Custom Authentication

DomainUsernamePasswordAuthenticationToken authRequest
= new DomainUsernamePasswordAuthenticationToken(
username, password, domain);

setDetails(request, authRequest);
return this.getAuthenticationManager()
.authenticate(authRequest);
}
}

The new DomainUsernamePasswordAuthenticationFilter object will do

the following:

Obtain a username, password, and domain from the HTTP request.

Create our DomainUsernamePasswordAuthenticationToken object with
information obtained from the HTTP request.
Request that Spring Security validate
DomainUsernamePasswordAuthenticationToken. The work is delegated to
CalendarUserAuthenticationProvider.
If the token is validated, its superclass will set the authentication returned by
CalendarUserAuthenticationProvider on SecurityContextHolder, just
as we did to authenticate a user after they created a new account.

Updating our configuration

Now that we have created all the code required for an additional parameter, we need
to configure Spring Security to be aware of it. The following code snippet includes
the required updates to our security.xml file to support our additional parameter:
src/main/webapp/WEB-INF/spring/security.xml

<http use-expressions="true"
auto-config="true"
entry-point-ref="loginEntryPoint">
<custom-filter ref="domainFormLoginFilter"
position="FORM_LOGIN_FILTER"/>


<form-login login-page="/login/form"
login-processing-url="/login"
username-parameter="username"
password-parameter="password"
authentication-failure-url="/login/form?error"
default-target-url="/default"/>

[ 70 ]