6

I'm using Spring Security 3.0.2 and I can't find a way to load roles of anonymous user from database (I've got dynamic roles where roles can be given to everyone).

I've tried to use a custom anonymousAuthenticationProvider but this provider is never called. Here is my config:

<http auto-config="false">
    <logout invalidate-session="true" logout-success-url="/page/welcome" />
    <remember-me />
    <anonymous username="_GUEST_" granted-authority="ROLE_GUEST" key="anonymousKey" />
    <form-login login-page="/page/login" authentication-failure-url="/page/login?fail=1" default-target-url="/page/welcome" />
</http>

<authentication-manager alias="authenticationManager">
    <authentication-provider ref="anonymousAuthenticationProvider"></authentication-provider>
    <authentication-provider user-service-ref="accountDetails">
        <password-encoder ref="passwordEncoder">
            <salt-source user-property="xxxx" />
        </password-encoder>
    </authentication-provider>
</authentication-manager>

<beans:bean id="accountDetails" class="com.mysite.AccountDetailsImpl" />

<beans:bean id="passwordEncoder" class="org.springframework.security.authentication.encoding.ShaPasswordEncoder">
    <beans:constructor-arg value="512" />
</beans:bean>

<beans:bean id="anonymousAuthenticationProvider" class="com.my.site.security.CustomAnonymousAuthenticationProvider">
    <beans:property name="key" value="anonymousKey" />
</beans:bean>

My anonymousAuthenticationProvider is never called so I can't load custom authorities from database. When I log in, my service accountDetails is called and I can load roles from database for the user, I want the same thing for anonymous user.

How can I do it ? thanks

Jerome Cance
  • 8,103
  • 12
  • 53
  • 106
  • Guys, I'm in the same problem. The questio is, can I send a parameter received from a querystring to use in my custom authentication? If yes, how? Can you put yours complete xml ? Tks a lot! Rodrigo –  Jan 31 '11 at 13:48

1 Answers1

4

It seems to be that the easiest way to achieve it is to declare a AnonymousAuthenticationFilter with a custom UserAttribute, which will produce the required authorities:

<http auto-config = "false">
    <anonymous enabled = "false" />
    <custom-filter ref = "myFilter" position = "ANONYMOUS_FILTER" />
    ...
</http>

<beans:bean id = "myFilter" class = "org.springframework.security.web.authentication.AnonymousAuthenticationFilter">
    <beans:property name = "key" value = "anonymousKey" />
    <beans:property name = "userAttribute" ref = "myAttributes" />
</beans:bean>

<beans:bean id = "myAttributes" class = "..." />
axtavt
  • 239,438
  • 41
  • 511
  • 482
  • In Spring Security 4 AnonymousAuthenticationFilter lost `userAttribute` as described here: http://docs.spring.io/spring-security/site/migrate/current/3-to-4/html5/migrate-3-to-4-xml.html#m3to4-deprecations-web-aaf So this won't help in newer versions. – shobull Jul 29 '16 at 12:14