struts 2 action I need to set request parameter. The problem is that the request is controlled by spring security. I've tried adding input field to login form, but spring doesn't forward its value to struts action.

How can I solve this problem?

[Pavel Kazlou]

The struts 2 action is bound to successful login using spring security configuration:

<http auto-config='true'>
...
<form-login login-page="/login.action" authentication-failure-url="/login_failed.action" login-processing-url="/perform_login" default-target-url='/initialize.action' always-use-default-target='true' />
...
</http>

[Pavel Kazlou]

All right, let's omit struts 2. How can I pass parameter to the request which is made after a successful authentication?
That's almost the same as modifying my configuration:

default-target-url='/initialize.action?myParam=myValue'

but myValue is a dynamic value, I can't hardcode it.

[Pavel Kazlou]

You can try the following solution:
1. insert custom filter into spring security filter chain
2. inside this filter obtain http session and store there the value of request parameter

As we change the login form (adding another parameter) we need to customize spring representation of login form and spring login processing filter.
Here is the configuration:

	<authentication-manager alias="authenticationManager"/>

	<beans:bean id="myFilter" class="test.MyAuthenticationProcessingFilter">
		<custom-filter position="AUTHENTICATION_PROCESSING_FILTER" />
	 	<beans:property name="defaultTargetUrl" value="/initialize.action"/>
		<beans:property name="authenticationFailureUrl" value="/login_failed.action"/>
		<beans:property name="authenticationManager" ref="authenticationManager"/>
		<beans:property name="alwaysUseDefaultTargetUrl" value="true"/>
		<beans:property name="filterProcessesUrl" value="/perform_login"/>
	</beans:bean>
	
	<beans:bean id="entryPoint" class="org.springframework.security.ui.webapp.AuthenticationProcessingFilterEntryPoint">
		<beans:property name="loginFormUrl" value="/login.action"/>
	</beans:bean>

MyAuthenticationProcessingFilter extends spring's org.springframework.security.ui.webapp.AuthenticationProcessingFilter, wraps attemptAuthentication method obtaining request parameter and storing it inside http session. This class is written just to show the idea, for better practice browse AuthenticationProcessingFilter code for username and password parameters.

public class MyAuthenticationProcessingFilter extends AuthenticationProcessingFilter {

	@Override
	public Authentication attemptAuthentication(HttpServletRequest request)
			throws AuthenticationException {
		String param = request.getParameter("myParam");
	
		HttpSession session = request.getSession();
		if (session != null || getAllowSessionCreation()) {
			session.setAttribute("myParamInsideSession", param);
		}
		
		return super.attemptAuthentication(request);
	}

}

You may notice that "myFilter" and "entryPoint" beans together define parameters that are otherwise defined by <form-login> element inside <http>. You use <form-login> when you want the default behavior. But in our case we use custom beans, so you should remove <form-login> element completely.
Now we need to tell <http> use our beans. "myFilter" bean is passed to spring chain by using <custom-filter> element inside bean definition:

<beans:bean id="myFilter" class="test.MyAuthenticationProcessingFilter">
	<custom-filter position="AUTHENTICATION_PROCESSING_FILTER" />
 	...
</beans:bean>

"entryPoint" is passed to <http> using attribute:

<http entry-point-ref="entryPoint">
    ...
    <!-- no form-login here -->
</http>

[Pavel Kazlou]

Pavel, thank you very much for the help, I appreciate it.

[Hongli Li]

Pavel Kazlou wrote:Pavel, thank you very much for the help, I appreciate it.

WTH, you thank yourself for helping out yourself?

[Mark Spritzler]

Hongli Li wrote:

Pavel Kazlou wrote:Pavel, thank you very much for the help, I appreciate it.

WTH, you thank yourself for helping out yourself?

Exactly, after 9 days he resolved his issue and was nice enough to post it here, so that if anyone else has the same situation, they can find a great answer.

Mark

[Sin Vince]

Hi Pavel, thanks for your nice work
I do appreciate

[Hernan Amaya]

Thank you very much for your contribution, I needed to add recaptcha to my spring, struts2, webapp, login form, and this post saved me time and effort. Greetings.