Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Set details on authentication token created by HttpServlet3RequestFactory

Browse Source 
Currently the login mechanism when triggered by executing HttpServlet3RequestFactory#login does not set any details on the underlying authentication token that is authenticated.

This change adds an AuthenticationDetailsSource on the HttpServlet3RequestFactory, which defaults to a WebAuthenticationDetailsSource.

Closes gh-9579
This commit is contained in:
Karl Tinawi
2021-04-11 15:13:13 +01:00
committed by Steve Riesenberg
parent be802f57ba
commit c57fc309c2
4 changed files with 71 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
config/src/main/java/org/springframework/security/config/annotation/web/configurers/ServletApiConfigurer.java
View File

@@ -21,6 +21,7 @@ import java.util.List;
import jakarta.servlet.http.HttpServletRequest;
import org.springframework.context.ApplicationContext;
import org.springframework.security.authentication.AuthenticationDetailsSource;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.AuthenticationTrustResolver;
import org.springframework.security.config.annotation.web.HttpSecurityBuilder;
@@ -90,6 +91,11 @@ public final class ServletApiConfigurer<H extends HttpSecurityBuilder<H>>
if (trustResolver != null) {
this.securityContextRequestFilter.setTrustResolver(trustResolver);
}
AuthenticationDetailsSource<HttpServletRequest, ?> authenticationDetailsSource = http
.getSharedObject(AuthenticationDetailsSource.class);
if (authenticationDetailsSource != null) {
this.securityContextRequestFilter.setAuthenticationDetailsSource(authenticationDetailsSource);
}
ApplicationContext context = http.getSharedObject(ApplicationContext.class);
if (context != null) {
String[] grantedAuthorityDefaultsBeanNames = context.getBeanNamesForType(GrantedAuthorityDefaults.class);