Authenticate users with SpringSecurity using a WebService that requires a username and password

Question

Currently I am writing a web application using Spring Security. We have a web service which authenticates users by username and password.

Web service:
String[] login(String username, String password);

How do I configure Spring Security to pass the provided username and password to the web service?

I have written a UserDetailsService which only receives a username.

Answer 1

The idea with UserDetailsService is that your implementation provides a UserDetails object representing the user with that username, and Spring Security handles checking the credentials.

If that kind of design doesn't work well with your backend, because you require the password as a parameter, then you might need to look at implementing your own AuthenticationProvider.

Answer 2

Extend org.acegisecurity.providers.dao.AbstractUserDetailsAuthenticationProvider

/**
 * @author rodrigoap
 * 
 */
public class WebServiceUserDetailsAuthenticationProvider extends
 AbstractUserDetailsAuthenticationProvider {

  @Override
  protected UserDetails retrieveUser(String username,
  UsernamePasswordAuthenticationToken authentication)
  throws AuthenticationException {
     //Improve this line:
 String password = authentication.getCredentials().toString();
 // Invoke your webservice here
 GrantedAuthority[] grantedAuth = loginWebService.login(username, password);
 // create UserDetails. Warning: User is deprecated!
 UserDetails userDetails = new User(username, password, grantedAuth);
 return userDetails;
  }

}

Answer 3

I have implemented almost identical solution but the retrieveUser() method is not firing. Do you have any suggestions?

Answer 4

I think the problem is with your xml. Did you turned off the auto-config? And does your class extend AbstractUserDetailsAuthenticationProvider?