10

In a Spring Security 3.2 based application I have a explicit configured UsernamePasswordAuthenticationFilter, that need an reference to the sessionAuthenticationStrategy (in order to invoke .onAuthentication).*

The sessionAuthenticationStrategy is the default one created by <security:http> (HttpSecurityBeanDefinitionParser).

My question: Is how can I get an reference to the SessionAuthenticationStrategy without configuring the complete SessionAuthenticationStrategy explicite, so that I can inject this reference in XML configuration?

<security:http auto-config="false" use-expressions="true"
    entry-point-ref="loginUrlAuthenticationEntryPoint" 
    access-decision-manager-ref="httpAccessDecisionManager">
    ...
    <security:custom-filter
             ref="usernamePasswordAuthenticationFilter"
             position="FORM_LOGIN_FILTER"/>
    ...
</security:http>

...

<bean id="usernamePasswordAuthenticationFilter"
    class=" o.s.scurity.web.authentication.UsernamePasswordAuthenticationFilter">

   <property name="sessionAuthenticationStrategy" ref="????">   <!-- ?? ->
   ...
</bean>

*my real UsernamePasswordAuthenticationFilter is a customized subclass, but that should not matter for this question

1

4 Answers 4

6

I have had a look at the HttpSecurityBeanDefinitionParser (and the HttpConfigurationBuilder.createSessionManagementFilters()) that is the class responsible to parse the security:http tag and for creating of SessionAuthenticationStrategy bean.

Therefore I know that Spring Security 3.2.5.RELEASE create (in my configuration) a CompositeSessionAuthenticationStrategy bean and uses this as session strategy. This bean will get the default name: org.springframework.security.web.authentication.session.CompositeSessionAuthenticationStrategy#0

So my current workaround is to have a reference to this bean, by its name:

<bean id="usernamePasswordAuthenticationFilter"
     class=" o.s.scurity.web.authentication.UsernamePasswordAuthenticationFilter">

    <property name="sessionAuthenticationStrategy">
        <ref
           bean="org.springframework.security.web.authentication.session.CompositeSessionAuthenticationStrategy#0"/>                
    </property>
    ...
 </bean>

This workaround has some serious limitations:

  • when a newer version of spring security works in an other way (creating an other bean) then it will fail.
  • when there is an other CompositeSessionAuthenticationStrategy thats name is created with ReaderContext.generateBeanName then this approach may fail, because of #0 maybe become #1 (depends on the order in which the beans are created)
4
+100

I'm afraid there is no obvious way to get it.

But all the examples in Spring-Security reference manual are coherent on that : you should not even want to get it : all show an explicit SessionAuthenticationStrategy injected in the UserNamePasswordAuthenticationFilter and if appropriate in the SessionManagementFilter.

According to the javadocs of these 2 classes, the default SessionAuthenticationStrategy are :

  • SessionFixationProtectionStrategy for Servlet < 3.1
  • ChangeSessionIdAuthenticationStrategy for Servlet 3.1+

So the correct way is to create a bean implementing SessionAuthenticationStrategy either one of the above defaults, or another implementation if you have special needs and use it wherever you need to.

Of course, it is always possible to use reflection to access private members of Spring security implementation classes, but you know it is bad and comes with high risk of getting broken on next release of Spring security.

1
  • How to select SessionAuthenticationStrategy impelementation based on servlet version used in servlet container?
    – Alex78191
    May 18, 2018 at 3:40
3

When working with JavaConfig (I'm afraid is not your case) you can get a reference by doing

        http.getConfigurer(SessionManagementConfigurer.class).init(http);
        http.getSharedObject(SessionAuthenticationStrategy.class);
3

Expanding on Ralph's answer, you can use a FactoryBean to get a reference to the AuthenticationStrategy.

public class SessionAuthenticationStrategyFactoryBean implements BeanFactoryAware, FactoryBean<SessionAuthenticationStrategy> {

    private BeanFactory beanFactory;

    @Override
    public void setBeanFactory(BeanFactory beanFactory) throws BeansException {
        this.beanFactory = beanFactory;
    }

    @Override
    public SessionAuthenticationStrategy getObject() throws Exception {
        final CompositeSessionAuthenticationStrategy sas = beanFactory.getBean(CompositeSessionAuthenticationStrategy.class);
        return sas;
    }

    @Override
    public Class<?> getObjectType() {
        return SessionAuthenticationStrategy.class;
    }

    @Override
    public boolean isSingleton() {
        return true;
    }
}

... and make it available on you XML configuration:

<bean id="sas" class="com.example.SessionAuthenticationStrategyFactoryBean" />

<bean id="usernamePasswordAuthenticationFilter"
    class=" o.s.scurity.web.authentication.UsernamePasswordAuthenticationFilter">

   <property name="sessionAuthenticationStrategy" ref="sas">
   ...
</bean>

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.