Spring Security 3: Is it possible to see which AuthenticationProvider has authenticated a session?

views:

answers:

+1 Q:

Spring Security 3: Is it possible to see which AuthenticationProvider has authenticated a session?

I have an AuthenticationManager with multiple AuthenticationProviders. That works very well, the first AP that can auth² the Authentication authenticates the user and if none can, the user is refused.

Now I have an a bit more special case, and I need to find out which AuthenticationProvider authenticated a user that was authenticated successfully. I cannot seem to find a way in which this can be done in a stable and reliable fashion.

I can imagine some creative hacks (e.g. interleaving instances of an own AuthenticationProvider that always fails to authenticate, but which can help infer which was the last AuthenticationProvider that was seen), but that's really not the point. Is there an official way to do this?

+1 A:

I haven't tried it but you might be able to hook into the events that are fired on successful authentications and get the information you are looking for

AuthenticationSuccessEvent: Application event which indicates successful authentication. InteractiveAuthenticationSuccessEvent:Indicates an interactive authentication was successful.

http://static.springsource.org/spring-security/site/docs/3.0.x/apidocs/org/springframework/security/authentication/event/package-summary.html

InteractiveAuthenticationSuccessEvent, has a property which tells you the class which fired the event

Aaron Saunders 2010-09-09 06:16:35

This will get me there most of the way. I may have multiple auth providers of the same class (e.g. Jdbc… against a number of different DSs) though. Since this should just be configurable I guess I can't just subclass those without actually overriding anything, so I'll have to work around that or use cglib and subclass dynamically. This is a really good start though, thanks!

Bernd Haug 2010-09-13 08:31:48

Why not just store that information along with the UserDetails stuff in the current session?

Gandalf 2010-09-09 17:55:03

Well, the AuthProvider that authenticated the user would have to write it in the session at that point, and I didn't write those.

Bernd Haug 2010-09-13 08:27:14

Shouldn't be hard to extend them (yay OO programming!) and add that simple functionality.

Gandalf 2010-09-13 19:32:33

ansaurus

tags:

views:

answers:

Spring Security 3: Is it possible to see which AuthenticationProvider has authenticated a session?

related questions