StackOverflow2013

Note that there are some explanatory texts on larger screens.

plurals

PO
text
Body
copied!<p>I ran into this problem, and solved it using a custom implementation of the Spring Security RembereMe Service infrastructure. Here is what you need to do.</p> <ul> <li><p>Define your own Authentication object</p> <p>public class LinkAuthentication extends AbstractAuthenticationToken { @Override public Object getCredentials() { return null; }</p> <pre><code>@Override public Object getPrincipal() { return the prncipal that that is passed in via the constructor } </code></pre> <p>}</p></li> </ul> <p>Define </p> <pre><code>public class LinkRememberMeService implements RememberMeServices, LogoutHandler { /** * It might appear that once this method is called and returns an authentication object, that authentication should be finished and the * request should proceed. However, spring security does not work that way. * * Once this method returns a non null authentication object, spring security still wants to run it through its authentication provider * which, is totally brain dead on the part of Spring this, is why there is also a * LinkAuthenticationProvider * */ @Override public Authentication autoLogin(HttpServletRequest request, HttpServletResponse response) { String accessUrl = ServletUtils.getApplicationUrl(request, "/special/"); String requestUrl = request.getRequestURL().toString(); if (requestUrl.startsWith(accessUrl)) { // take appart the url extract the token, find the user details object // and return it. LinkAuthentication linkAuthentication = new LinkAuthentication(userDetailsInstance); return linkAuthentication; } else { return null; } } @Override public void loginFail(HttpServletRequest request, HttpServletResponse response) { } @Override public void loginSuccess(HttpServletRequest request, HttpServletResponse response, Authentication successfulAuthentication) { } @Override public void logout(HttpServletRequest request, HttpServletResponse response, Authentication authentication) { } } public class LinkAuthenticationProvider implements AuthenticationProvider { @Override public Authentication authenticate(Authentication authentication) throws AuthenticationException { // Spring Security is totally brain dead and over engineered return authentication; } @Override public boolean supports(Class<?> authentication) { return LinkAuthentication.class.isAssignableFrom(authentication); } } </code></pre> <p>Hack up the rest rest of your spring security xml to define a custom authentication provider, and the custom remember me service. </p> <p>P.S. if you do base64 encoding of the GUID in your URL it will be a few characters shorter. You can use the Apache commons codec base64 binary encoder / decoder to do safer url links.</p> <pre><code>public static String toBase64Url(UUID uuid) { return Base64.encodeBase64URLSafeString(toBytes(uuid)); } </code></pre>

Querying!

Guidance

An individual column

Larger individual text columns get their own page to allow for proper reading.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload