How to connect to a user using Spring-security?

Question

I need to program the login of users who have been authenticated through the Facebook API. The reason for this is that there are a number of elements that are associated with each user (for example, with a shopping cart), therefore, as soon as the user authenticates using the Facebook API, I need to register the user using spring security so that he can access his basket.

Based on my research, there are many methods for implementing it, but I could not deploy them, because I send a login request from my code, and another problem is that some people created a user object, but they did not explain how create it.

Those who created a custom object, but did not explain how to do this.

From the first example: this answer

Authentication auth = new UsernamePasswordAuthenticationToken(user, null, user.getAuthorities()); 

From the second example: this

  34.User details = new User(username); 35.token.setDetails(details); 

From the third example: this

  Authentication authentication = new UsernamePasswordAuthenticationToken(user, null, AuthorityUtils.createAuthorityList("ROLE_USER")); 

The following example , this does not help, because I need to log in from my own code, and not from the browser; so I don’t know how to populate the HttpServletRequest object.

 protected void automatedLogin(String username, String password, HttpServletRequest request) { 

Mycode

 ... if(isAuthenticatedByFB()) { login(username); return "success"; } else{ return "failed"; } 

Answer 1

Unfortunately, it seems that Spring Security does not have “full” support for programmatic login. Here's how I did it successfully:

 @Autowired AuthenticationSuccessHandler successHandler; @Autowired AuthenticationManager authenticationManager; @Autowired AuthenticationFailureHandler failureHandler; public void login(HttpServletRequest request, HttpServletResponse response, String username, String password) { UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken(username, password); token.setDetails(new WebAuthenticationDetails(request));//if request is needed during authentication Authentication auth; try { auth = authenticationManager.authenticate(token); } catch (AuthenticationException e) { //if failureHandler exists try { failureHandler.onAuthenticationFailure(request, response, e); } catch (IOException | ServletException se) { //ignore } throw e; } SecurityContextHolder.getContext().setAuthentication(auth); successHandler.onAuthenticationSuccess(request, response, auth);//if successHandler exists //if user has a http session you need to save context in session for subsequent requests HttpSession session = request.getSession(true); session.setAttribute("SPRING_SECURITY_CONTEXT", securityContext); } 

UPDATE . Essentially, this is done using Spring RememberMeAuthenticationFilter.doFilter()

Answer 2

This code is from Grails' Spring Security Core -Plugin , which is released under the Apache 2.0 license. I added imports to indicate which types. The original author is Bert Beckwith.

 import org.springframework.security.core.userdetails.UserCache; import org.springframework.security.core.userdetails.UserDetails; import org.springframework.security.core.userdetails.UserDetailsService; import org.springframework.security.core.context.SecurityContextHolder; import org.springframework.security.authentication.UsernamePasswordAuthenticationToken; ... public static void reauthenticate(final String username, final String password) { UserDetailsService userDetailsService = getBean("userDetailsService"); UserCache userCache = getBean("userCache"); UserDetails userDetails = userDetailsService.loadUserByUsername(username); SecurityContextHolder.getContext().setAuthentication(new UsernamePasswordAuthenticationToken( userDetails, password == null ? userDetails.getPassword() : password, userDetails.getAuthorities())); userCache.removeUserFromCache(username); } 

The getBean method simply provides a bean from the application context.