Re: Custom Authenticator notfiring...?!?? !@?

"Griffith, Michael *" <[email protected]> Tue, 24 Mar 2009 14:26:06 -0400
Newsgroups	gmane.comp.java.springframework.user
Message-ID	<[email protected]>
Ok, I found the problem and I'm posting for anyone who may have this
problem now or in the future... (which may include me..)

The httpSessionContextIntegrationFilter didn't find the SecurityContext,
with containing a valid Authentication object. Once I modified the
filter to slip the SecurityContext into the HttpSession, it started
working...

public void doFilter(ServletRequest request, ServletResponse response,
		FilterChain chain) throws IOException, ServletException
{
	
	Authentication authResult =
attemptAuthentication((HttpServletRequest) request);
    	SecurityContext context= SecurityContextHolder.getContext();
    	context.setAuthentication(authResult);
    	HttpServletRequest servletRequest= (HttpServletRequest) request;
 
servletRequest.getSession().setAttribute(HttpSessionContextIntegrationFi
lter.ACEGI_SECURITY_CONTEXT_KEY, context);
    	logger.debug("Setting Security Context to: " + authResult);
   	chain.doFilter(request, response);
}

Thank you Rodrigo for your reply.

Cheers!
MG 

-----Original Message-----
From: Griffith, Michael * [mailto:[email protected]] 
Sent: Tuesday, March 24, 2009 12:21 PM
To: List for Spring users
Subject: Re: [Springframework-user] Custom Authenticator
notfiring...?!?? !@?

Can anyone help me? I think I am close, but cannot get past the
anonymous user filter...

I had the log level set too low to see my debugging statements, so I
fixed that and can see that my components are being called. 

I also created a Filter to add to the chain to fire my custom provider.
It looks like the filter is firing correctly, and I am trying to store
the AuthenticationToken in the SecurityContext, but it seems as if I am
not saving it correctly? 

The way I interpret the log, the anonymous filter doesn't respect the
token I put in the security context and creates an anonymous user which
is used instead of my object.

My Filter looks like this:
public class MockAuthenticationFilter extends AbstractProcessingFilter {
	
	@Override
	public void doFilter(ServletRequest request, ServletResponse
response,
			FilterChain chain) throws IOException,
ServletException {
		
	  Authentication authResult =
attemptAuthentication((HttpServletRequest) request);
 
SecurityContextHolder.getContext().setAuthentication(authResult);
        logger.debug("Setting Security Context to: " + authResult);
       	chain.doFilter(request, response);

	}

	private static final Log logger =
LogFactory.getLog(MockAuthenticationFilter.class);
	@Override
	public Authentication attemptAuthentication(HttpServletRequest
requests)
			throws AuthenticationException {

		logger.debug("**** in
MockAuthenticationFilter.attemptAuthentication");
		AuthenticationManager authenticationManager=
getAuthenticationManager();
		if(authenticationManager == null){
			throw new
AuthenticationServiceException("Authentication Manager is not
specified.");
		}
		Authentication auth= new MockAuthenticationToken();
		Authentication authentication=
authenticationManager.authenticate(auth);
		logger.debug("Returning Authentication: " +
authentication);
		
		return authentication;
	}
	

	@Override
	public String getDefaultFilterProcessesUrl() {
		// TODO Auto-generated method stub
		return "/j_acegi_mock_security_check";
	}

}

Here is the log:

[Repository] DEBUG - FilterChainProxy$VirtualFilterChain.doFilter(270) |
/css/default.css at position 1 of 6 in additional filter chain; firing
Filter:
'gov.hhs.fda.ocio.fastar.repository.web.filter.MockAuthenticationFilter@
1fb432e'
[Repository] DEBUG - MockAuthenticationFilter.attemptAuthentication(41)
| **** in MockAuthenticationFilter.attemptAuthentication
[Repository] DEBUG - MockAuthenticatorProvider.supports(31) | ***** in
MockAuthenticationProvider/supports, authentication: class
gov.hhs.fda.ocio.fastar.repository.web.util.MockAuthenticationToken
[Repository] DEBUG - ProviderManager.doAuthentication(195) |
Authentication attempt using $Proxy398 [Repository] DEBUG -
MockAuthenticatorProvider.authenticate(46) |
******* in MockAuthenticatorProvider/authenticate
[Repository] DEBUG - MockAuthenticatorProvider.authenticate(47) |
returning:
gov.hhs.fda.ocio.fastar.repository.web.util.MockAuthenticationToken@199c
277[]
[Repository] DEBUG - MockAuthenticationFilter.attemptAuthentication(48)
| Returning Authentication:
gov.hhs.fda.ocio.fastar.repository.web.util.MockAuthenticationToken@199c
277[]
[Repository] DEBUG - MockAuthenticationFilter.doFilter(31) | Setting
Security Context to:
gov.hhs.fda.ocio.fastar.repository.web.util.MockAuthenticationToken@199c
277[]
[Repository] DEBUG - FilterChainProxy$VirtualFilterChain.doFilter(270) |
/css/default.css at position 2 of 6 in additional filter chain; firing
Filter:
'org.acegisecurity.context.HttpSessionContextIntegrationFilter@1f7d5cb'
[Repository] DEBUG - HttpSessionContextIntegrationFilter.doFilter(227) |
Obtained a valid SecurityContext from ACEGI_SECURITY_CONTEXT to
associate with SecurityContextHolder:
'org.acegisecurity.context.SecurityContextImpl@6faa3d44: Authentication:
org.acegisecurity.providers.anonymous.AnonymousAuthenticationToken@6faa3
d44: Username: anonymousUser; Password: [PROTECTED]; Authenticated:
true; Details: org.acegisecurity.ui.WebAuthenticationDetails@ffff4c9c:
RemoteIpAddress: 10.148.1.109; SessionId: null; Granted Authorities:
ROLE_ANONYMOUS'
[Repository] DEBUG - FilterChainProxy$VirtualFilterChain.doFilter(270) |
/css/default.css at position 3 of 6 in additional filter chain; firing
Filter:
'org.acegisecurity.wrapper.SecurityContextHolderAwareRequestFilter@1f532
9f'
[Repository] DEBUG - SavedRequestAwareWrapper.<init>(107) | Wrapper not
replaced; SavedRequest was: null [Repository] DEBUG -
FilterChainProxy$VirtualFilterChain.doFilter(270) | /css/default.css at
position 4 of 6 in additional filter chain; firing
Filter:
'org.acegisecurity.providers.anonymous.AnonymousProcessingFilter@ce8273'
[Repository] DEBUG - AnonymousProcessingFilter.doFilter(118) |
SecurityContextHolder not populated with anonymous token, as it already
contained:
'org.acegisecurity.providers.anonymous.AnonymousAuthenticationToken@6faa
3d44: Username: anonymousUser; Password: [PROTECTED];
Authenticated: true; Details:
org.acegisecurity.ui.WebAuthenticationDetails@ffff4c9c: RemoteIpAddress:
10.148.1.109; SessionId: null; Granted Authorities: ROLE_ANONYMOUS'
[Repository] DEBUG - FilterChainProxy$VirtualFilterChain.doFilter(270) |
/css/default.css at position 5 of 6 in additional filter chain; firing
Filter: 'org.acegisecurity.ui.ExceptionTranslationFilter@1d654a3'
[Repository] DEBUG - FilterChainProxy$VirtualFilterChain.doFilter(270) |
/css/default.css at position 6 of 6 in additional filter chain; firing
Filter:
'org.acegisecurity.intercept.web.FilterSecurityInterceptor@4ecd90'

Any reply would be appreciated!

MG

-----Original Message-----
From: Griffith, Michael * [mailto:[email protected]]
Sent: Monday, March 23, 2009 4:55 PM
To: List for Spring users
Subject: Re: [Springframework-user] Custom Authenticator
notfiring...?!?? !@?

Rodrigo, 

Thanks for the reply!

This is really confusing. I get what you are telling me, but I thought
that the Filters fired in the order defined in the chain. In this case,
anonymousProcessingFilter is configured as the 5th filter, and my
MockAuthenticationFilter should be the 3rd filter. Is the problem the
httpSessionContextIntegrationFilter?  What should I do to get my filter
to fire beforehand?

Cheers!

MG
-----Original Message-----
From: CV - Peinado Rodrigo [mailto:[email protected]]
Sent: Monday, March 23, 2009 4:36 PM
To: List for Spring users
Subject: Re: [Springframework-user] Custom Authenticator
notfiring...?!?? !@?

Hi Michael, the method attemptAuthentication from
MockAuthenticationFilter is not invoked because there is already a
security context in the session.
As you can read in the logs, a previous filter (the first) detected
that:

[Repository] DEBUG - FilterChainProxy$VirtualFilterChain.doFilter(270) |
/js/script.aculo.us/dragdrop.js at position 1 of 7 in additional filter
chain; firing Filter:
'org.acegisecurity.context.HttpSessionContextIntegrationFilter@b3869c'
[Repository] DEBUG - HttpSessionContextIntegrationFilter.doFilter(227) |
Obtained a valid SecurityContext from ACEGI_SECURITY_CONTEXT to
associate with SecurityContextHolder:
'org.acegisecurity.context.SecurityContextImpl@6faaf9b0: Authentication:
org.acegisecurity.provid
ers.anonymous.AnonymousAuthenticationToken@6faaf9b0: Username:
anonymousUser; Password: [PROTECTED]; Authenticated: true; Details:
org.acegisecurity.ui.WebAuthenticationDetails@ffff8868: RemoteIpAddress:
10.148.0.185; SessionId: null; Granted Authorities: ROLE_ANONYMOUS'


Rodrigo.



-----Mensaje original-----
De: Griffith, Michael * [mailto:[email protected]]
Enviado el: Lunes, 23 de Marzo de 2009 06:17 p.m.
Para: List for Spring users
Asunto: [Springframework-user] Custom Authenticator not firing...?!??!@?

Hi everyone, 

I'm trying to stub out a custom authenticator, which I will later get to
authenticate against Quest's Web SSO. I am using Acegi 1.0.7 and Spring
2.5.x  It doesn't seem that the custom filter is doing its job and the
authentication mechanism always returns anonymous user because of the
anonymousProcessingFilter.
 
I have my filterProxy Chain defined as such:

<bean id="filterChainProxy"
class="org.acegisecurity.util.FilterChainProxy">
  <property name="filterInvocationDefinitionSource">
    <value>
      CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON
      PATTERN_TYPE_APACHE_ANT
 
/**=httpSessionContextIntegrationFilter,logoutFilter,mockAuthenticationF
ilter,securityContextHolderAwareRequestFilter,anonymousProcessingFilter,
exceptionTranslationFilter,filterInvocationInterceptor
    </value>
  </property>
</bean>

The rest of the authentication wiring looks like:

<bean id="authenticationManager"
class="org.acegisecurity.providers.ProviderManager">
  <property name="providers">
    <list>
      <ref bean="mockAuthenticatorProvider"/>
    </list>
  </property>
</bean>

<bean id="mockAuthenticatorProvider"
class="...web.util.MockAuthenticatorProvider"/>

<bean id="mockAuthenticationFilter"
class="...web.filter.MockAuthenticationFilter">
	<property name="authenticationManager"><ref
local="authenticationManager"/></property>
	<property
name="authenticationFailureUrl"><value>/public/login.action?login_error=
1</value></property>
	<property name="defaultTargetUrl"><value>/</value></property>
	<property
name="filterProcessesUrl"><value>/j_acegi_mock_security_check</value></p
roperty>
</bean>

My filter looks as such:
public class MockAuthenticationFilter extends AbstractProcessingFilter {

	private static final Log logger =
LogFactory.getLog(MockAuthenticationFilter.class);
	@Override
	public Authentication attemptAuthentication(HttpServletRequest
requests)
			throws AuthenticationException {

		logger.debug("**** in
MockAuthenticationFilter.attemptAuthentication");
		Authentication authentication=
getAuthenticationManager().authenticate(null);
		logger.debug("Returning Authentication: " +
authentication);
		return authentication;
	}

	@Override
	public String getDefaultFilterProcessesUrl() {
		// TODO Auto-generated method stub
		return "/j_acegi_mock_security_check";
	}
}

What am I missing about this configuration? 

The whole chain is supposed to return a MockAuthentication object with
my hard coded info for principle and granted authorities, but I never
see any of the debugging statements in the log. From the log info below,
it looks as if the filter is being referenced in the chain, but none of
the authentication mechanisms seems to be firing:

[Repository] DEBUG - FilterChainProxy$VirtualFilterChain.doFilter(270) |
/js/script.aculo.us/dragdrop.js at position 1 of 7 in additional filter
chain; firing Filter:
'org.acegisecurity.context.HttpSessionContextIntegrationFilter@b3869c'
[Repository] DEBUG - HttpSessionContextIntegrationFilter.doFilter(227) |
Obtained a valid SecurityContext from ACEGI_SECURITY_CONTEXT to
associate with SecurityContextHolder:
'org.acegisecurity.context.SecurityContextImpl@6faaf9b0: Authentication:
org.acegisecurity.provid
ers.anonymous.AnonymousAuthenticationToken@6faaf9b0: Username:
anonymousUser; Password: [PROTECTED]; Authenticated: true; Details:
org.acegisecurity.ui.WebAuthenticationDetails@ffff8868: RemoteIpAddress:
10.148.0.185; SessionId: null; Granted Authorities: ROLE_ANONYMOUS'
[Repository] DEBUG - FilterChainProxy$VirtualFilterChain.doFilter(270) |
/js/script.aculo.us/dragdrop.js at position 2 of 7 in additional filter
chain; firing Filter: 'org.acegisecurity.ui.logout.LogoutFilter@192b987'
[Repository] DEBUG - FilterChainProxy$VirtualFilterChain.doFilter(270) |
/js/script.aculo.us/dragdrop.js at position 3 of 7 in additional filter
chain; firing Filter:
'gov.hhs.fda.ocio.fastar.repository.web.filter.MockAuthenticationFilter@
1d2625d'
[Repository] DEBUG - FilterChainProxy$VirtualFilterChain.doFilter(270) |
/js/script.aculo.us/dragdrop.js at position 4 of 7 in additional filter
chain; firing Filter:
'org.acegisecurity.wrapper.SecurityContextHolderAwareRequestFilter@137d0
cf'
[Repository] DEBUG - SavedRequestAwareWrapper.<init>(107) | Wrapper not
replaced; SavedRequest was: null [Repository] DEBUG -
FilterChainProxy$VirtualFilterChain.doFilter(270) |
/js/script.aculo.us/dragdrop.js at position 5 of 7 in additional filter
chain; firing Filter:
'org.acegisecurity.providers.anonymous.AnonymousProcessingFilter@16dcbc9
'
[Repository] DEBUG - AnonymousProcessingFilter.doFilter(118) |
SecurityContextHolder not populated with anonymous token, as it already
contained:
'org.acegisecurity.providers.anonymous.AnonymousAuthenticationToken@6faa
f9b0: Username: anonymousUser; Password: [PROTECTED];
Authenticated: true; Details:
org.acegisecurity.ui.WebAuthenticationDetails@ffff8868: RemoteIpAddress:
10.148.0.185; SessionId: null; Granted Authorities: ROLE_ANONYMOUS'
[Repository] DEBUG - FilterChainProxy$VirtualFilterChain.doFilter(270) |
/js/script.aculo.us/dragdrop.js at position 6 of 7 in additional filter
chain; firing Filter:
'org.acegisecurity.ui.ExceptionTranslationFilter@15e3974'
[STDOUT] [Repository] DEBUG -
FilterChainProxy$VirtualFilterChain.doFilter(270) |
/js/script.aculo.us/dragdrop.js at position 7 of 7 in additional filter
chain; firing Filter:
'org.acegisecurity.intercept.web.FilterSecurityInterceptor@10e0904'

Any reply would be appreciated.

Best Regards,

MG

------------------------------------------------------------------------
----
--
Apps built with the Adobe(R) Flex(R) framework and Flex Builder(TM) are
powering Web 2.0 with engaging, cross-platform capabilities. Quickly and
easily build your RIAs with Flex Builder, the Eclipse(TM)based
development software that enables intelligent coding and step-through
debugging.
Download the free 60 day trial. http://p.sf.net/sfu/www-adobe-com
_______________________________________________
Springframework-user mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/springframework-user
*** ADVERTENCIA *** - El contenido del presente mensaje y los archivos
adjuntos que pudiera contener son privados, estrictamente confidenciales
y exclusivos para su destinatario, pudiendo contener informacion
protegida por normas legales y de secreto profesional. Bajo ninguna
circunstancia su contenido puede ser transmitido o revelado a terceros
ni divulgado en forma alguna. En consecuencia de haberlo recibido por
error, rogamos contactar al remitente y eliminarlo de su sistema. No nos
responsabilizamos por la integridad y la seguridad de este mensaje, ya
que el mismo podria estar sujeto a manipulaciones ilegales de
informacion. *** WARNING *** - The information transmitted is intended
only for the person or entity to which it is addressed and may contain
confidential and/or privileged material.
Any review, retransmission, dissemination or other use of, or taking of
any action in reliance upon, this information by persons or entities
other than the intended recipient is prohibited. If you received this in
error, please contact the sender and delete the material from any
computer. The integrity and security of this message cannot be
guaranteed and it may be subject to unauthorized amendment, for which we
accept no liability.

------------------------------------------------------------------------
------
Apps built with the Adobe(R) Flex(R) framework and Flex Builder(TM) are
powering Web 2.0 with engaging, cross-platform capabilities. Quickly and
easily build your RIAs with Flex Builder, the Eclipse(TM)based
development software that enables intelligent coding and step-through
debugging.
Download the free 60 day trial. http://p.sf.net/sfu/www-adobe-com
_______________________________________________
Springframework-user mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/springframework-user

------------------------------------------------------------------------
------
Apps built with the Adobe(R) Flex(R) framework and Flex Builder(TM) are
powering Web 2.0 with engaging, cross-platform capabilities. Quickly and
easily build your RIAs with Flex Builder, the Eclipse(TM)based
development software that enables intelligent coding and step-through
debugging.
Download the free 60 day trial. http://p.sf.net/sfu/www-adobe-com
_______________________________________________
Springframework-user mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/springframework-user

------------------------------------------------------------------------
------
Apps built with the Adobe(R) Flex(R) framework and Flex Builder(TM) are
powering Web 2.0 with engaging, cross-platform capabilities. Quickly and
easily build your RIAs with Flex Builder, the Eclipse(TM)based
development software that enables intelligent coding and step-through
debugging.
Download the free 60 day trial. http://p.sf.net/sfu/www-adobe-com
_______________________________________________
Springframework-user mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/springframework-user

------------------------------------------------------------------------------
Apps built with the Adobe(R) Flex(R) framework and Flex Builder(TM) are
powering Web 2.0 with engaging, cross-platform capabilities. Quickly and
easily build your RIAs with Flex Builder, the Eclipse(TM)based development
software that enables intelligent coding and step-through debugging.
Download the free 60 day trial. http://p.sf.net/sfu/www-adobe-com