Question

Does anyone know in Spring a way to implement a user-service or authentication provider that will accept any user when logging in?

This is further to my previous question: spring-ws get username & password

I have a basic security setup in my spring-ws project:

<security:http auto-config="true">
    <security:intercept-url pattern="/**" access="ROLE_USER" />
    <security:intercept-url pattern="/*.wsdl" access="ROLE_USER" />
    <security:http-basic/>
</security:http>

<security:authentication-manager erase-credentials="false">
    <security:authentication-provider user-service-ref="userService">
        <security:user-service>
            <security:user name="me" password="mypass"
                authorities="ROLE_USER" />
        </security:user-service>
    </security:authentication-provider>
</security:authentication-manager>

I don’t want to specify users in the user-service, I want a user with any details to have access, I simply want to make sure the user gives a username and password and to ensure that I can access this from the SecurityContextHolder.

Is it necessary to implement my own user-service or authentication-provider to do this and if so can anyone point in the direction of an example or provide me with one?

Thanks!

Answer 1

You need to provide your own AuthenticationProvider i.e. an implementation of the org.springframework.security.authentication.AuthenticationProvider interface.

<security:authentication-manager alias="authenticationManager">
  <security:authentication-provider ref="myProvider" />
</security:authentication-manager>

<bean id="myProvider" class="MyProvider"/>

MyProvider can then either delegate to a custom UserDetailsService to set the authorieties (the roles) or set a ROLE_USER directly.