I need a custom authentication manager because, when I use the one supplied by spring security into the AuthenticationHandler of my web services, and when I add the concurrent-session-control element, I have this exception : java.lang.IllegalArgumentException: Authentication.getDetails() required.
Everything would work very well if I did not need the element concurrent-session-control.
This is the way my handler is used into my web services:
Code:
<bean id="authenticationHandler" class="com.ws.xfire.impl.AuthenticationHandler">
<property name="authenticationManager" ref="authenticationManager"/>
</bean>
<bean name="userService" class="org.codehaus.xfire.spring.ServiceBean">
<property name="serviceBean" ref="userWS"/>
<property name="serviceClass" value="com.ws.xfire.UserService"/>
<property name="inHandlers">
<list>
<ref bean="addressingHandler"/>
<ref bean="authenticationHandler"/>
</list>
</property>
</bean>
This is the code of AuthenticationHandler that uses the AuthenticationManager:
Code:
public void invoke(MessageContext context) throws XFireFault {
Element header = context.getInMessage().getHeader();
if (header == null) {
throw new XFireFault(AuthenticationConstants.MISSING_AUTH_TOKEN, XFireFault.SENDER);
}
Namespace ns = Namespace.getNamespace(TOKEN_NS);
Element token = header.getChild(AuthenticationToken.NAME, ns);
if (token == null) {
throw new XFireFault(AuthenticationConstants.MISSING_AUTH_TOKEN,
XFireFault.SENDER);
}
String username = token.getChild(AuthenticationToken.LOGIN, ns).getText();
String password = token.getChild(AuthenticationToken.PASSWORD, ns).getText();
try {
UsernamePasswordAuthenticationToken authToker =
new UsernamePasswordAuthenticationToken(username, password);
authenticationManager.authenticate(authToker);
} catch (Exception e) {
log.warn(e);
throw new XFireFault(AuthenticationConstants.AUTHENTICATION_FAILED, XFireFault.SENDER);
}
context.setProperty(AuthenticationConstants.LOGIN_KEY, username);
}
My custom AuthenticationManager only overrides the method doAuthentication to bypass the problem:
Code:
public class CustomAuthenticationManager extends ProviderManager {
@Override
public Authentication doAuthentication(Authentication authRequest)
throws AuthenticationException {
UsernamePasswordAuthenticationToken result = UsernamePasswordAuthenticationToken) super.doAuthenticatio(authRequest);
copyDetails(authRequest, result);
return result;
}
protected void copyDetails(Authentication source, UsernamePasswordAuthenticationToken dest) {
if (dest.getDetails() == null) {
Object details = source.getDetails();
dest.setDetails(details);
}
}
}
Any ideas ?
Problem with concurrent sessions
