Question

I’m needing to do some custom things when a user tries to log in depending on their username but these things need to happen before the authentication process. Here’s what I’ve got so far.

Our system allows for multiple email addresses and the client wants the user to be able to authenticate using any 1 of them. To allow for this I created a custom UserDetailsService and had the code lookup the user appropriately.

The other things I need to do require a few flags on the user object that spring-security doesn’t really know or care about. But I need to hook into the auth process, check these flags, and return appropriate error messages to the user. To give a more concrete example, I need to know if this is the first time a user has ever logged into the system. So we have a flag on the user to track this. When the user tries to authenticate, I need to read this value and do some stuff, including sending a message back to the user and halting authentication.

I looked into the Event Listener mechanisms in the documentation but what I am not seeing how to do is how to inject my own workflow via the listeners. I need to do a flow like this:

Auth with valid email but first time -> cancel authentication -> display message on login page

I think if I can get that one scenario handled, I can figure the others out that I need.

UPDATE: I’m reading on filters now to see if I missed something…

Answer 1

The simplest was to hook into the authentication process is to provide your own AuthenticationProvider. There are only two methods to implement. In authenticate() you can do all of your custom stuff.

To configure your provider into the framework do something like:

<authentication-manager>
  <authentication-provider ref="myAuthenticationProvider" />
</authentication-manager>