Creating a custom authentication with Acegi/Spring Security

Question

I'm having trouble discovering exactly what I need to implement in order to use a custom authentication method with my web application using Spring Security. I have a Grails application with the Spring Security plugin that currently uses the standard user/password authentication with a browser form. This is working correctly.

I need to implement a mechanism alongside of this that implements a type of MAC authentication. If the HTTP request contains several parameters (e.g. a user identifier, timestamp, signature, etc.) I need to take those parameters, perform some hashing and signature/timestamp comparisons, and then authenticate the user.

I'm not 100% sure where to start with this. What Spring Security classes do I need to extend/implement? I have read the Reference Documentation and have an okay understanding of the concepts, but am not really sure if I need a Filter or Provider or Manager, or where/how exactly to create Authentication objects. I've messed around trying to extend AbstractProcessingFilter and/or implement AuthenticationProvider, but I just get caught up understanding how I make them all play nicely.

Answer 1

1. Implement a custom AuthenticationProvider which gets all your authentication information from the Authentication: getCredentials(), getDetails(), and getPrincipal().

   Tie it into your Spring Security authentication mechanism using the following configuration snippet:

   <bean id="myAuthenticationProvider" class="com.example.MyAuthenticationProvider">
     <security:custom-authentication-provider />
   </bean>
   

2. This step is optional, if you can find a suitable one from standard implementations. If not, implement a class extending the Authentication interface on which you can put your authentication parameters:

   (e.g. a user identifier, timestamp, signature, etc.)
   

3. Extend a custom SpringSecurityFilter which ties the above two classes together. For example, the Filter might get the AuthenticationManager and call authenticate() using your implementation of Authentication as input.

   You can extend AbstractProcessingFilter which extends SpringSecurityFilter as a start.

   You can reference AuthenticationProcessingFilter which extends AbstractProcessingFilter. AuthenticationProcessingFilter implements the standard Username/Password Authentication.

4. Configure your Spring Security to add or replace the standard AUTHENTICATION_PROCESSING_FILTER. For Spring Security Filter orders, see http://static.springframework.org/spring-security/site/reference/html/ns-config.html#filter-stack

   Here is a configuration snippet for how to replace it with your implementation:

   <beans:bean id="myFilter" class="com.example.MyAuthenticationFilter">
     <custom-filter position="AUTHENTICATION_PROCESSING_FILTER"/>
   </beans:bean>