Access to HttpServletRequest during DaoAuthenticationProvider authentication in Spring Security

Question

I need to access the HttpServletRequest object from my DaoAuthenticationProvider in Spring Security.

The security component extends the DaoAuthenticationProvider , and we override the authenticate method to perform some user authentication / verification. An additional check is necessary to check the ip-address of the user who is included in the request URL as a parameter of the query string (Ex: http://domain.com/context?ip=192.168.0.1 ).

I'm currently trying to use RequestContextHolder thread-local and get an http request in my custom DaoAuthenticationProvider .

Some of the other solutions that I read here and on the Spring forums seem to suggest introducing AuthenticationDetailsSource , using custom-filter and other steps that I don't understand because I'm new to Spring's security.

We would have different web applications that use the same security component to perform authentication.

Can someone point me in the right direction or help me with any approaches implemented earlier?

Answer 1

You can add Spring RequestContextFilter to your web.xml. Thus, the attributes will be stored in the current thread with each request. Then you can get the original HtttpServletRequest:

 ServletRequestAttributes attributes = (ServletRequestAttributes) RequestContextHolder.currentRequestAttributes(); HttpServletRequest request = attributes.getRequest(); 

Answer 2

You can use RequestContextHolder , and it really contains the same request, although Spring Security usually terminates the incoming request, so you can get a different link depending on whether you place the RequestContextFilter before or after Spring Security Chain (note that you can easily check this yourself by comparing the value returned from RequestContextHolder with the request in the application controller).

It is also relatively easy to introduce custom AuthenticationDetails , as you mentioned:

 package com.mycompany; public class MyWebAuthenticationDetailsSource implements AuthenticationDetailsSource { public Object buildDetails(Object context) { return ((HttpServletRequest)context).getParameter("ip"); } } 

Then use

 <bean id="ads" class="com.mycompany.MyWebAuthenticationDetailsSource /> <bean id="formLoginFilter" class="org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter"> <property name="authenticationDetailsSource" ref="ads" /> <property name="authenticationManager" ref="authenticationmanager" /> </bean> 

and add it as a custom filter, as described in the reference guide. In 3.1, the namespace supports this directly in the form-login element . Authentication.getDetails() will then return the value of your ip parameter.

Please note that you probably should not use 3.0.4, as it has detected security vulnerabilities.

Also can you explain how the "ip" parameter is set?