spring security 2 phase authentication

Question

I'm a newb to spring security and I'm not sure where to start. I have requirements to have a multi-page authentication. The first page authenticates the username, if the username exists the web app progresses to the password page. (site image) The second page authenticates the password, if successful then the user is authenticated. I'm not sure how to fit this into spring auth. Do I add multiple login-filters and authenticationproviders ? If I add multiple authenticationproviders, will I be authenticated after the first login ?

Answer 1

Page 1: User enters username. Submit this to your own controller where you check if the user exists. If the user exists, display page 2, pass the username in the model. You better not include Spring Security authentication in this step.

Page 2: User enters password. Use a readonly or hidden field to keep track of the username. Submit the form to Spring Security form login filter. You don't need multiple authentication providers.

Note: This approach has an information "leak"; any visitor can check whether a username exists in the system or not.

Answer 2

It depends on the kind of your authentication:

• JDBCAuthentication

  You can do with @holmis83 suggests.

• LDAPAuthentication:

  I am afraid tht you can't do that.