How to impersonate a user using SwitchUserFilter in Spring?

Question

I have no knowledge of Spring Impersonating a user.

I read an example configuration code to impersonate the user and noticed that SwitchUserFilter is used for this implementation.

How to implement an impersonating user using Spring FilterUserFilter Filter and how does it work? What is the internal stream of an impersonating user?

In my application, I also use Spring protection.

Can someone help me with a simple description or any example for this?

Answer 1

First you need to create an instance SwitchUserFilter, for example:

@Bean
public SwitchUserFilter switchUserFilter() {
    SwitchUserFilter filter = new SwitchUserFilter();
    filter.setUserDetailsService(userDetailsService);
    filter.setSuccessHandler(authenticationSuccessHandler);
    filter.setFailureHandler(authenticationFailureHandler());
    return filter;
}

Then you can add a filter this way:

@Override
protected void configure(HttpSecurity http) throws Exception {

    http
     ...
     .addFilterAfter(switchUserFilter(), FilterSecurityInterceptor.class);

, ,

GET /login/impersonate?username=loginIdOfTheNewUser

GET /logout/impersonate

, , . /login/impersonate ADMIN /logout/impersonate , :

        .authorizeRequests()
            .antMatchers("/login/impersonate*").hasRole("ADMIN")
            .antMatchers("/logout/impersonate*").authenticated()
            .antMatchers("/**").permitAll();

. .