Programmatic login in Spring Security 2

Question

I'm trying to find a way to skip the login form when a user clicks on an "activate account" link that he has received by email. This link contains a single-use random token that can serve as an authentication method.

By this token I can retrieve the user details and activate its account, but I am yet to find a way to sign-in programmatically.

I am looking for a way to implement something like this:

void forceLogin ( String username );

Is it possible?

My spring-security configuration is this:

<http>
<intercept-url pattern="/userAccount/logout.do" access="ROLE_USER"/>
... (More intercepts)

<form-login login-page="/userAccount/login.do"
  authentication-failure-url="/userAccount/login.do?failure=true"
  login-processing-url="/userAccount/j_spring_security_check.do"
  always-use-default-target="false"
  default-target-url="/userAccount/redirectAfterLogin.do"
  />

<anonymous />
<logout logout-url="/userAccount/logout.do" />
</http>

Answer 1

Sounds like you should write your own PreAuthenticationFilter.

I would subclass the AbstractPreAuthenticatedProcessingFilter similar to this:

public class TokenAuthFilter extends AbstractPreAuthenticatedProcessingFilter {

   protected Object getPreAuthenticatedPrincipal(HttpServletRequest request) {
      String token = request.getAttribute("customToken");
      //... look up user details based on this token
     String username = UserDao.getUserbyToken(token);
     return username;
   }

}

Then in your Spring Security configuration XML add a line like this:

<bean id="tokenAuth" class="...TokenAuthFilter" >
   <security:custom-filter position="PRE_AUTH_FILTER" />
</bean>

Not 100% complete but should get you started.