如何通过类实现自动连接SecurityContextRepository

Question

I'm trying to do an Ajax login with a code i taked overthere, this is:

@Controller
@RequestMapping("/login")

public class AjaxLoginController {

@Autowired
@Qualifier("AuthenticationManager")
AuthenticationManager authenticationManager;

@Autowired
SecurityContextRepository repository;

@Autowired
RememberMeServices rememberMeServices;

@RequestMapping(method=RequestMethod.GET)
public void login() {}

@RequestMapping(method=RequestMethod.POST)
@ResponseBody
public String performLogin(
    @RequestParam("j_username") String username, 
    @RequestParam("j_password") String password,
    HttpServletRequest request, HttpServletResponse response) 
{
    UsernamePasswordAuthenticationToken token = 
            new UsernamePasswordAuthenticationToken(username, password);
    try {
            Authentication auth = authenticationManager.authenticate(token);
            SecurityContextHolder.getContext().setAuthentication(auth);
            repository.saveContext(SecurityContextHolder.getContext(), request, response);
            rememberMeServices.loginSuccess(request, response, auth);
            return "{\"status\": true}";
    } catch (BadCredentialsException ex) {
            return "{\"status\": false, \"error\": \"Bad Credentials\"}";
    }
}
}

This example have an xml configuration of beans for the autowire, but my project requires to do it by class configuration. I solved the first autowire issue adding this to my security class configuration:

@Bean
public AuthenticationManager AuthenticationManager() throws Exception {
    return authenticationManager();
}

Now i'm trying to do the something with the securityContextRepository but all that i find on forums are xml configurations solutions. Anyone knows how configure this class as Bean to solve this? Thx.

Answer 1

HttpSessionSecurityContextRepository is the default implementation for SecurityContextRepository . Add this to the configuration:

@Bean
public SecurityContextRepository securityContextRepository() {
    return new HttpSessionSecurityContextRepository();
}

Note that the name of the bean is securityContextRepository and not repository which, I think, reduces any possible ambiguity.