Spring Security Authentication

 

Authentication and Access Control

Application security boils down to two more or less independent problems: authentication (who are you?) and authorization (what are you allowed to do?). 

Sometimes people say “access control” instead of "authorization", which can get confusing, but it can be helpful to think of it that way because “authorization” is overloaded in other places. 

Spring Security has an architecture that is designed to separate authentication from authorization and has strategies and extension points for both.

Authentication

The main strategy interface for authentication is AuthenticationManager, which has only one method:

public interface AuthenticationManager {

  Authentication authenticate(Authentication authentication)
    throws AuthenticationException;
}

An AuthenticationManager can do one of 3 things in its authenticate() method:

  • Return an Authentication (normally with authenticated=true) if it can verify that the input represents a valid principal.

  • Throw an AuthenticationException if it believes that the input represents an invalid principal.

  • Return null if it cannot decide.

AuthenticationException is a runtime exception. It is usually handled by an application in a generic way, depending on the style or purpose of the application. In other words, user code is not normally expected to catch and handle it. For example, a web UI might render a page that says that the authentication failed, and a backend HTTP service might send a 401 response, with or without a WWW-Authenticate header depending on the context.

The most commonly used implementation of AuthenticationManager is ProviderManager, which delegates to a chain of AuthenticationProvider instances. An AuthenticationProvider is a bit like an AuthenticationManager, but it has an extra method to allow the caller to query whether it supports a given Authentication type:

public interface AuthenticationProvider {

	Authentication authenticate(Authentication authentication)
			throws AuthenticationException;

	boolean supports(Class<?> authentication);
}

The Class<?> argument in the supports() method is really Class<? extends Authentication> (it is only ever asked if it supports something that is passed into the authenticate() method). A ProviderManager can support multiple different authentication mechanisms in the same application by delegating to a chain of AuthenticationProviders. If a ProviderManager does not recognize a particular Authentication instance type, it is skipped.

A ProviderManager has an optional parent, which it can consult if all providers return null. If the parent is not available, a null Authentication results in an AuthenticationException.

Sometimes, an application has logical groups of protected resources (for example, all web resources that match a path pattern, such as /api/**), and each group can have its own dedicated AuthenticationManager. Often, each of those is a ProviderManager, and they share a parent. The parent is then a kind of “global” resource, acting as a fallback for all providers.


Comments

Post a Comment

Popular posts from this blog

Hibernate Many to Many Relationship

  @Entity @Table(name = "Employee") public class Employee { // ... @ManyToMany(cascade = { CascadeType.ALL }) @JoinTable( name = "Employee_Project", joinColumns = { @JoinColumn(name = "employee_id") }, inverseJoinColumns = { @JoinColumn(name = "project_id") } ) Set<Project> projects = new HashSet <>(); // standard constructor/getters/setters } @JoinTable specifies that an intermediate table is used to map the ManyToMany relationship it specifies the Join column as the id of the Employee class from which the Many side of the relationship is being created. The inverseJoinColumns attribute specifies the Join column of the target of the M2M relationship. @Entity @Table(name = "Project") public class Project { // ... @ManyToMany(mappedBy = "projects") private Set<Employee> employees = new HashSet <>(); // ...
Read more

Why Integral Calculus limit tending to infinity a sacrilege

I think that, Integral calculus tending to infinity should be discontinued in the sense of the thing that space and time are infinite and calculating the area under the entire curve is a crime.. Differntial calculus also to the limit of 0 should not be taught.. Though I feel 0 and infinity are scary concepts which may help in extending your thought, but is a big farce.. limited thought and a mix of good/bad feeling is what should be the new norm.. the distribution of the elements in space has to continue expanding and there's plenty of space available for the good souls and also on earth people should reduce the burden by living a decent baalanced life no matter if you are good or evil.. And As a schizophrenic I am looking for my medicinal cure F-20.. please excuse
Read more

Introduction

Introduction My Mother Usha Wangnoo Sharma My Father Prof.. MK Sharma My Brother Kunal Sharma young generation As a kid I was not aware about what I was studying, In fact I don't even remember me studying A,B,C at school.. I caught up with the basics in class 6 th and Then I studied grammer thorroughly. THen I don't know why I started studying science and I started enjoying enjoyed it, along with History, Geography(was my favourite area of choice) Chemistry was my second area of interest,But I think Biology was a favourite also I could draw Birds and their internal organisms very clearly, was scared to cut lizzards in the zoology class in the bio Lab. I was well aware of the human body structure but I skipped the Genital organs class due to some strange consciousness and I was ashamed. I got deep into science and used to revisit the language(English) was very weak in Sanskrit and Hindi. That's half the problem. I was often called ulti khopdi by my classmates.. In f...
Read more