Pfthb

I have configured Spring security to work with both LDAP and DB based login. First it tries to login via LDAP and if required permissions is not there then it takes to username/password entry page.

<security:http auto-config="false" entry-point-ref="loginUrlAuthenticationEntryPoint">
 <security:custom-filter ref="customPreAuthFilter" position="PRE_AUTH_FILTER"/> // This is for LDAP
 <security:custom-filter ref="customAuthFilter" position="FORM_LOGIN_FILTER"/> // This is for DB Based

 /** intercept urls 

 **/

</security:http>

I want to add a new screen on the top and user need to select between the two button LDAP or username/pass. How do I proceed?

The data to be accessed is the same url i.e. /home but both ldap and DB users should be able to access.

If you look at code in UsernamePasswordAuthenticationFilter there is setDetails method.

from docs:

Provided so that subclasses may configure what is put into the
authentication request's details property.

Idea from here
Provision to change ldap/Ad provider url at run time

You can set the details like authtype here and use it authentication provider, But to achieve the things you would lik adds little more work.

Adding details and hope it helps.

CustomUsernamePasswordAuthenticationFilter.java

import javax.servlet.http.HttpServletRequest;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.authentication.AuthenticationDetailsSource;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
import org.springframework.stereotype.Component;

@Component
public class CustomUsernamePasswordAuthenticationFilter extends UsernamePasswordAuthenticationFilter 

 private static final Logger logger = LoggerFactory.getLogger(CustomUsernamePasswordAuthenticationFilter.class);

 @Autowired
 @Override
 public void setAuthenticationManager(AuthenticationManager authenticationManager) 
 // TODO Auto-generated method stub
 super.setAuthenticationManager(authenticationManager);
 

 @Autowired 
 @Override
 public void setAuthenticationDetailsSource(
 AuthenticationDetailsSource<HttpServletRequest, ?> authenticationDetailsSource) 
 super.setAuthenticationDetailsSource(authenticationDetailsSource);
 

 @Override
 protected void setDetails(HttpServletRequest request, UsernamePasswordAuthenticationToken authRequest) 
 String authType = request.getParameter("authType");
 logger.info("authType ",authType);
 authRequest.setDetails(authenticationDetailsSource.buildDetails(request));
 

But this is not sufficient you would need to extend WebAuthenticationDetails.

Reason is WebAuthenticationDetails provides only remote IP address and sessionId so, to add authType we need to extend this class.

You have to extend WebAuthenticationDetailsSource to return CustomAuthenticationDetails as shown below.

CustomAuthenticationDetails.java

public class CustomAuthenticationDetails extends WebAuthenticationDetails


 private final String authType;

 public CustomAuthenticationDetails(HttpServletRequest request) 
 super(request);
 authType = request.getParameter("authType");
 

 public String getAuthType() 
 return authType;
 

CustomWebAuthenticationDetailsSource.java

public class CustomWebAuthenticationDetailsSource extends WebAuthenticationDetailsSource 

 @Override
 public WebAuthenticationDetails buildDetails(HttpServletRequest context) 
 return new CustomAuthenticationDetails(context);
 

Please note these classes for demo purpose only.

Need to autowire actual authentication providers in these classes.

import java.util.Arrays;
import java.util.List;

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.authentication.AuthenticationProvider;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.authentication.dao.DaoAuthenticationProvider;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.ldap.authentication.LdapAuthenticationProvider;
import org.springframework.stereotype.Component;

@Component
public class AuthenicationProviderJdbcLdapImpl implements AuthenticationProvider

 // you need to autowire jdbc auth provider
 @Autowired(required = false)
 DaoAuthenticationProvider authenticationProvider;

 //you need to autowire ldap auth provider
 @Autowired(required = false)
 LdapAuthenticationProvider ldapAuthenticationProvider;



 protected static class User
 private final String userId;
 private final String password;
 public User(String userId,String password) 
 this.userId = userId;
 this.password = password;
 
 public String getUserId() 
 return userId;
 
 public String getPassword() 
 return password;
 
 @Override
 public String toString() 
 return "User [userId=" + userId + ", password=" + password + "]";
 
 

 private final static Logger logger = LoggerFactory.getLogger(AuthenicationProviderJdbcLdapImpl.class);
 private static final List<User> users1 = Arrays.asList(new User("admin1", "password"),new User("admin2", "password"));
 private static final List<User> users2 = Arrays.asList(new User("admin3", "password"),new User("admin4", "password"));

 @Override
 public Authentication authenticate(Authentication authentication) throws AuthenticationException 

 CustomAuthenticationDetails details = (CustomAuthenticationDetails) authentication.getDetails();

 String authType = details.getAuthType();
 logger.info("authType ",authType);
 if("jdbc".equalsIgnoreCase(authType)) 
 logger.info("perfrom jdbc authentication");

 //perform your authentication using jdbc
 //the below is just for explaination

 return performAuthentication(authentication, users1);

 else if("ldap".equalsIgnoreCase(authType)) 
 logger.info("perfrom ldap authentication");

 //perform your authentication using ldap
 //the below is just for explaination

 return performAuthentication(authentication, users2);

 
 return null;
 

 private Authentication performAuthentication(Authentication authentication,List<User> users) 
 String credential = (String) authentication.getCredentials();
 String userId = authentication.getName();
 for(User user: users) 
 if(user.getUserId().equals(userId)&& user.getPassword().equals(credential)) 
 authentication = new UsernamePasswordAuthenticationToken(authentication.getPrincipal(), authentication.getCredentials(),authentication.getAuthorities());

 return authentication;
 
 
 return null;
 
 @Override
 public boolean supports(Class<?> authentication) 
 return authentication.equals(UsernamePasswordAuthenticationToken.class);
 

If you would need to redirect different login page (not sure, if you have the requirement) you register AuthenticationFailureHandler shown in security config. Here it is redirected to login and login1 based on condition.

http.failureHandler(new AuthenticationFailureHandler() 

 @Override
 public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response,
 AuthenticationException exception) throws IOException, ServletException 
 String whichPage = request.getParameter("whichPage");
 System.out.println("inside login failure handler "+whichPage);
 if("login1".equals(whichPage)) 
 response.sendRedirect(request.getContextPath() +"/login1");
 else 
 response.sendRedirect(request.getContextPath() +"/login");
 
 
 )

WebSecurityConfig.java

import java.io.IOException;


import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.springframework.beans.factory.annotation.Autowired;

import org.springframework.context.annotation.Bean;

import org.springframework.context.annotation.Configuration;

import org.springframework.security.authentication.AuthenticationManager;

import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;

import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.AuthenticationException;

import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.web.authentication.AuthenticationFailureHandler;
import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;

@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter 

 @Autowired
 private UserDetailsService userDetailsService;

 @Bean
 public BCryptPasswordEncoder bCryptPasswordEncoder() 
 return new BCryptPasswordEncoder();
 

 @Bean
 public AuthenticationManager getAuthenticationManager() throws Exception 
 return super.authenticationManagerBean();
 


 @Autowired
 AuthenticationSuccessHandler authenticationSuccessHandler;

 @Autowired()
 AuthenicationProviderJdbcImpl authenicationProviderJdbcImpl;

 @Autowired()
 AuthenicationProviderLdapImpl authenicationProviderLdapImpl;


 @Autowired
 CustomUsernamePasswordAuthenticationFilter customUsernamePasswordAuthenticationFilter;


 @Override
 protected void configure(HttpSecurity http) throws Exception 
 http.addFilterAt(customUsernamePasswordAuthenticationFilter, UsernamePasswordAuthenticationFilter.class);

 http
 .authorizeRequests()
 .antMatchers("/resources/**", "/registration","/login1").permitAll()
 .anyRequest().authenticated()
 .and()
 .formLogin()
 .loginPage("/login")
 .permitAll()//.successHandler(authenticationSuccessHandler)
 .failureHandler(new AuthenticationFailureHandler() 

 @Override
 public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response,
 AuthenticationException exception) throws IOException, ServletException 
 String whichPage = request.getParameter("whichPage");
 System.out.println("inside login failure handler "+whichPage);
 if("login1".equals(whichPage)) 
 response.sendRedirect(request.getContextPath() +"/login1");
 else 
 response.sendRedirect(request.getContextPath() +"/login");
 
 
 )
 .and()
 .logout()
 .permitAll();
 

 @Override
 protected void configure(AuthenticationManagerBuilder auth) throws Exception 
 auth.authenticationProvider(authenicationProviderLdapImpl).authenticationProvider(authenicationProviderJdbcImpl);

 



 @Autowired
 public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception 
 /*auth.userDetailsService(userDetailsService)
 .passwordEncoder(bCryptPasswordEncoder());*/

 

The below is from logs when authType = jdbc or authType=ldap

login called
2018-11-23 17:45:25.606 INFO 7232 --- [nio-8080-exec-6] stomUsernamePasswordAuthenticationFilter : authType jdbc 
2018-11-23 17:45:25.606 INFO 7232 --- [nio-8080-exec-6] c.t.a.AuthenicationProviderJdbcLdapImpl : authType jdbc
2018-11-23 17:45:25.606 INFO 7232 --- [nio-8080-exec-6] c.t.a.AuthenicationProviderJdbcLdapImpl : perfrom jdbc authentication
login called
login1 called
login1 called
2018-11-23 17:45:42.435 INFO 7232 --- [nio-8080-exec-5] stomUsernamePasswordAuthenticationFilter : authType ldap 
2018-11-23 17:45:42.435 INFO 7232 --- [nio-8080-exec-5] c.t.a.AuthenicationProviderJdbcLdapImpl : authType ldap
2018-11-23 17:45:42.435 INFO 7232 --- [nio-8080-exec-5] c.t.a.AuthenicationProviderJdbcLdapImpl : perfrom ldap authentication returning true in ldap