How to implement own OpenIDConsumer on Spring Security? - spring

Question

I want to implement a new OpenIDConsumer for Spring Security OpenID. I implemented OpenIDConsumer in a class and then added the corresponding configuration to applicationContext-security.xml, but my code doesn't seems to be executed at all.
This is the relevant part from applicationContext-security.xml:
<http auto-config="false">
<intercept-url pattern="/**" access="ROLE_USER"/>
<openid-login login-page="/auth/login"
authentication-failure-url="/auth/login?login_error=true">
<attribute-exchange>
<openid-attribute name="email" type="http://axschema.org/contact/email" required="true"/>
</attribute-exchange>
</openid-login>
</http>
<b:bean id="openIdConsumer" class="sample.OpenIDTestConsumer">
<b:property name="email" value="email"/>
</b:bean>
Now, the class sample.OpenIDTestConsumer is initialized but it is not used by Spring Security, and the original class is used instead I think OpenID4JavaConsumer.
The sample.OpenIDTestConsumer class implements the OpenIDConsumer interface and it is initialized and the setEmail method is set, but it doesn't execute the beginConsumption or endConsumption methods, that's why I think it is just created because of applicationContext-security.xml bean definition but is not used.
The question is: How can I glue or set a custom class to work as the OpenIDConsumer and not use the Spring implementation?

Answer 1

By default Spring Security registers an OpenIDAuthenticationFilter with an OpenID4JavaConsumer when using the security namespace configuration. You can not define a custom consumer with the namespace. A solution would be to use a custom filter and configure the OpenIDAuthenticationFilter by hand in your applicationContext-security.xml:
<http ...>
...
<custom-filter position="OPENID_FILTER" ref="openIdFilter" />
</http>
<b:bean id="openIdFilter" class="org.springframework.security.openid.OpenIDAuthenticationFilter">
<b:property name="consumer" ref="openidConsumer" />
<!-- customize your filter (authentication failure url, login-page, … -->
</b:bean>
<b:bean id="openIdConsumer" class="sample.OpenIDTestConsumer">
<!-- config attribute exchange here -->
<b:property name="email" value="email"/>
</b:bean>

Answer 2

Another solution is to use a tip from the FAQ and use a BeanPostProcessor. The result might look something like this:
public class CustomOpenidConsumerBeanPostProcessor implements BeanPostProcessor {
private OpenIDConsumer openidConsumer;
public Object postProcessAfterInitialization(Object bean, String name) {
if (bean instanceof OpenIDCOnsumer) {
return openidConsumer;
}
return bean;
}
public Object postProcessBeforeInitialization(Object bean, String name) {
return bean;
}
public void setOpenidConsumer(OpenIDConsumer openidConsumer) {
this.openidConsumer = openidConsumer;
}
}
Then your configuration would include the following:
<b:bean class="CustomOpenidConsumerBeanPostProcessor">
<b:property name="openidConsumer" ref="openIdConsumer"/>
</b:bean>
<b:bean id="openIdConsumer" class="sample.OpenIDTestConsumer">
<!-- config attribute exchange here -->
<b:property name="email" value="email"/>
</b:bean>