\r\nimport org.springframework.beans.factory.annotation.Value;\r\nimport org.springframework.security.web.authentication.preauth.AbstractPreAuthenticatedProcessingFilter;\r\n\r\npublic class LtpaPreAuthenticatedFilter extends AbstractPreAuthenticatedProcessingFilter {\r\n\r\n @Value(\"${ltpa.secret}\")\r\n private String ltpaSecret;\r\n\r\n @Value(\"${ltpa.cookieName}\")\r\n private String ltpaCookieName;\r\n\r\n @Override\r\n protected Object getPreAuthenticatedPrincipal(HttpServletRequest request) {\r\n\r\n Cookie[] cookies = request.getCookies();\r\n if( cookies == null ) {\r\n return null;\r\n }\r\n\r\n for( int i= 0; i<cookies.length ; i++ ){\r\n String name = cookies[i].getName();\r\n String value = cookies[i].getValue();\r\n\r\n if( ltpaCookieName.equalsIgnoreCase(name) ){\r\n DominoLtpaToken ltpaToken = new DominoLtpaToken( value, ltpaSecret );\r\n\r\n if( ltpaToken.isValid() ){\r\n return ltpaToken.getDistinguishedName();\r\n }\r\n }\r\n }\r\n\r\n return null;\r\n }\r\n\r\n @Override\r\n protected Object getPreAuthenticatedCredentials(HttpServletRequest request) {\r\n \/\/ is required to return an empty string\r\n return \"\";\r\n }\r\n\r\n}\r\n<\/code><\/pre>\nThe filter implements two methods, one for extraction of the principal, and the other for the credentials (which we don’t have with LTPA tokens). In the getPreAuthenticatedPrincipal<\/i> method, existinig LTPA tokens are searched, then the user extracted and the token validated.<\/p>\n
The secret of the LTPA token and the name are stored in application.properties:<\/em><\/p>\n![\"\"](\"https:\/\/hasselba.ch\/blog\/wp-content\/uploads\/2018\/07\/Greenshot-2018-07-30-12.37.59.png\")
<\/a><\/p>\n![\"\"](\"https:\/\/hasselba.ch\/blog\/wp-content\/uploads\/2018\/07\/application.properties.png\")
<\/a><\/p>\nThe second part is implementing a AuthenticationUserDetailsService. This service is for getting additional details for the authenticated user, for example the ACL roles or groups the user belongs to.<\/p>\n
import java.util.Collection;\r\nimport java.util.HashSet;\r\n\r\nimport org.springframework.security.core.GrantedAuthority;\r\nimport org.springframework.security.core.userdetails.AuthenticationUserDetailsService;\r\nimport org.springframework.security.core.userdetails.User;\r\nimport org.springframework.security.core.userdetails.UserDetails;\r\nimport org.springframework.security.core.userdetails.UsernameNotFoundException;\r\nimport org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationToken;\r\n\r\npublic class LtpaUserDetailsService implements AuthenticationUserDetailsService<PreAuthenticatedAuthenticationToken> {\r\n\r\n @Override\r\n public UserDetails loadUserDetails(PreAuthenticatedAuthenticationToken token)\r\n throws UsernameNotFoundException {\r\n\r\n String userName=(String)token.getPrincipal();\r\n\r\n Collection<GrantedAuthority> authorities = new HashSet<GrantedAuthority>() ;\r\n authorities.add(new LtpaUserAuthority());\r\n\r\n User user = new User(userName,\"\",authorities);\r\n\r\n return user;\r\n }\r\n\r\n}<\/code><\/pre>\nIn our case, we are just adding an LtpaUserAuthority<\/em> to the user information. Don’t worry about the usage of the LtpaUserAuthority<\/em>. We come back to this in another post.<\/p>\nimport org.springframework.security.core.GrantedAuthority;\r\n\r\npublic class LtpaUserAuthority implements GrantedAuthority {\r\n\r\n private static final long serialVersionUID = 1L;\r\n\r\n @Override\r\n public String getAuthority() {\r\n return \"ROLE_USER_LTPA\";\r\n }\r\n\r\n}<\/code><\/pre>\nIn the last step we have to update the SecurityConfig.java <\/em>to activate the filter:<\/p>\n@EnableWebSecurity\r\npublic class SecurityConfig extends WebSecurityConfigurerAdapter {\r\n\r\n @Configuration\r\n @Order(1)\r\n static class DominoLtpaSecurityConfigurerAdapter extends WebSecurityConfigurerAdapter {\r\n\r\n @Bean\r\n public AuthenticationUserDetailsService<PreAuthenticatedAuthenticationToken> authenticationUserDetailsService() {\r\n return new LtpaUserDetailsService();\r\n }\r\n\r\n @Bean\r\n public PreAuthenticatedAuthenticationProvider preAuthenticatedAuthenticationProvider() {\r\n PreAuthenticatedAuthenticationProvider provider = new PreAuthenticatedAuthenticationProvider();\r\n\r\n provider.setPreAuthenticatedUserDetailsService(authenticationUserDetailsService());\r\n provider.setUserDetailsChecker(new AccountStatusUserDetailsChecker());\r\n\r\n return provider;\r\n }\r\n\r\n @Override\r\n protected void configure(AuthenticationManagerBuilder auth) throws Exception {\r\n auth.authenticationProvider(preAuthenticatedAuthenticationProvider());\r\n }\r\n\r\n @Bean\r\n public AbstractPreAuthenticatedProcessingFilter preAuthenticatedProcessingFilter() throws Exception {\r\n LtpaPreAuthenticatedFilter filter = new LtpaPreAuthenticatedFilter();\r\n filter.setAuthenticationManager(authenticationManager());\r\n return filter;\r\n }\r\n\r\n @Override\r\n protected void configure(HttpSecurity http) throws Exception {\r\n http.addFilter(preAuthenticatedProcessingFilter())\r\n .authorizeRequests()\r\n .antMatchers(\"\/**\").permitAll() ;\r\n }\r\n }\r\n ...\r\n}<\/code><\/pre>\nThis includes the filter in any request. Now, the Principal contains the user name stored in the LTPA token.<\/p>\n","protected":false},"excerpt":{"rendered":"
To integrate the new HTTP stack into the existing environment, we can use LTPA tokens. These tokens are cookies which store the authentication information and allow to share them betweeen different participating Domino servers. A users must log on only … Weiterlesen