Question

I am trying to set the database name as the request input parameter from the spring security login page. At present I am only getting username that’s been retrieved using spring security SecurityContextHolder.getContext().getAuthentication().

How to access the additional field that’s been set on the login page?

Answer 1

Elaborating on @Vacuum’s comment

Here’s a simple way (untested, but I believe this would work)

1. Create a new class ExUsernamePasswordAuthenticationFilter that will extend the default filter and grab the additional parameter and store it in the session. It will look something like this:

public class ExUsernamePasswordAuthenticationFilter extends UsernamePasswordAuthenticationFilter {
    
    @Override
    public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException {
        final String dbValue = request.getParameter("dbParam");
        request.getSession().setAttribute("dbValue", dbValue);

        return super.attemptAuthentication(request, response); 
    } 
}

2. In your UserDetailsService implementation, modify your implementation of:

UserDetails loadUserByUsername(String username) throws UsernameNotFoundException, DataAccessException;

to grab the session variable that the filter from step 1) makes available.

3. in your <http /> security set-up, override the default filter with your custom one

<custom-filter ref="beanForYourCustomFilterFromStep1" position="FORM_LOGIN_FILTER"/>

Refer to this part of the documentation for more info about custom filters: http://static.springsource.org/spring-security/site/docs/3.1.x/reference/springsecurity-single.html#ns-custom-filters