authentication by code

[newreaders]

Hi

I am using the following code to login programatically but it doesn't work (seems to not recognizing the authorities), can someone tell me what's wrong?

UsernamePasswordAuthenticationToken auth =
    new UsernamePasswordAuthenticationToken(user.getUsername(), user.getPassword());
auth.setDetails(request.getRemoteAddr());
auth.setAuthenticated(true);
    
Context context = ContextHolder.getContext();
if (context instanceof SecureContext) {
    ((SecureContext) context).setAuthentication(auth);
}

I didn't set the authorities because in the javadoc of UsernamePasswordAuthenticationToken, it says that I shouldn't call the setAuthorities method.

How can I get the AuthenticationManager? So that I can authenticate the UsernamePasswordAuthenticationToken.

Thanks

[Luke Taylor]

Hi,

What do you mean by "it doesn't work"? What's failing and what's the error? Presumable the code you've posted works OK, so it's whatever you're trying to do afterwards that's not working? You haven't really explained the context in which this is taking place. Where are you calling this code from?

Normally the authentication manager will populate the authorities based on some external configuration (e.g. a database). How you obtain one depends on what you're trying to do.

Luke.

[newreaders]

I passed an encrypted password to the authenticator instead of a plaintext password and as a result I could not access to the restricted pages. Even though I wasn't authenticated, the request.getRemoteUser() call shows my username.

Thanks

[Ben Alex]

Even though I wasn't authenticated, the request.getRemoteUser() call shows my username.

The code you have shown above looks like an attempt to write an authentication mechanism. As Luke said, what is the context of the code - what is it trying to do?

If it's an authentication mechansim (something that presents credentials to the security framework), it is required to present the Authentication to the AuthenticationManager. If AuthenticationManager returns an exception, it is required to set the ContextHolder to null. If AuthenticationManager returns a populated Authentication, an authentication mechanism is required to set the ContextHolder to that returned Authentication. Please take a look at AbstractProcessingFilter and AuthenticationProcessingFilter for a concrete example of this description.

I would encouage you to use Acegi Security's standard authentication mechanisms instead of writing your own, unless you have a compelling reason.

The reason request.getRemoteUser() returns a username is because your authentication mechanism has left the ContextHolder with an Authentication object, when if authentication failed if should have set the ContextHolder to null.