Although this type of functionality is in no way trivial to achieve, it is actually possible without modifying Spring.
The actual code is too large to publish, so I will try to describe the basic principle and leave you the code.
- Extend Spring
SavedRequestAwareAuthenticationSuccessHandler and implement functionality for serializing and writing an Authentication object for a session cookie with a global scope. See the documentation for the authentication-success-handler-ref attribute in the Spring <sec:http> for more information on how to hook this up. (Note: if the problem is with several web applications in the same domain, you can of course limit the scope of cookies to the current domain). - In all your web applications, add a
web.xml a <filter> springSecurityFilterChain named springSecurityFilterChain and class org.springframework.web.filter.DelegatingFilterProxy and <filter-mapping> for the filter with the URL pattern /* You do not need to create the actual bean Spring Security provides a default implementation for you. - In all of your web applications, add a
web.xml a <filter> singleSignonAuthenticationFilterChain named singleSignonAuthenticationFilterChain with class org.springframework.web.filter.DelegatingFilterProxy and matches <filter-mapping> for the filter with the URL /* pattern - Now you add a new bean call to
singleSignonAuthenticationFilterChain , which should point to the class that implements Filter . In the doFilter() method, verify that there is a session attribute called SPRING_SECURITY_CONTEXT . If there is, then we are already logged in. Otherwise, grab the serialized Authentication token, deserialize it and use SecurityContextHolder.getContext().setAuthentication(authentication) to authenticate the user using Spring. Also, do not forget session.setAttribute("SPRING_SECURITY_CONTEXT", SecurityContextHolder.getContext()) or place authentication every time, which is not necessary.
The twist to (4) attribute is that if you find that the SPRING_SECURITY_CONTEXT attribute SPRING_SECURITY_CONTEXT missing, it may be because the user has just left the current web application. In this case, it should be unloaded globally, so in this case you want to delete the cookie containing the serialized authentication token.
It is difficult to write a resume in one page, but I hope you get a general idea. It is currently implemented in a complex application consisting of several web applications, and it works great.