Using Tomcat NTLM with Spring Security

Question

Hi. I'm using Spring Security 2 with Spring MVC. The tomcat container I will be using already has NTLM support and will provide access to only authenticated users, before forwarding their username in the header of the request.

I tried writing a custom AutenticationEntryPoint with the idea that no form/ http-basic login would be required, since the request header would already contain the userIDs. But so far, I have found no means of achieving this.

Any ideas and suggestions would be highly appreciated.

Thanks.

Answer 1

Look at Waffle. Maybe Waffle itself is not what you want, but it has a spring security filter implementation that is on the receiving end of what you're trying to achieve.

Answer 2

I actually found that Spring security has native support for pre-authenticated security. In particular, I looked at org.springframework.security.ui.preauth.AbstractPreAuthenticatedProcessingFilter, which comes with a number of implemententations, of which RequestHeaderPreAuthenticatedProcessingFilter seemed the most useful. Alternatively, one could also write a custom filter by extending the AbstractPreAuthenticatedProcessingFilter. Once that is done, you will also need to define a custom entry point in your application context, along with other dependencies required by Spring Security. I apologize that I'm in a rush and don't have time to format it properly. Hope this helps.

<bean id="customEntryPoint" class="org.springframework.security.ui.preauth.PreAuthenticatedProcessingFilterEntryPoint" /> and this <bean id="preauthAuthProvider" class="org.springframework.security.providers.preauth.PreAuthenticatedAuthenticationProvider"> <security:custom-authentication-provider /> <property name="preAuthenticatedUserDetailsService"> <bean id="userDetailsServiceWrapper" class="org.springframework.security.userdetails.UserDetailsByNameServiceWrapper"> <property name="userDetailsService" ref="userDetailsService" /> </bean> </property> </bean>

and this <bean id="userDetailsService" class="yourimplementation.CustomUserDetailsService"> </bean>

and this <security:http auto-config="false" access-decision-manager-ref="accessDecisionManager" entry-point-ref="customEntryPoint"> <security:intercept-url pattern="/*" access="permitAll" /> </security:http> <security:authentication-manager alias="authenticationManager" />