Should I use both SocialAuthenticationFilter and ProviderSignInController together

Question

In short

Authentication events do not fire when using the ProviderSigninController. How can I use full spring security integration?

Long version

As far as I understand, I have a functional Spring-social setting that works as follows:

ProviderSignInController is configured to create social connections and automatically provide user accounts when a new user appears. I am using SignInAdapter, as shown by the documented example ,

I also have a regular Spring-security authentication service using UserDetailsService.

However, one difference that I saw is that logging into the social authentication system does not create any * AuthenticationEvents. These events are raised by the filter for regular accounts.

I wonder - Am I missing a piece of this integration? .
It seems a bit vulnerable, not passing through the SocialAuthenticationFilter, and just manually setting the auth context.

I want a central place to log authentication events.

Answer 1

I had a similar situation where I wanted to use SocialAuthenticationFilter for auth and implicit registration with Spring Security, and not ProviderSignInController (I agree that this is a bit dirty with the controller).

I plugged it in and it worked mostly, but I lost my onAuthenticationSuccess events, which gave me regular input.

What I finally did to get the filter to work as I needed was to add an ObjectPostProcessor to it. This allowed me to manually set my AuthenticationSuccessHandler after the filter was initialized deep in SpringSocialConfigurer (without a handle on it).

Here is a snippet.

// Spring Social configurer integrates with Spring Security for us .and().apply(new SpringSocialConfigurer() .postLoginUrl("/") // other setup .addObjectPostProcessor(new ObjectPostProcessor<SocialAuthenticationFilter>() { @Override public <O extends SocialAuthenticationFilter> O postProcess(O filter) { filter.setAuthenticationSuccessHandler(loginSuccessHandler); return filter; } }); 

loginSuccessHandler , is the same bean that I set in my normal filter configuration via .formLogin().successHandler(loginSuccessHandler) .

You can also indicate your Handler failure here.

It served my purpose. Now the solution uses my SocialUserDetailsService for auth and ConnectionSignUp for implicit registration (when registering in UserConnectionRepository).

Hope this helps.