Add getDelegate() method to ObservationAuthenticationManager

[mtommila]

Add a getDelegate() method to ObservationAuthenticationManager to get the underlying AuthenticationManager.

This may be useful when configuring security if you need to get the ProviderManager to customize it. If you try to get it from HttpSecurity.getSharedObject(AuthenticationManager.class) but the ProviderManager has been wrapped with an ObservationAuthenticationManager then there's no easy way to get the ProviderManager otherwise.

[pivotal-cla]

@mtommila Please sign the Contributor License Agreement!

Click here to manually synchronize the status of this Pull Request.

See the FAQ for frequently asked questions.

[pivotal-cla]

@mtommila Thank you for signing the Contributor License Agreement!

[jzheaux]

Thanks for the suggestion, @mtommila. Instead of adding a getter to ObservationAuthenticationManager, you can construct an AuthenticationManager yourself and wrap it:

@Bean 
AuthenticationManager authenticationManager(ObservationRegistry registry) {
    // ... prepare authentication providers
    ProviderManager toObserve = new ProviderManager(providers);
    return new ObservationAuthenticationManager(registry, toObserve);
}

In this way, you'd have direct access to the underlying manager in addition to having more access to its configuration.

If that doesn't seem to help, can you tell me more about your situation and what you want to achieve by getting the delegate AuthenticationManager?

[mtommila]

Hello,

Constructing my own AuthenticationManager and especially all the authentication providers is exactly what I want to avoid. The situation is that we are using a third-party product (the CoreMedia content management system), which is built on the Spring framework, including Spring security. It provides a Spring security setup, which we are customizing to add OAuth2 OIDC SSO to it.

So, the AuthenticationManager and authentication providers are set up elsewhere (by the underlying CoreMedia system, and by our customization of adding OAuth2 SSO to it). But what I need to customize further is the OAuth2 part slightly so that it works with the authentication provider, and the underlying CoreMedia system. It needs a bit of glue logic to get it to work.

In my glue logic, I need to get the existing, pre-configured AuthenticationManager (that is a ProviderManager) and from there, get the AuthenticationProviders to find the one of them that is the OidcAuthorizationCodeAuthenticationProvider and wrap it with a wrapper that contains my custom glue logic.

The logic is something as follows:

  public SecurityFilterChain aadSecurityFilterChain(HttpSecurity http) throws Exception {
    http.securityMatcher(loginUrl, redirectUrl).authorizeHttpRequests((authorize) -> authorize.requestMatchers(loginUrl, redirectUrl).permitAll()).oauth2Login((oauth2Login) -> oauth2Login.authorizationEndpoint((authorizationEndpoint) -> authorizationEndpoint.baseUri(baseUrl)).loginProcessingUrl(redirectUrl)
      .successHandler(successHandler)).sessionManagement((sessionManagement) -> sessionManagement.sessionAuthenticationStrategy(sessionAuthenticationStrategy));
    http.with(new SecurityConfigurerAdapter<>() {
      @Override
      public void configure(HttpSecurity http) {
        wrapAuthenticationProvider(http.getSharedObject(AuthenticationManager.class));
      }
    }, Customizer.withDefaults());
    return http.build();
  }

  @Bean
  public AADAuthenticationProviderWrapper aadProviderWrapper() {
    return new AADAuthenticationProviderWrapper();
  }

  private void wrapAuthenticationProvider(AuthenticationManager authenticationManager) {
    ProviderManager providerManager = (ProviderManager) authenticationManager;
    ListIterator<AuthenticationProvider> iterator = providerManager.getProviders().listIterator();
    boolean wrapped = false;
    while (iterator.hasNext()) {
      AuthenticationProvider authenticationProvider = iterator.next();
      if (authenticationProvider instanceof OidcAuthorizationCodeAuthenticationProvider) {
        AADAuthenticationProviderWrapper aadAuthenticationProviderWrapper = aadProviderWrapper();
        aadAuthenticationProviderWrapper.setAuthenticationProvider(authenticationProvider);
        iterator.set(aadAuthenticationProviderWrapper);
        wrapped = true;
      }
    }
    if (!wrapped) {
      throw new IllegalArgumentException("OidcAuthorizationCodeAuthenticationProvider not found");
    }
  }

Is there a better way to wrap the existing OIDC authentication provider?

[jzheaux]

Gotcha. One of the strategies that can help when post-processing code that you don't have control over is registering an ObjectPostProcessor. It's like BeanPostProcessor, but for individual objects managed by the DSL.

It looks something like this:

http
    .oauth2Login((oauth2) -> oauth2
        .addObjectPostProcessor(new ObjectPostProcessor<>() {
            @Override
            public AuthenticationProvider postProcess(AuthenticationProvider provider) {
                if (provider instanceof OidcAuthorizationCodeAuthenticationProvider oidc) {
                    return wrap(oidc);
                }
                return provider; 
            }
        }
    )

What you return from the post-processor is the authentication provider that will get added. How well does that work for you?