Class AbstractAuthenticationFilterConfigurer<B extends HttpSecurityBuilder<B>,T extends AbstractAuthenticationFilterConfigurer<B,T,F>,F extends AbstractAuthenticationProcessingFilter>
java.lang.Object
org.springframework.security.config.annotation.SecurityConfigurerAdapter<DefaultSecurityFilterChain,B>
org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer<T,B>
org.springframework.security.config.annotation.web.configurers.AbstractAuthenticationFilterConfigurer<B,T,F>
- Type Parameters:
T
- refers to "this" for returning the current configurerF
- refers to theAbstractAuthenticationProcessingFilter
that is being built
- All Implemented Interfaces:
SecurityConfigurer<DefaultSecurityFilterChain,
B>
- Direct Known Subclasses:
FormLoginConfigurer
,OAuth2LoginConfigurer
,Saml2LoginConfigurer
public abstract class AbstractAuthenticationFilterConfigurer<B extends HttpSecurityBuilder<B>,T extends AbstractAuthenticationFilterConfigurer<B,T,F>,F extends AbstractAuthenticationProcessingFilter>
extends AbstractHttpConfigurer<T,B>
Base class for configuring
AbstractAuthenticationFilterConfigurer
. This is
intended for internal use only.- Since:
- 3.2
- See Also:
-
Constructor Summary
ConstructorsModifierConstructorDescriptionprotected
Creates a new instance with minimal defaultsprotected
AbstractAuthenticationFilterConfigurer
(F authenticationFilter, String defaultLoginProcessingUrl) Creates a new instance -
Method Summary
Modifier and TypeMethodDescriptionfinal T
authenticationDetailsSource
(AuthenticationDetailsSource<jakarta.servlet.http.HttpServletRequest, ?> authenticationDetailsSource) Specifies a customAuthenticationDetailsSource
.void
Configure theSecurityBuilder
by setting the necessary properties on theSecurityBuilder
.protected abstract RequestMatcher
createLoginProcessingUrlMatcher
(String loginProcessingUrl) Create theRequestMatcher
given a loginProcessingUrlfinal T
defaultSuccessUrl
(String defaultSuccessUrl) Specifies where users will be redirected after authenticating successfully if they have not visited a secured page prior to authenticating.final T
defaultSuccessUrl
(String defaultSuccessUrl, boolean alwaysUse) Specifies where users will be redirected after authenticating successfully if they have not visited a secured page prior to authenticating oralwaysUse
is true.final T
failureHandler
(AuthenticationFailureHandler authenticationFailureHandler) Specifies theAuthenticationFailureHandler
to use when authentication fails.final T
failureUrl
(String authenticationFailureUrl) The URL to send users if authentication fails.protected final AuthenticationEntryPoint
Gets the Authentication Entry Pointprotected final RequestMatcher
protected final F
Gets the Authentication Filterprotected final String
Gets the URL to send users to if authentication failsprotected final String
Gets the login pageprotected final String
Gets the URL to submit an authentication request to (i.e.void
Initialize theSecurityBuilder
.final boolean
protected T
Specifies the URL to send users to if login is required.loginProcessingUrl
(String loginProcessingUrl) Specifies the URL to validate the credentials.final T
Equivalent of invoking permitAll(true)final T
permitAll
(boolean permitAll) Ensures the urls forfailureUrl(String)
as well as for theHttpSecurityBuilder
, thegetLoginPage()
andgetLoginProcessingUrl()
are granted access to any user.protected final void
registerAuthenticationEntryPoint
(B http, AuthenticationEntryPoint authenticationEntryPoint) protected final void
securityContextRepository
(SecurityContextRepository securityContextRepository) protected final void
setAuthenticationFilter
(F authFilter) Sets the Authentication Filterfinal T
successHandler
(AuthenticationSuccessHandler successHandler) Specifies theAuthenticationSuccessHandler
to be used.protected final void
updateAccessDefaults
(B http) Updates the default values for access.protected final void
Updates the default values for authentication.Methods inherited from class org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer
disable, getSecurityContextHolderStrategy, withObjectPostProcessor, withObjectPostProcessor
Methods inherited from class org.springframework.security.config.annotation.SecurityConfigurerAdapter
addObjectPostProcessor, addObjectPostProcessor, and, getBuilder, postProcess, setBuilder
-
Constructor Details
-
AbstractAuthenticationFilterConfigurer
protected AbstractAuthenticationFilterConfigurer()Creates a new instance with minimal defaults -
AbstractAuthenticationFilterConfigurer
protected AbstractAuthenticationFilterConfigurer(F authenticationFilter, String defaultLoginProcessingUrl) Creates a new instance- Parameters:
authenticationFilter
- theAbstractAuthenticationProcessingFilter
to usedefaultLoginProcessingUrl
- the default URL to use forloginProcessingUrl(String)
-
-
Method Details
-
defaultSuccessUrl
Specifies where users will be redirected after authenticating successfully if they have not visited a secured page prior to authenticating. This is a shortcut for callingdefaultSuccessUrl(String, boolean)
.- Parameters:
defaultSuccessUrl
- the default success url- Returns:
- the
FormLoginConfigurer
for additional customization
-
defaultSuccessUrl
Specifies where users will be redirected after authenticating successfully if they have not visited a secured page prior to authenticating oralwaysUse
is true. This is a shortcut for callingsuccessHandler(AuthenticationSuccessHandler)
.- Parameters:
defaultSuccessUrl
- the default success urlalwaysUse
- true if thedefaultSuccessUrl
should be used after authentication despite if a protected page had been previously visited- Returns:
- the
FormLoginConfigurer
for additional customization
-
loginProcessingUrl
Specifies the URL to validate the credentials.- Parameters:
loginProcessingUrl
- the URL to validate username and password- Returns:
- the
FormLoginConfigurer
for additional customization
-
securityContextRepository
-
createLoginProcessingUrlMatcher
Create theRequestMatcher
given a loginProcessingUrl- Parameters:
loginProcessingUrl
- creates theRequestMatcher
based upon the loginProcessingUrl- Returns:
- the
RequestMatcher
to use based upon the loginProcessingUrl
-
authenticationDetailsSource
public final T authenticationDetailsSource(AuthenticationDetailsSource<jakarta.servlet.http.HttpServletRequest, ?> authenticationDetailsSource) Specifies a customAuthenticationDetailsSource
. The default isWebAuthenticationDetailsSource
.- Parameters:
authenticationDetailsSource
- the customAuthenticationDetailsSource
- Returns:
- the
FormLoginConfigurer
for additional customization
-
successHandler
Specifies theAuthenticationSuccessHandler
to be used. The default isSavedRequestAwareAuthenticationSuccessHandler
with no additional properties set.- Parameters:
successHandler
- theAuthenticationSuccessHandler
.- Returns:
- the
FormLoginConfigurer
for additional customization
-
permitAll
Equivalent of invoking permitAll(true)- Returns:
- the
FormLoginConfigurer
for additional customization
-
permitAll
Ensures the urls forfailureUrl(String)
as well as for theHttpSecurityBuilder
, thegetLoginPage()
andgetLoginProcessingUrl()
are granted access to any user.- Parameters:
permitAll
- true to grant access to the URLs false to skip this step- Returns:
- the
FormLoginConfigurer
for additional customization
-
failureUrl
The URL to send users if authentication fails. This is a shortcut for invokingfailureHandler(AuthenticationFailureHandler)
. The default is "/login?error".- Parameters:
authenticationFailureUrl
- the URL to send users if authentication fails (i.e. "/login?error").- Returns:
- the
FormLoginConfigurer
for additional customization
-
failureHandler
Specifies theAuthenticationFailureHandler
to use when authentication fails. The default is redirecting to "/login?error" usingSimpleUrlAuthenticationFailureHandler
- Parameters:
authenticationFailureHandler
- theAuthenticationFailureHandler
to use when authentication fails.- Returns:
- the
FormLoginConfigurer
for additional customization
-
init
Description copied from interface:SecurityConfigurer
Initialize theSecurityBuilder
. Here only shared state should be created and modified, but not properties on theSecurityBuilder
used for building the object. This ensures that theSecurityConfigurer.configure(SecurityBuilder)
method uses the correct shared objects when building. Configurers should be applied here.- Specified by:
init
in interfaceSecurityConfigurer<B extends HttpSecurityBuilder<B>,
T extends AbstractAuthenticationFilterConfigurer<B, T, F>> - Overrides:
init
in classSecurityConfigurerAdapter<DefaultSecurityFilterChain,
B extends HttpSecurityBuilder<B>> - Throws:
Exception
-
registerDefaultAuthenticationEntryPoint
-
registerAuthenticationEntryPoint
protected final void registerAuthenticationEntryPoint(B http, AuthenticationEntryPoint authenticationEntryPoint) -
getAuthenticationEntryPointMatcher
-
configure
Description copied from interface:SecurityConfigurer
Configure theSecurityBuilder
by setting the necessary properties on theSecurityBuilder
.- Specified by:
configure
in interfaceSecurityConfigurer<B extends HttpSecurityBuilder<B>,
T extends AbstractAuthenticationFilterConfigurer<B, T, F>> - Overrides:
configure
in classSecurityConfigurerAdapter<DefaultSecurityFilterChain,
B extends HttpSecurityBuilder<B>> - Throws:
Exception
-
loginPage
Specifies the URL to send users to if login is required. If used with
EnableWebSecurity
a default login page will be generated when this attribute is not specified.If a URL is specified or this is not being used in conjunction with
EnableWebSecurity
, users are required to process the specified URL to generate a login page. -
isCustomLoginPage
public final boolean isCustomLoginPage()- Returns:
- true if a custom login page has been specified, else false
-
getAuthenticationFilter
Gets the Authentication Filter- Returns:
- the Authentication Filter
-
setAuthenticationFilter
Sets the Authentication Filter- Parameters:
authFilter
- the Authentication Filter
-
getLoginPage
Gets the login page- Returns:
- the login page
-
getAuthenticationEntryPoint
Gets the Authentication Entry Point- Returns:
- the Authentication Entry Point
-
getLoginProcessingUrl
Gets the URL to submit an authentication request to (i.e. where username/password must be submitted)- Returns:
- the URL to submit an authentication request to
-
getFailureUrl
Gets the URL to send users to if authentication fails- Returns:
- the URL to send users if authentication fails (e.g. "/login?error").
-
updateAuthenticationDefaults
protected final void updateAuthenticationDefaults()Updates the default values for authentication. -
updateAccessDefaults
Updates the default values for access.
-