Package org.springframework.security.config.annotation.web.configurers

Class AbstractAuthenticationFilterConfigurer<B extends HttpSecurityBuilder<B>,T extends AbstractAuthenticationFilterConfigurer<B,T,F>,F extends AbstractAuthenticationProcessingFilter>

java.lang.Object

org.springframework.security.config.annotation.SecurityConfigurerAdapter<DefaultSecurityFilterChain,B>

org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer<T,B>

org.springframework.security.config.annotation.web.configurers.AbstractAuthenticationFilterConfigurer<B,T,F>

Type Parameters:

T - refers to "this" for returning the current configurer

F - refers to the AbstractAuthenticationProcessingFilter that is being built

All Implemented Interfaces:

SecurityConfigurer<DefaultSecurityFilterChain,B>

Direct Known Subclasses:

FormLoginConfigurer, OAuth2LoginConfigurer, OneTimeTokenLoginConfigurer, Saml2LoginConfigurer

public abstract class AbstractAuthenticationFilterConfigurer<B extends HttpSecurityBuilder<B>,T extends AbstractAuthenticationFilterConfigurer<B,T,F>,F extends AbstractAuthenticationProcessingFilter>
extends AbstractHttpConfigurer<T,B>

Base class for configuring AbstractAuthenticationFilterConfigurer. This is intended for internal use only.

Since:

3.2

See Also:

• FormLoginConfigurer

Constructor Summary

Constructors

Modifier	Constructor	Description
protected	AbstractAuthenticationFilterConfigurer()	Creates a new instance with minimal defaults.
protected	AbstractAuthenticationFilterConfigurer(F authenticationFilter, String defaultLoginProcessingUrl)	Creates a new instance.

Method Summary

Modifier and Type	Method	Description
final T	authenticationDetailsSource(AuthenticationDetailsSource<jakarta.servlet.http.HttpServletRequest,?> authenticationDetailsSource)	Specifies a custom AuthenticationDetailsSource.
void	configure(B http)	Configure the SecurityBuilder by setting the necessary properties on the SecurityBuilder.
protected abstract RequestMatcher	createLoginProcessingUrlMatcher(String loginProcessingUrl)	Create the RequestMatcher given a loginProcessingUrl.
final T	defaultSuccessUrl(String defaultSuccessUrl)	Specifies where users will be redirected after authenticating successfully if they have not visited a secured page prior to authenticating.
final T	defaultSuccessUrl(String defaultSuccessUrl, boolean alwaysUse)	Specifies where users will be redirected after authenticating successfully if they have not visited a secured page prior to authenticating or alwaysUse is true.
final T	failureHandler(AuthenticationFailureHandler authenticationFailureHandler)	Specifies the AuthenticationFailureHandler to use when authentication fails.
final T	failureUrl(String authenticationFailureUrl)	The URL to send users if authentication fails.
protected final AuthenticationEntryPoint	getAuthenticationEntryPoint()	Gets the Authentication Entry Point.
protected final RequestMatcher	getAuthenticationEntryPointMatcher(B http)
protected final F	getAuthenticationFilter()	Gets the Authentication Filter.
protected final String	getFailureUrl()	Gets the URL to send users to if authentication fails.
protected final String	getLoginPage()	Gets the login page.
protected final String	getLoginProcessingUrl()	Gets the URL to submit an authentication request to (i.e.
void	init(B http)	Initialize the SecurityBuilder.
final boolean	isCustomLoginPage()	Returns true if a custom login page has been specified.
protected T	loginPage(String loginPage)	Specifies the URL to send users to if login is required.
T	loginProcessingUrl(String loginProcessingUrl)	Specifies the URL to validate the credentials.
final T	permitAll()	Equivalent of invoking permitAll(true).
final T	permitAll(boolean permitAll)	Ensures the urls for failureUrl(String) as well as for the HttpSecurityBuilder, the getLoginPage() and getLoginProcessingUrl() are granted access to any user.
protected final void	registerAuthenticationEntryPoint(B http, AuthenticationEntryPoint authenticationEntryPoint)
protected final void	registerDefaultAuthenticationEntryPoint(B http)
T	securityContextRepository(SecurityContextRepository securityContextRepository)
protected final void	setAuthenticationFilter(F authFilter)	Sets the Authentication Filter.
final T	successHandler(AuthenticationSuccessHandler successHandler)	Specifies the AuthenticationSuccessHandler to be used.
protected final void	updateAccessDefaults(B http)	Updates the default values for access.
protected final void	updateAuthenticationDefaults()	Updates the default values for authentication.

Methods inherited from class org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer

disable, getRequestMatcherBuilder, getSecurityContextHolderStrategy, withObjectPostProcessor

Methods inherited from class org.springframework.security.config.annotation.SecurityConfigurerAdapter

addObjectPostProcessor, getBuilder, postProcess, setBuilder

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

AbstractAuthenticationFilterConfigurer

protected AbstractAuthenticationFilterConfigurer()

Creates a new instance with minimal defaults.

AbstractAuthenticationFilterConfigurer

protected AbstractAuthenticationFilterConfigurer(F authenticationFilter,
 String defaultLoginProcessingUrl)

Creates a new instance.

Parameters:

authenticationFilter - the AbstractAuthenticationProcessingFilter to use

defaultLoginProcessingUrl - the default URL to use for loginProcessingUrl(String)

Method Details

defaultSuccessUrl

public final T defaultSuccessUrl(String defaultSuccessUrl)

Specifies where users will be redirected after authenticating successfully if they have not visited a secured page prior to authenticating. This is a shortcut for calling defaultSuccessUrl(String, boolean).

Parameters:

defaultSuccessUrl - the default success url

Returns:

the FormLoginConfigurer for additional customization

defaultSuccessUrl

public final T defaultSuccessUrl(String defaultSuccessUrl,
 boolean alwaysUse)

Specifies where users will be redirected after authenticating successfully if they have not visited a secured page prior to authenticating or alwaysUse is true. This is a shortcut for calling successHandler(AuthenticationSuccessHandler).

Parameters:

defaultSuccessUrl - the default success url

alwaysUse - true if the defaultSuccessUrl should be used after authentication despite if a protected page had been previously visited

Returns:

the FormLoginConfigurer for additional customization

loginProcessingUrl

public T loginProcessingUrl(String loginProcessingUrl)

Specifies the URL to validate the credentials.

Parameters:

loginProcessingUrl - the URL to validate username and password

Returns:

the FormLoginConfigurer for additional customization

securityContextRepository

public T securityContextRepository(SecurityContextRepository securityContextRepository)

createLoginProcessingUrlMatcher

protected abstract RequestMatcher createLoginProcessingUrlMatcher(String loginProcessingUrl)

Create the RequestMatcher given a loginProcessingUrl.

Parameters:

loginProcessingUrl - creates the RequestMatcher based upon the loginProcessingUrl

Returns:

the RequestMatcher to use based upon the loginProcessingUrl

authenticationDetailsSource

public final T authenticationDetailsSource(AuthenticationDetailsSource<jakarta.servlet.http.HttpServletRequest,?> authenticationDetailsSource)

Specifies a custom AuthenticationDetailsSource. The default is WebAuthenticationDetailsSource.

Parameters:

authenticationDetailsSource - the custom AuthenticationDetailsSource

Returns:

the FormLoginConfigurer for additional customization

successHandler

public final T successHandler(AuthenticationSuccessHandler successHandler)

Specifies the AuthenticationSuccessHandler to be used. The default is SavedRequestAwareAuthenticationSuccessHandler with no additional properties set.

Parameters:

successHandler - the AuthenticationSuccessHandler.

Returns:

the FormLoginConfigurer for additional customization

permitAll

public final T permitAll()

Equivalent of invoking permitAll(true).

Returns:

the FormLoginConfigurer for additional customization

permitAll

public final T permitAll(boolean permitAll)

Ensures the urls for failureUrl(String) as well as for the HttpSecurityBuilder, the getLoginPage() and getLoginProcessingUrl() are granted access to any user.

Parameters:

permitAll - true to grant access to the URLs false to skip this step

Returns:

the FormLoginConfigurer for additional customization

failureUrl

public final T failureUrl(String authenticationFailureUrl)

The URL to send users if authentication fails. This is a shortcut for invoking failureHandler(AuthenticationFailureHandler). The default is "/login?error".

Parameters:

authenticationFailureUrl - the URL to send users if authentication fails (i.e. "/login?error").

Returns:

the FormLoginConfigurer for additional customization

failureHandler

public final T failureHandler(AuthenticationFailureHandler authenticationFailureHandler)

Specifies the AuthenticationFailureHandler to use when authentication fails. The default is redirecting to "/login?error" using SimpleUrlAuthenticationFailureHandler

Parameters:

authenticationFailureHandler - the AuthenticationFailureHandler to use when authentication fails.

Returns:

the FormLoginConfigurer for additional customization

init

public void init(B http)

Description copied from interface: SecurityConfigurer

Initialize the SecurityBuilder. Here only shared state should be created and modified, but not properties on the SecurityBuilder used for building the object. This ensures that the SecurityConfigurer.configure(SecurityBuilder) method uses the correct shared objects when building. Configurers should be applied here.

Specified by:

init in interface SecurityConfigurer<B extends HttpSecurityBuilder<B>,T extends AbstractAuthenticationFilterConfigurer<B,T,F>>

Overrides:

init in class SecurityConfigurerAdapter<DefaultSecurityFilterChain,B extends HttpSecurityBuilder<B>>

registerDefaultAuthenticationEntryPoint

protected final void registerDefaultAuthenticationEntryPoint(B http)

registerAuthenticationEntryPoint

protected final void registerAuthenticationEntryPoint(B http,
 AuthenticationEntryPoint authenticationEntryPoint)

getAuthenticationEntryPointMatcher

protected final RequestMatcher getAuthenticationEntryPointMatcher(B http)

configure

public void configure(B http)

Description copied from interface: SecurityConfigurer

Configure the SecurityBuilder by setting the necessary properties on the SecurityBuilder.

Specified by:

configure in interface SecurityConfigurer<B extends HttpSecurityBuilder<B>,T extends AbstractAuthenticationFilterConfigurer<B,T,F>>

Overrides:

configure in class SecurityConfigurerAdapter<DefaultSecurityFilterChain,B extends HttpSecurityBuilder<B>>

loginPage

protected T loginPage(String loginPage)

Specifies the URL to send users to if login is required. If used with EnableWebSecurity a default login page will be generated when this attribute is not specified.

If a URL is specified or this is not being used in conjunction with EnableWebSecurity, users are required to process the specified URL to generate a login page.

isCustomLoginPage

public final boolean isCustomLoginPage()

Returns true if a custom login page has been specified.

Returns:

true if a custom login page has been specified, else false

getAuthenticationFilter

protected final F getAuthenticationFilter()

Gets the Authentication Filter.

Returns:

the Authentication Filter

setAuthenticationFilter

protected final void setAuthenticationFilter(F authFilter)

Sets the Authentication Filter.

Parameters:

authFilter - the Authentication Filter

getLoginPage

protected final String getLoginPage()

Gets the login page.

Returns:

the login page

getAuthenticationEntryPoint

protected final AuthenticationEntryPoint getAuthenticationEntryPoint()

Gets the Authentication Entry Point.

Returns:

the Authentication Entry Point

getLoginProcessingUrl

protected final String getLoginProcessingUrl()

Gets the URL to submit an authentication request to (i.e. where username/password must be submitted)

Returns:

the URL to submit an authentication request to

getFailureUrl

protected final String getFailureUrl()

Gets the URL to send users to if authentication fails.

Returns:

the URL to send users if authentication fails (e.g. "/login?error").

updateAuthenticationDefaults

protected final void updateAuthenticationDefaults()

Updates the default values for authentication.

updateAccessDefaults

protected final void updateAccessDefaults(B http)

Updates the default values for access.