SecurityContextHolder returns null after I call setAuthentication with the custom authentication token - spring-boot

Question

I have a small Spring Boot project which has username/password authentication. I use spring-security sign-in with our LDAP connection. What I want, and I did manage to do in several projects, is extending AbstractAuthenticationToken class in order to add my own fields.
In my custom GenericFilterBean class, I want to create my own authentication object and set into SecurityContextHolder as below:
KfsMsgToken kfsMsgToken = new KfsMsgToken(
kfsInMessageInfo.getObjId(),
new ArrayList<>());
SecurityContextHolder.getContext().setAuthentication(kfsMsgToken);
And, here is my custom Authentication class:
public class KfsMsgToken extends AbstractAuthenticationToken {
String kfsInMsgOid;
public KfsMsgToken(String kfsInMsgOid, Collection<? extends GrantedAuthority> authorities) {
super(authorities);
this.kfsInMsgOid = kfsInMsgOid;
}
/**
*
* #return
*/
#Override
public Object getCredentials() {
return null;
}
/**
*
* #return
*/
#Override
public Object getPrincipal() {
return null;
}
public String getKfsInMsgOid() {
return kfsInMsgOid;
}
public void setKfsInMsgOid(String kfsInMsgOid) {
this.kfsInMsgOid = kfsInMsgOid;
}
}
The problem is, after login successfully, I see UsernamePasswordAuthenticationToken which has been already setted. I reset authentication field using my custom token object, returns null in service layer. I have no idea what is the reason.
All advises are appreciated!
My security configuration:
#Configuration
#Order(SecurityProperties.BASIC_AUTH_ORDER)
public class SecurityConfig extends WebSecurityConfigurerAdapter {
#Value("${ldap.urls}")
private String ldapUrl;
#Value("${ldap.domain}")
private String ldapDomain;
#Override
protected void configure(HttpSecurity http) throws Exception {
http.authorizeRequests()
.antMatchers("/css/**", "/fonts/**", "/img/**", "/js/**", "/pdf/**").permitAll()
.and().formLogin().defaultSuccessUrl("/index", true).loginProcessingUrl("/login").permitAll().and()
.authorizeRequests()
.anyRequest().authenticated()
.and()
.csrf().disable();
}
#Bean
public ActiveDirectoryLdapAuthenticationProvider activeDirectoryLdapAuthenticationProvider() {
ActiveDirectoryLdapAuthenticationProvider activeDirectoryLdapAuthenticationProvider = new
ActiveDirectoryLdapAuthenticationProvider(ldapDomain, ldapUrl);
return activeDirectoryLdapAuthenticationProvider;
}
}
How I register my filter:
#Bean
public FilterRegistrationBean jwtFilter() {
final FilterRegistrationBean registrationBean = new FilterRegistrationBean();
registrationBean.setFilter(new KfsInMsgFilter(kfsInMessageService, kfsMsgToken, messageChannelService));
registrationBean.setOrder(0);
registrationBean.addUrlPatterns(SECURE);
registrationBean.setDispatcherTypes(DispatcherType.REQUEST);
return registrationBean;
}
This is what I do in my filter:
public class KfsInMsgFilter extends GenericFilterBean {
#Override
public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
...
// at this point, Authentication holds UserNamePasswordAuthenticationToken
KfsMsgToken kfsMsgToken = new KfsMsgToken(
kfsInMessageInfo.getObjId(),
new ArrayList<>());
SecurityContextHolder.getContext().setAuthentication(kfsMsgToken);
...
}
}

Answer 1

You need to extend AbstractAuthenticationProcessingFilter and have your custom LDAP authentication inside there and register and finally use
http.addFilterAfter(
new CustomFilter(), UsernamePasswordAuthenticationProcessingFilter.class);

Answer 2

Setting authenticated field over my custom token,
kfsMsgToken.setAuthenticated(Boolean.TRUE.booleanValue());
solved my problem.
But,
I think there is a better way. Using scoped beans is more efficient and practical.
I changed my custom filter to a request-scoped bean:
#Data
#AllArgsConstructor
#NoArgsConstructor
#Component
#Scope(value="request", proxyMode = ScopedProxyMode.TARGET_CLASS)
public class KfsMsgToken {
String kfsInMsgOid;
}
By autowiring, I can get and read the value that I need.