满足此要求的Spring Security最佳实践

Question

Current Spring app requires to add additional authentication checking from a POJO library. The POJO library includes several customized authentication module to choose. Some can be quite simple, like check the username and encrypted password within a URL from database, or from a file, others can be LDAP authentication or Web Service authenticate.

The tricky part is current application has its own authentication method within security.xml, and we don't want to compromise either one.

My goal is make this work based on minimal change.

I think there might be several solutions for this but trying to get a good practice:

1. Customize a Spring authentication provider to handle the pojo authentication for the authentication manager
2. Customize a Spring pre-authentication (or something alike) bean for pojo and let app security do the next.
3. Extends a filter class and register in web.xml , so this can make minimal change to the existing spring security context, but I am not sure how to make this handle the LDAP and WS authentication.

and many other options if anyone can give a better hint. Thanks in advance.

Answer 1

Create a custom Spring Authentication manager that extends the one that already exists. Call super.authenticate() and if that goes through then add the extra authentication logic.