Spring Boot two ways for Authentication: Combine LDAP and token based auth
For my RESTfulll application, we need to have two kinds of authentications. One is based on LDAP for all internal employees. This is recently implemented and working fine. For all external employees we need some token based authentication.
What do I mean with that? These employees will get send a generated token via email, this token is stored with an expiry date in our database. The employees should be able to “login” with that token. So what would be the best way to implement something like that?
My first thought was to build an additional ExternalAuthenticationProvider
and add this to the security conf. This works, the users can login with the token as their username
, they get the JWT. But when they like to access any resources, the response is a HTTP 403
-error.
For me this implementation looks like a dirty hack, I don’t like the approach, maybe there is better one.
Thanks for any advices.
@Component
public class ExternalAuthenticationProvider implements AuthenticationProvider {
@Autowired
private ExternalEffortLinkManagementRepository externalEffortLinkManagementRepository;
@Override
public Authentication authenticate(Authentication auth) throws AuthenticationException {
Collection<GrantedAuthority> gas = new HashSet<GrantedAuthority>();
String userToken = auth.getName();
ExternalEffortLinkManagement token = externalEffortLinkManagementRepository.getByLink(userToken);
if (token != null && token.isActive()) {
gas.add(new SimpleGrantedAuthority(SecurityConstants.ROLE_EXTERNAL));
return new UsernamePasswordAuthenticationToken(userToken, null, gas);
} else {
throw new
BadCredentialsException("External system authentication failed");
}
}
@Override
public boolean supports(Class<?> auth) {
return auth.equals(UsernamePasswordAuthenticationToken.class);
}
}
spring spring-boot authentication
add a comment |
For my RESTfulll application, we need to have two kinds of authentications. One is based on LDAP for all internal employees. This is recently implemented and working fine. For all external employees we need some token based authentication.
What do I mean with that? These employees will get send a generated token via email, this token is stored with an expiry date in our database. The employees should be able to “login” with that token. So what would be the best way to implement something like that?
My first thought was to build an additional ExternalAuthenticationProvider
and add this to the security conf. This works, the users can login with the token as their username
, they get the JWT. But when they like to access any resources, the response is a HTTP 403
-error.
For me this implementation looks like a dirty hack, I don’t like the approach, maybe there is better one.
Thanks for any advices.
@Component
public class ExternalAuthenticationProvider implements AuthenticationProvider {
@Autowired
private ExternalEffortLinkManagementRepository externalEffortLinkManagementRepository;
@Override
public Authentication authenticate(Authentication auth) throws AuthenticationException {
Collection<GrantedAuthority> gas = new HashSet<GrantedAuthority>();
String userToken = auth.getName();
ExternalEffortLinkManagement token = externalEffortLinkManagementRepository.getByLink(userToken);
if (token != null && token.isActive()) {
gas.add(new SimpleGrantedAuthority(SecurityConstants.ROLE_EXTERNAL));
return new UsernamePasswordAuthenticationToken(userToken, null, gas);
} else {
throw new
BadCredentialsException("External system authentication failed");
}
}
@Override
public boolean supports(Class<?> auth) {
return auth.equals(UsernamePasswordAuthenticationToken.class);
}
}
spring spring-boot authentication
Could you provide snippets of code of your solution? As to 403 maybe the provider does not set required authorities?
– Jan Mares
Nov 12 '18 at 9:52
I updated the post
– Max
Nov 12 '18 at 10:22
1
What authorities does the accessed resources require? 403 suggests the user is authenticated but does not have access rights to the resource - unless the error handling is customized in your app. As to what is best practice - have a look at how spring does it - e.g. OAuth2AuthenticationManager. But I don't think, your approach is wrong as such.
– Jan Mares
Nov 12 '18 at 19:34
add a comment |
For my RESTfulll application, we need to have two kinds of authentications. One is based on LDAP for all internal employees. This is recently implemented and working fine. For all external employees we need some token based authentication.
What do I mean with that? These employees will get send a generated token via email, this token is stored with an expiry date in our database. The employees should be able to “login” with that token. So what would be the best way to implement something like that?
My first thought was to build an additional ExternalAuthenticationProvider
and add this to the security conf. This works, the users can login with the token as their username
, they get the JWT. But when they like to access any resources, the response is a HTTP 403
-error.
For me this implementation looks like a dirty hack, I don’t like the approach, maybe there is better one.
Thanks for any advices.
@Component
public class ExternalAuthenticationProvider implements AuthenticationProvider {
@Autowired
private ExternalEffortLinkManagementRepository externalEffortLinkManagementRepository;
@Override
public Authentication authenticate(Authentication auth) throws AuthenticationException {
Collection<GrantedAuthority> gas = new HashSet<GrantedAuthority>();
String userToken = auth.getName();
ExternalEffortLinkManagement token = externalEffortLinkManagementRepository.getByLink(userToken);
if (token != null && token.isActive()) {
gas.add(new SimpleGrantedAuthority(SecurityConstants.ROLE_EXTERNAL));
return new UsernamePasswordAuthenticationToken(userToken, null, gas);
} else {
throw new
BadCredentialsException("External system authentication failed");
}
}
@Override
public boolean supports(Class<?> auth) {
return auth.equals(UsernamePasswordAuthenticationToken.class);
}
}
spring spring-boot authentication
For my RESTfulll application, we need to have two kinds of authentications. One is based on LDAP for all internal employees. This is recently implemented and working fine. For all external employees we need some token based authentication.
What do I mean with that? These employees will get send a generated token via email, this token is stored with an expiry date in our database. The employees should be able to “login” with that token. So what would be the best way to implement something like that?
My first thought was to build an additional ExternalAuthenticationProvider
and add this to the security conf. This works, the users can login with the token as their username
, they get the JWT. But when they like to access any resources, the response is a HTTP 403
-error.
For me this implementation looks like a dirty hack, I don’t like the approach, maybe there is better one.
Thanks for any advices.
@Component
public class ExternalAuthenticationProvider implements AuthenticationProvider {
@Autowired
private ExternalEffortLinkManagementRepository externalEffortLinkManagementRepository;
@Override
public Authentication authenticate(Authentication auth) throws AuthenticationException {
Collection<GrantedAuthority> gas = new HashSet<GrantedAuthority>();
String userToken = auth.getName();
ExternalEffortLinkManagement token = externalEffortLinkManagementRepository.getByLink(userToken);
if (token != null && token.isActive()) {
gas.add(new SimpleGrantedAuthority(SecurityConstants.ROLE_EXTERNAL));
return new UsernamePasswordAuthenticationToken(userToken, null, gas);
} else {
throw new
BadCredentialsException("External system authentication failed");
}
}
@Override
public boolean supports(Class<?> auth) {
return auth.equals(UsernamePasswordAuthenticationToken.class);
}
}
spring spring-boot authentication
spring spring-boot authentication
edited Nov 12 '18 at 10:22
asked Nov 12 '18 at 8:11
Max
146112
146112
Could you provide snippets of code of your solution? As to 403 maybe the provider does not set required authorities?
– Jan Mares
Nov 12 '18 at 9:52
I updated the post
– Max
Nov 12 '18 at 10:22
1
What authorities does the accessed resources require? 403 suggests the user is authenticated but does not have access rights to the resource - unless the error handling is customized in your app. As to what is best practice - have a look at how spring does it - e.g. OAuth2AuthenticationManager. But I don't think, your approach is wrong as such.
– Jan Mares
Nov 12 '18 at 19:34
add a comment |
Could you provide snippets of code of your solution? As to 403 maybe the provider does not set required authorities?
– Jan Mares
Nov 12 '18 at 9:52
I updated the post
– Max
Nov 12 '18 at 10:22
1
What authorities does the accessed resources require? 403 suggests the user is authenticated but does not have access rights to the resource - unless the error handling is customized in your app. As to what is best practice - have a look at how spring does it - e.g. OAuth2AuthenticationManager. But I don't think, your approach is wrong as such.
– Jan Mares
Nov 12 '18 at 19:34
Could you provide snippets of code of your solution? As to 403 maybe the provider does not set required authorities?
– Jan Mares
Nov 12 '18 at 9:52
Could you provide snippets of code of your solution? As to 403 maybe the provider does not set required authorities?
– Jan Mares
Nov 12 '18 at 9:52
I updated the post
– Max
Nov 12 '18 at 10:22
I updated the post
– Max
Nov 12 '18 at 10:22
1
1
What authorities does the accessed resources require? 403 suggests the user is authenticated but does not have access rights to the resource - unless the error handling is customized in your app. As to what is best practice - have a look at how spring does it - e.g. OAuth2AuthenticationManager. But I don't think, your approach is wrong as such.
– Jan Mares
Nov 12 '18 at 19:34
What authorities does the accessed resources require? 403 suggests the user is authenticated but does not have access rights to the resource - unless the error handling is customized in your app. As to what is best practice - have a look at how spring does it - e.g. OAuth2AuthenticationManager. But I don't think, your approach is wrong as such.
– Jan Mares
Nov 12 '18 at 19:34
add a comment |
1 Answer
1
active
oldest
votes
I found the error:
Snippet 1:
gas.add(new SimpleGrantedAuthority(SecurityConstants.ROLE_EXTERNAL)); // ROLE_EXTERNAL = "EXTERNAL"
was replaced with
Snippet 2:
gas.add(new SimpleGrantedAuthority("ROLE_" + SecurityConstants.ROLE_EXTERNAL));
I have used the same code (Snippet 1) for the LDAP authentication, so I just passed the string "EXTERNAL"
to the SimpleGrantedAuthority
constructor. But I did this within my CustomLdapAuthoritiesPopulator
, seems like spring adds the ROLE_
-prefix somehow in the hidden code. But this did not work with my ExternalAuthenticationProvider
, there it was necessary to add ROLE_
to the string.
add a comment |
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53258081%2fspring-boot-two-ways-for-authentication-combine-ldap-and-token-based-auth%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
I found the error:
Snippet 1:
gas.add(new SimpleGrantedAuthority(SecurityConstants.ROLE_EXTERNAL)); // ROLE_EXTERNAL = "EXTERNAL"
was replaced with
Snippet 2:
gas.add(new SimpleGrantedAuthority("ROLE_" + SecurityConstants.ROLE_EXTERNAL));
I have used the same code (Snippet 1) for the LDAP authentication, so I just passed the string "EXTERNAL"
to the SimpleGrantedAuthority
constructor. But I did this within my CustomLdapAuthoritiesPopulator
, seems like spring adds the ROLE_
-prefix somehow in the hidden code. But this did not work with my ExternalAuthenticationProvider
, there it was necessary to add ROLE_
to the string.
add a comment |
I found the error:
Snippet 1:
gas.add(new SimpleGrantedAuthority(SecurityConstants.ROLE_EXTERNAL)); // ROLE_EXTERNAL = "EXTERNAL"
was replaced with
Snippet 2:
gas.add(new SimpleGrantedAuthority("ROLE_" + SecurityConstants.ROLE_EXTERNAL));
I have used the same code (Snippet 1) for the LDAP authentication, so I just passed the string "EXTERNAL"
to the SimpleGrantedAuthority
constructor. But I did this within my CustomLdapAuthoritiesPopulator
, seems like spring adds the ROLE_
-prefix somehow in the hidden code. But this did not work with my ExternalAuthenticationProvider
, there it was necessary to add ROLE_
to the string.
add a comment |
I found the error:
Snippet 1:
gas.add(new SimpleGrantedAuthority(SecurityConstants.ROLE_EXTERNAL)); // ROLE_EXTERNAL = "EXTERNAL"
was replaced with
Snippet 2:
gas.add(new SimpleGrantedAuthority("ROLE_" + SecurityConstants.ROLE_EXTERNAL));
I have used the same code (Snippet 1) for the LDAP authentication, so I just passed the string "EXTERNAL"
to the SimpleGrantedAuthority
constructor. But I did this within my CustomLdapAuthoritiesPopulator
, seems like spring adds the ROLE_
-prefix somehow in the hidden code. But this did not work with my ExternalAuthenticationProvider
, there it was necessary to add ROLE_
to the string.
I found the error:
Snippet 1:
gas.add(new SimpleGrantedAuthority(SecurityConstants.ROLE_EXTERNAL)); // ROLE_EXTERNAL = "EXTERNAL"
was replaced with
Snippet 2:
gas.add(new SimpleGrantedAuthority("ROLE_" + SecurityConstants.ROLE_EXTERNAL));
I have used the same code (Snippet 1) for the LDAP authentication, so I just passed the string "EXTERNAL"
to the SimpleGrantedAuthority
constructor. But I did this within my CustomLdapAuthoritiesPopulator
, seems like spring adds the ROLE_
-prefix somehow in the hidden code. But this did not work with my ExternalAuthenticationProvider
, there it was necessary to add ROLE_
to the string.
answered Nov 20 '18 at 10:59
Max
146112
146112
add a comment |
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Some of your past answers have not been well-received, and you're in danger of being blocked from answering.
Please pay close attention to the following guidance:
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53258081%2fspring-boot-two-ways-for-authentication-combine-ldap-and-token-based-auth%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Could you provide snippets of code of your solution? As to 403 maybe the provider does not set required authorities?
– Jan Mares
Nov 12 '18 at 9:52
I updated the post
– Max
Nov 12 '18 at 10:22
1
What authorities does the accessed resources require? 403 suggests the user is authenticated but does not have access rights to the resource - unless the error handling is customized in your app. As to what is best practice - have a look at how spring does it - e.g. OAuth2AuthenticationManager. But I don't think, your approach is wrong as such.
– Jan Mares
Nov 12 '18 at 19:34