login by code

[wwheeler]

I apologize for resurrecting a thread that's over three years old now, but this is the only thread I saw for this particular topic (programmatic login after a user self-registration) and there's an update for Spring 2.5. The technique described still works just fine, but "Context" has become "SecurityContext" and "ContextHolder" has become "SecurityContextHolder". (Both in package org.acegisecurity.context.) Everything else is the same. So here is the code that I used:

UsernamePasswordAuthenticationToken upat =
    new UsernamePasswordAuthenticationToken(username, password);
Authentication auth = authMgr.authenticate(upat);
SecurityContext ctx = SecurityContextHolder.getContext();
ctx.setAuthentication(auth);

Hope somebody finds that useful.

[Luke Taylor]

Spring 2.5? These changes were made in Acegi Security 0.9

http://acegisecurity.org/upgrade/upgrade-080-090.html

:-)

[mueller]

Has anything else been updated in the last several years to make this extremely common signup verification and forgotten password technique easier to implement with ACEGI?

[lomu]

An other way to bypass double encoding is simply to change it just before login

DaoAuthenticationProvider daoProvider = ((DaoAuthenticationProvider)SpringApplicationContext.getBean("daoAuthenticationProvider"));
daoProvider.setPasswordEncoder((PasswordEncoder)SpringApplicationContext.getBean("plainTextPasswordEncoder"));
daoProvider.setSaltSource(null);

and then reactive it :

daoProvider.setPasswordEncoder((PasswordEncoder)SpringApplicationContext.getBean("md5PasswordEncoder"));
daoProvider.setSaltSource((SaltSource)SpringApplicationContext.getBean("reflectionSaltSource"));