Spring Security 6 CustomAuthenticationFilter(intend to replace the UsernamePasswordAuthenticationFilter) does not work - spring

Question

By reference https://www.baeldung.com/spring-security-extra-login-fields
I intend to customize the the functionality of Spring security Authentication UsernamePasswordAuthenticationFilter to get the additional customized "loginForm" fields.
I created one customized filter
CustomAuthenticationFilter extends UsernamePasswordAuthenticationFilter
and one customized authentication token
public class CustomAuthenticationToken extends UsernamePasswordAuthenticationToken
By using the below configuration:
#EnableWebSecurity
#Configuration(proxyBeanMethods = false)
public class AuthenticationSecurityConfig extends AbstractHttpConfigurer<AuthenticationSecurityConfig, HttpSecurity> {
#Override
public void configure(HttpSecurity http) throws Exception {
AuthenticationManager authenticationManager = http.getSharedObject(AuthenticationManager.class);
http.addFilterBefore(authenticationFilter(authenticationManager), UsernamePasswordAuthenticationFilter.class);
}
#Bean
SecurityFilterChain defaultSecurityFilterChain(HttpSecurity http) throws Exception {
http.authorizeHttpRequests()
.requestMatchers("/css/**", "/login")
.permitAll()
.requestMatchers("/resources/**")
.permitAll()
.and()
.formLogin(form -> form
.loginPage("/login")
.permitAll()
)
.logout()
.logoutUrl("/logout")
.and()
.authorizeHttpRequests(
auth -> auth.anyRequest().authenticated()
)
.apply(securityConfig());
return http.build();
}
}
I can successfully make the my AuthenticationProvider's
authenticate
method to be executed, and It can successfully return one "authenticated"
Authentication object.
However it will not redirect to the OAuth2 client's redirect page(I setup my project as one OIDC authorization server), it will stay at login page, the log will be like below:
.HttpSessionRequestCache : Saved request http://192.168.0.107:9000/oauth2/authorize?client_id=messaging-client&redirect_uri=http%3A%2F%2F192.168.0.107%3A8080%2Fauth%2Fsigninwin%2Fmain&response_type=code&scope=openid%20profile%20message.read&state=802af0dcd82a483eb726c1dffff0867d&code_challenge=t_tfBjZPRd228uEZuQJ56clfXokGYqiwkudQqKhWQqo&code_challenge_method=S256&prompt=login&response_mode=query&continue&continue to session
2022-11-30T19:48:05.063+08:00 DEBUG 63801 --- [nio-9000-exec-5] o.s.s.web.DefaultRedirectStrategy : Redirecting to http://192.168.0.107:9000/login
2022-11-30T19:48:05.078+08:00 DEBUG 63801 --- [nio-9000-exec-6] o.s.security.web.FilterChainProxy : Securing GET /login
2022-11-30T19:48:05.078+08:00 DEBUG 63801 --- [nio-9000-exec-6] o.s.security.web.FilterChainProxy : Secured GET /login
2022-11-30T19:48:05.084+08:00 DEBUG 63801 --- [nio-9000-exec-6] o.s.s.w.a.AnonymousAuthenticationFilter : Set SecurityContextHolder to anonymous SecurityContext
If I will not use the customized filter CustomAuthenticationFilter, every thing will be fine(But of couse I can't get the additonal LoginForm fileds).
My build.gradle
plugins {
id "org.springframework.boot" version "3.0.0-RC2"
id "io.spring.dependency-management" version "1.0.11.RELEASE"
id "java"
}
implementation "org.springframework.security:spring-security-oauth2-authorization-server:1.0.0"
Any ideas?
I suspected that the attributes of CustomAuthenticationFilter(use new to create the object) is not the same with attributes of the UsernamePasswordAuthenticationFilter that spring security framework will initialize, need further check the disparity.

Answer 1

There are two solutions,
the difference with previous versions is due to this change: https://github.com/spring-projects/spring-security/issues/11110
*** First solution ***
You can use the old strategy (deprecated) with automatic saving of the SecurityContextHolder setting:
http.securityContext((securityContext) -> securityContext.requireExplicitSave(false))
*** Second solution ***
Define an HttpSessionSecurityContextRepository:
#Bean
public HttpSessionSecurityContextRepository securityContextRepository() {
return new HttpSessionSecurityContextRepository();
}
Set to http configuration:
http.securityContext().securityContextRepository(securityContextRepository())
finally set the context repository to your custom filter:
filter.setSecurityContextRepository(securityContextRepository());