Question

I am developing two web applications where one is a server app and the other is a client app, both are using Spring Security. My use case is such that after a user logs into the server app, the user can then access the client app from links within the server app. Since the user should not have to log in again when they click on these links (part of my requirements), I decided to use a strategy similar to Single SignOn in order to forward their authentication information from the server app to the client app.

On the client app, I am using Spring Security’s RequestHeaderAuthenticationFilter to look for a custom request header that is set by the server app.

1. If this custom header is found, do I have to do any further validation that this request is trustworthy? In Spring’s Pre-Authentication doc, RequestHeaderAuthenticationFilter does not perform any authentication and will assume the request to be from the user specified in the SM_USER attribute. How do I ensure that the request is genuine?

2. How do I send the user from one app to another with a custom header in the http request? Redirecting the request does not work as the header information will be lost. Forwarding does not work as the forwarded request does not go through the configured Spring Security filters on the client app, thus the request is never “authenticated” and no session is created.

Answer 1

Since I didn’t receive any responses, I changed my approach slightly in order to achieve the same SSO behavior. I am answering my own question here to close this issue.

Instead of using the RequestHeaderAuthenticationFilter, I subclassed Spring’s AbstractPreAuthenticatedProcessingFilter which retrieves the Principal and Credentials from the HttpRequest. I then implemented a custom preAuthenticatedUserDetailsService that will validate the Credentials with the server app before loading the UserDetails.

As for #2, I am no longer using custom headers in the initial pre-authenticated login request. I am simply appending the principal (username) and credentials as url parameters to the initial pre-authenticated “login” request to the client app. Since the communicated between the two apps are secured via SSL, I figured that should be safe.

This is what my security configuration looks like now:

<b:bean id="http403EntryPoint" class="org.springframework.security.web.authentication.Http403ForbiddenEntryPoint" />
<b:bean id="navigatorPreAuthFilter" class="com.example.NavigatorPreAuthenticatedProcessingFilter">
    <b:property name="authenticationManager" ref="authenticationManager" />
</b:bean>

<http auto-config="false" entry-point-ref="http403EntryPoint">

    <custom-filter position="PRE_AUTH_FILTER" ref="navigatorPreAuthFilter" />
    <session-management session-fixation-protection="newSession" />
    <logout logout-success-url="/logout" delete-cookies="JSESSIONID" />

    <intercept-url pattern="/index.jsp" access="ROLE_QUESTIONNAIRE_ASSIGNEE"/>
</http>

<b:bean id="preAuthenticatedUserDetailsService" class="com.example.NavigatorPreAuthenticatedUserDetailsService" />
<b:bean id="preauthAuthProvider" class="org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationProvider">
    <b:property name="preAuthenticatedUserDetailsService" ref="preAuthenticatedUserDetailsService" />
</b:bean>

<authentication-manager alias="authenticationManager">
    <authentication-provider ref="preauthAuthProvider"/>
</authentication-manager>