Question

I’m using Spring 3.1.1.RELEASE. How do I access the original request object in the authentication success handler method? When I submit my spring security form, I submit three parameters, the username, the password, and a third token (with param name = “token”). I have tried this …

@RequestMapping(value = "/authenticate")
public String authenticate() 
{
    final HttpServletRequest origRequest = 
                ((ServletRequestAttributes) RequestContextHolder.
                        currentRequestAttributes()).getRequest();
    String token = origRequest.getParameter("token");

However, the value “token” is always null, even though I know its not when I submit the request. Here’s how I configure my Spring security …

<beans:bean id="springboardUsernamePasswordUrlAuthenticationFilter" 
    class="org.collegeboard.springboard.dido.security.SpringboardUsernamePasswordUrlAuthenticationFilter">
    <beans:property name="filterProcessesUrl" value="/j_spring_security_check"/>
    <beans:property name="authenticationManager" ref="authenticationManager"/>
    <beans:property name="authenticationFailureHandler">
        <beans:bean class="org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler">
            <beans:property name="defaultFailureUrl" value="/login/failure"/>
        </beans:bean>
    </beans:property>
    <beans:property name="authenticationSuccessHandler">
        <beans:bean
            class="org.springframework.security.web.authentication.SimpleUrlAuthenticationSuccessHandler">
            <beans:property name="defaultTargetUrl" value="/pdregistration/authenticate" />
        </beans:bean>
    </beans:property>
</beans:bean>

Thanks for your help, – Dave

Answer 1

It’s to late. After successfull authentication your user was redirected by SimpleUrlAuthenticationSuccessHandler to /authenticate. If you need access to previous HTTP request then just provide your own implementation for authenticationSuccessHandler. At this moment you will be able to get your token:

public class CustomAuthenticationSuccessHandler extends SimpleUrlAuthenticationSuccessHandler {
    @Override
    public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException, ServletException {
        // grab your token here from request
        super.onAuthenticationSuccess(request, response, authentication);
    }
}

<beans:property name="authenticationSuccessHandler">
    <beans:bean
        class="com.domain.security.CustomAuthenticationSuccessHandler">
        <beans:property name="defaultTargetUrl" value="/pdregistration/authenticate" />
    </beans:bean>
</beans:property>