Spring security and custom AuthenticationFilter with Spring boot

12
votes

I have custom authentication filter which creates PreAuthenticatedAuthenticationToken and stores it in security context. This all works fine. Here is the config:

@Configuration
@EnableWebMvcSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private SsoAuthenticationProvider authenticationProvider;

    @Autowired
    private SsoAuthenticationFilter ssoAuthenticationFilter;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.addFilterAfter(ssoAuthenticationFilter, SecurityContextPersistenceFilter.class);
    }
}

Now my ssoAuthenticationFilter is part of the FilterChainProxy, on the right position. Smooth.

But as the ssoAuthenticationFilter is Filter it gets picked up by Boot and included as a filter. So my filter chain really looks like:

  • ssoAuthenticationFilter (included because being Filter)
  • filterChainProxy (spring autoconfiguration)
    • ...
    • SecurityContextPersistenceFilter
    • ssoAuthenticationFilter (included by http.addFilterAfter(...))
    • ...
  • some other filters

Obviously I would like to get rid of the autoregistration of the ssoAuthenticationFilter here (the first one listed).

Any tips much appreciated.

1
javaspringspring-securityspring-boot

1 Answers

11
votes

2 choices:

  1. Add a FilterRegistrationBean @Bean with your filter bean as its target filter and mark it as enabled=false

  2. Don't create a @Bean definition for your filter (normally that's what I do, but YMMV since you might depend on autowiring or something to get it working)