Spring Security pass URL parameters to Authentication Provider

Question

Is there a way to pass URL parameters to an authentication provider in Spring Security 3?

Our login page will need to receive an email token as a parameter that the authentication system will need to be aware of when it sets the status of the user. Specifically, it will let a user with a correct token log in that would not otherwise be able to.

I have a custom class extending the DaoAuthenticationProvider class. My authentication logic is in that class's authenticate method.

I'm hoping there is some way to pass this data into the authenticate method.

Answer 1

You could inject the HttpServletRequest object on your authentication provider class:

private @Autowired HttpServletRequest request;

Now, you should be able to access the request parameters with APIs such as request.getParameterValues(paramName)

Answer 2

您需要覆盖UsernamePasswordAuthenticationFilter.setDetails()并通过UsernamePasswordAuthenticationToken details属性将额外信息传递给您的自定义身份验证提供程序。