Part 3 : Three main pillars in the Spring Security Authentication Mechanism–AuthenticationProvider

AuthenticationProvider

Interface AuthenticationProvider  indicates a class can process a specific Authenticatiom implementation like LDAP, databases,SSO etc.
From the docs
“The default implementation in Spring Security is called ProviderManager and rather than handling the authentication request itself, it delegates to a list of configured AuthenticationProviders, each of which is queried n turn to see if it can perform the authentication. Each provider will either throw an exception or return a fully populated Authentication object.”
When we write:

1. <authentication-provider>
2. <user-service>
3. <user authorities=”ROLE_USER” name=”guest” password=”guest” />
4. </authentication-provider>

In the spring security config file, a InMemoryDaoImpl implementation of theUserDetailService is configured by Spring security.

The authenticate() method of the class implementing AuthenticationProvider must return an UsernamePasswordAuthenticationToken instance if the authentication is successful, if not it will return null.
For custom authentication provider we need to provide a similar entry in the security-config.xml

1. <authentication-manager>
2. <authentication-provider ref=”myAthenticationProvider”/>
3. </authentication-manager>

And the template for the Provider class will be like below:

1. Public class MyAuthenticationProvider implements AuthenticationProvider {
2. @Override
3. Public Authentication authenticate(Authentication authentication) throws AuthenticationException{
4. //get crediantials from the authentication
5. //check them for validity and assign grantedauths
6. //return Authentication or null
7. }
8. @Override
9. Public Boolean supports(Class<?> authentication){
10. //code to return whether the authentication type is supported
11. }

This is all you need usually to provide a custom provider to check on the supplied credentials of the user in Spring Security.