passing password through spring security to dao object

Question

I am creating an application using struts2 and spring security and have few problems/questions.

1. How can I pass to DAO the password in order to compare the password and username with results from DB? I understand that the username can be passed by implementing the UserDetailsService and overriding the method

   public UserDetails loadUserByUsername(String username)

2. The second question is that I got null object from invoking the method SecurityContextHolder.getContext().getAuthentication() in overriden loadUserByUsername(). Why is that? And again - how can I get the password that the users will fill in the j_password field.

Below is my code:

web.xml

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://java.sun.com/xml/ns/javaee" xmlns:web="http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd" version="2.5">
    <display-name>Frontend</display-name>

<!-- context param to load at startup -->
    <context-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>classpath:applicationContext.xml</param-value>
    </context-param>
    <context-param>
        <param-name>org.apache.tiles.impl.BasicTilesContainer.DEFINITIONS_CONFIG</param-name>
        <param-value>/WEB-INF/configs/tiles-resources.xml</param-value>
  </context-param>

  <!-- filters -->

    <!-- ============ Spring Security Filter ============= -->
    <filter>
        <filter-name>springSecurityFilterChain</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    </filter>
    <filter-mapping>
      <filter-name>springSecurityFilterChain</filter-name>
      <url-pattern>/*</url-pattern>
    </filter-mapping>

    <!-- struts2 filter -->      
  <filter>
    <filter-name>struts2</filter-name>
    <filter-class>org.apache.struts2.dispatcher.ng.filter.StrutsPrepareAndExecuteFilter</filter-class>
    <init-param>
            <param-name>actionPackages</param-name>
            <param-value>fe.web.actions</param-value>
    </init-param>
  </filter>
   <filter-mapping>
        <filter-name>struts2</filter-name>
        <url-pattern>/*</url-pattern>
  </filter-mapping>

  <!-- listeners -->
  <listener>
    <listener-class>org.springframework.web.context.request.RequestContextListener</listener-class>
  </listener>
  <listener>
    <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
  </listener>
 <listener>
    <listener-class>org.apache.tiles.web.startup.TilesListener</listener-class>
  </listener>
  <listener>
    <listener-class> org.springframework.security.web.session.HttpSessionEventPublisher</listener-class>
  </listener>
</web-app>

spring-security.xml

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xmlns:lang="http://www.springframework.org/schema/lang"
       xmlns:context="http://www.springframework.org/schema/context"
       xmlns:tx="http://www.springframework.org/schema/tx"
       xmlns:sec="http://www.springframework.org/schema/security" 
       xsi:schemaLocation="http://www.springframework.org/schema/beans 
        http://www.springframework.org/schema/beans/spring-beans-3.2.xsd
        http://www.springframework.org/schema/context 
        http://www.springframework.org/schema/context/spring-context-3.2.xsd
        http://www.springframework.org/schema/tx 
        http://www.springframework.org/schema/tx/spring-tx-3.2.xsd
        http://www.springframework.org/schema/security 
        http://www.springframework.org/schema/security/spring-security-3.2.xsd">

       <sec:global-method-security secured-annotations="enabled" />

       <sec:http auto-config="true">
            <sec:intercept-url pattern="/**" access="ROLE_USER" />          
       </sec:http>

       <sec:authentication-manager>
            <sec:authentication-provider user-service-ref="UserAuthenticator">
                <sec:password-encoder hash="bcrypt" />
            </sec:authentication-provider>                  
        </sec:authentication-manager>       

        <bean id="UserAuthenticator" class="fe.security.UserAuthenticator"> 
        </bean>

</beans>

UserAuthenticator

package fe.security;

import java.util.Collection;

import org.springframework.security.core.Authentication;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.context.SecurityContext;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;

public class UserAuthenticator implements UserDetailsService{

    @Override
    public UserDetails loadUserByUsername(String username)
            throws UsernameNotFoundException {

        System.out.println(username);
        SecurityContext con = SecurityContextHolder.getContext();
        Authentication auth = con.getAuthentication(); //--the authentication object here is NULL

        String credentials = (String) auth.getCredentials();
        System.out.println("Username=" + username);
        System.out.println("pass=" + credentials);
        return null;
    }


}

Thanks in advance!

================================================================================

As I don't have enough reputation, here is the solution:

Ok, after carefully reading the Spring Security reference documentation I understand.

The thing is that Spring Security compares username and password from UserDetails returned from function UserDetailsService.loadUserByUsername with j_username and j_password field. It means that the DAO object should return the UserDetails with set fields username and password.

The answer to question about nullable SecurityContextHolder.getContext().getAuthentication() is that after successful authentication the SecurityContextHolder.getContext().getAuthentication() should return not-nullable object.

Regards

Answer 1

Ok, after carefully reading the Spring Security reference documentation I understand.

The thing is that Spring Security compares username and password from UserDetails returned from function UserDetailsService.loadUserByUsername with j_username and j_password field. It means that the DAO object should return the UserDetails with set fields username and password.

The answer to question about nullable SecurityContextHolder.getContext().getAuthentication() is that after successful authentication the SecurityContextHolder.getContext().getAuthentication() should return not-nullable object.

Regards