Spring Boot/Security Custom Authentication

Question

I'm trying to solve for a couple of hours this simple issue. Having read every blog/article that seem outdated, searching through stackoverflow too, i am not able to solve it.

In theory, when you want to use your custom Authentication provider, you create a class that implements the AuthenticiationProvider

public class CustomAuthProvider implements AuthProvider {}

And implement the authenticate and supports methods.

@Override
public Authentication authenticate(Authentication authentication) throws AuthenticationException {
    return MyCustomAuthentication();
}

@Override
public boolean supports(Class<?> authentication) {
    return (MyCustomAuthentication.class
            .isAssignableFrom(authentication));
}

And then create a SecurityConfig class that extends the WebSecurityConfigurerAdapter where you set your authentication provider.

public class SecurityConfig extends WebSecurityConfigurerAdapter {

    public SecurityConfig(AuthenticationProvider customAuthProvider) {
      super(true);
      this.customAuthProvider = customAuthProvider;
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
      auth.authenticationProvider(customAuthProvider);
    }
}

In theory, that should be it, that should work but yet it doesn't. Using the debugger, i can see that the provider is registered in the ProviderManager and it is the only one, yet the authenticate method is never used.

What am i missing?

I'm guessing just the default AuthenticationProvider initiated by Spring itself gets injected. Can you verify this by putting a breakpoint on the line starts with this.customAuthProvider... and restart the application? Are you instantiating your SecurityConfig with @Configuration? — Hasan Can Saral
As i have answered in the answer below, yes i do use @Configuration and it is the correct CustomAuthProvider injected. The problem is that the ProviderManager just ignores it when there is a need to authenticate. — gpopides

Hasan Can Saral Hasan Can Saral · Accepted Answer · 2020-08-15T13:54:13

Please make sure to put @Configuration on top of your SecurityConfig.

You might be injecting the default AuthenticationProvider initiated by Spring itself into your customAuthProvider. Make sure to initiate CustomAuthProvider and inject it into customAuthProvider:

public SecurityConfig(AuthenticationProvider customAuthProvider) {
    super(true);
    this.customAuthProvider = new CustomAuthProvider();
}

Spring Boot/Security Custom Authentication

2 Answers