TAM Webseal + spring pre-authentication

Question

Has anybody done spring pre-authentication with TAM Web-seal? Can you please share the configuration details?

Answer 1

If webseal forward the request with the username in iv-user header, then it is relative simple to configure spring-security:

<security:http auto-config="false" use-expressions="true" entry-point-ref="authenticationEntryPoint" access-decision-manager-ref="httpAccessDecisionManager">

    <security:custom-filter ref="webSealPreAuthFilter" position="PRE_AUTH_FILTER"/>
     ...
</security:http>


<bean id="webSealPreAuthFilter" class="org.springframework.security.web.authentication.preauth.RequestHeaderAuthenticationFilter">
    <property name="authenticationManager" ref="authenticationManager"/>
    <property name="principalRequestHeader" value="iv-user"/>

    <!-- exceptionIfHeaderMissing AND checkForPrincipalChanges needs to be enable to check that each request needs a "iv-user" header -->
    <property name="checkForPrincipalChanges" value="true"/>
    <property name="exceptionIfHeaderMissing" value="true"/>
</bean>


<alias name="authenticationManager" alias="org.springframework.security.authenticationManager"/>
<bean id="authenticationManager" class="org.springframework.security.authentication.ProviderManager">
    <property name="authenticationEventPublisher">
        <bean class="org.springframework.security.authentication.DefaultAuthenticationEventPublisher"/>
    </property>
    <constructor-arg name="providers">
        <list>
            <ref local="preAuthenticatedAuthenticationProvider"/>
        </list>
    </constructor-arg>
</bean>

<bean id="preAuthenticatedAuthenticationProvider"
        class="org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationProvider">
    <property name="preAuthenticatedUserDetailsService">
        <bean class="org.springframework.security.core.userdetails.UserDetailsByNameServiceWrapper">
            <constructor-arg name="userDetailsService" ref="userDetailsService"/>
        </bean>
    </property>
</bean>

<bean id="authenticationEntryPoint" class="org.springframework.security.web.authentication.Http403ForbiddenEntryPoint"/>

You need an userDetailsService but this is highly dependend on how your application works.