Spring security: remember-me doesn't work with custom AuthenticationProvider - 【StackMirror】|spring|jsf|spring-security|remember-me

I am using a custom AuthenticationProvider:

public class CustomAuthenticationProviderImpl extends AbstractUserDetailsAuthenticationProvider {

    @Resource(name="userDetailsService")
    private UserDetailsService userDetailsService;

    //.......

}

I also try to use the remember-me feature:

<security:http auto-config="true" use-expressions="true" access-denied-page="/auth/accessDenied.xhtml" >

    <!-- ........... -->

    <security:remember-me user-service-ref="userDetailsService" key="some-string"/>

</security:http>

Everything works except for the remember-me. It used to work when I did not use custom AuthenticationProvider.

What do I need to do in order to make the remember-me work?

UPDATE

I am also using an AuthenticationSuccessHandler:

public class AuthenticationSuccessHandlerImpl extends SimpleUrlAuthenticationSuccessHandler {

    @Override
    public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws ServletException, IOException {

        int timeout = 60*60;

        request.getSession().setMaxInactiveInterval(timeout); //60 minutes

        System.out.println("Session timeout of user: " + authentication.getName() + " has been set to: " + request.getSession().getMaxInactiveInterval() + " seconds.");

        setDefaultTargetUrl("/views/home.jsf");

        super.onAuthenticationSuccess(request, response, authentication);
    }
}

UPDAT 2:

I am getting the following debug output when I restart Tomcat. But when I load the login form, and when I submit it - I do not see any text that includes remember in the debug output, and no remember-me cookie is created.

DEBUG [pool-2-thread-1] 2012-04-16 09:18:11,166 (DefaultSingletonBeanRegistry.java:217) - org.springframework.beans.factory.support.DefaultSingletonBeanRegistry getSingleton :
 Creating shared instance of singleton bean 'rememberMeFilter'
DEBUG [pool-2-thread-1] 2012-04-16 09:18:11,166 (AbstractAutowireCapableBeanFactory.java:430) - org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory createBean :
 Creating instance of bean 'rememberMeFilter'
DEBUG [pool-2-thread-1] 2012-04-16 09:18:11,182 (AbstractEnvironment.java:114) - org.springframework.core.env.AbstractEnvironment <init> :
 Initializing new StandardServletEnvironment
DEBUG [pool-2-thread-1] 2012-04-16 09:18:11,182 (MutablePropertySources.java:103) - org.springframework.core.env.MutablePropertySources addLast :
 Adding [servletConfigInitParams] PropertySource with lowest search precedence
DEBUG [pool-2-thread-1] 2012-04-16 09:18:11,182 (MutablePropertySources.java:103) - org.springframework.core.env.MutablePropertySources addLast :
 Adding [servletContextInitParams] PropertySource with lowest search precedence
DEBUG [pool-2-thread-1] 2012-04-16 09:18:11,182 (MutablePropertySources.java:103) - org.springframework.core.env.MutablePropertySources addLast :
 Adding [jndiProperties] PropertySource with lowest search precedence
DEBUG [pool-2-thread-1] 2012-04-16 09:18:11,182 (MutablePropertySources.java:103) - org.springframework.core.env.MutablePropertySources addLast :
 Adding [systemProperties] PropertySource with lowest search precedence
DEBUG [pool-2-thread-1] 2012-04-16 09:18:11,182 (MutablePropertySources.java:103) - org.springframework.core.env.MutablePropertySources addLast :
 Adding [systemEnvironment] PropertySource with lowest search precedence
DEBUG [pool-2-thread-1] 2012-04-16 09:18:11,182 (AbstractEnvironment.java:120) - org.springframework.core.env.AbstractEnvironment <init> :
 Initialized StandardServletEnvironment with PropertySources [servletConfigInitParams,servletContextInitParams,jndiProperties,systemProperties,systemEnvironment]
DEBUG [pool-2-thread-1] 2012-04-16 09:18:11,182 (AbstractAutowireCapableBeanFactory.java:504) - org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory doCreateBean :
 Eagerly caching bean 'rememberMeFilter' to allow for resolving potential circular references
DEBUG [pool-2-thread-1] 2012-04-16 09:18:11,182 (DefaultSingletonBeanRegistry.java:217) - org.springframework.beans.factory.support.DefaultSingletonBeanRegistry getSingleton :
 Creating shared instance of singleton bean 'rememberMeServices'
DEBUG [pool-2-thread-1] 2012-04-16 09:18:11,182 (AbstractAutowireCapableBeanFactory.java:430) - org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory createBean :
 Creating instance of bean 'rememberMeServices'
DEBUG [pool-2-thread-1] 2012-04-16 09:18:11,198 (AbstractAutowireCapableBeanFactory.java:504) - org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory doCreateBean :
 Eagerly caching bean 'rememberMeServices' to allow for resolving potential circular references
DEBUG [pool-2-thread-1] 2012-04-16 09:18:11,198 (AbstractBeanFactory.java:245) - org.springframework.beans.factory.support.AbstractBeanFactory doGetBean :
 Returning cached instance of singleton bean 'userDetailsService'
DEBUG [pool-2-thread-1] 2012-04-16 09:18:11,213 (AbstractAutowireCapableBeanFactory.java:1498) - org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory invokeInitMethods :
 Invoking afterPropertiesSet() on bean with name 'rememberMeServices'
DEBUG [pool-2-thread-1] 2012-04-16 09:18:11,213 (AbstractBeanFactory.java:245) - org.springframework.beans.factory.support.AbstractBeanFactory doGetBean :
 Returning cached instance of singleton bean 'org.springframework.security.methodSecurityMetadataSourceAdvisor'
DEBUG [pool-2-thread-1] 2012-04-16 09:18:11,213 (AbstractBeanFactory.java:245) - org.springframework.beans.factory.support.AbstractBeanFactory doGetBean :
 Returning cached instance of singleton bean 'org.springframework.transaction.config.internalTransactionAdvisor'
DEBUG [pool-2-thread-1] 2012-04-16 09:18:11,213 (AbstractAutowireCapableBeanFactory.java:458) - org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory createBean :
 Finished creating instance of bean 'rememberMeServices'
DEBUG [pool-2-thread-1] 2012-04-16 09:18:11,213 (AbstractBeanFactory.java:245) - org.springframework.beans.factory.support.AbstractBeanFactory doGetBean :
 Returning cached instance of singleton bean 'org.springframework.security.authenticationManager'
DEBUG [pool-2-thread-1] 2012-04-16 09:18:11,213 (AbstractAutowireCapableBeanFactory.java:1498) - org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory invokeInitMethods :
 Invoking afterPropertiesSet() on bean with name 'rememberMeFilter'
DEBUG [pool-2-thread-1] 2012-04-16 09:18:11,213 (AbstractBeanFactory.java:245) - org.springframework.beans.factory.support.AbstractBeanFactory doGetBean :
 Returning cached instance of singleton bean 'org.springframework.security.methodSecurityMetadataSourceAdvisor'
DEBUG [pool-2-thread-1] 2012-04-16 09:18:11,213 (AbstractBeanFactory.java:245) - org.springframework.beans.factory.support.AbstractBeanFactory doGetBean :
 Returning cached instance of singleton bean 'org.springframework.transaction.config.internalTransactionAdvisor'
DEBUG [pool-2-thread-1] 2012-04-16 09:18:11,213 (AbstractAutowireCapableBeanFactory.java:458) - org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory createBean :
 Finished creating instance of bean 'rememberMeFilter'
DEBUG [pool-2-thread-1] 2012-04-16 09:18:11,213 (AbstractBeanFactory.java:245) - org.springframework.beans.factory.support.AbstractBeanFactory doGetBean :
 Returning cached instance of singleton bean 'rememberMeServices'
DEBUG [pool-2-thread-1] 2012-04-16 09:18:11,213 (DefaultSingletonBeanRegistry.java:217) - org.springframework.beans.factory.support.DefaultSingletonBeanRegistry getSingleton :
 Creating shared instance of singleton bean 'rememberMeAuthenticationProvider'
DEBUG [pool-2-thread-1] 2012-04-16 09:18:11,213 (AbstractAutowireCapableBeanFactory.java:430) - org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory createBean :
 Creating instance of bean 'rememberMeAuthenticationProvider'
DEBUG [pool-2-thread-1] 2012-04-16 09:18:11,213 (AbstractAutowireCapableBeanFactory.java:504) - org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory doCreateBean :
 Eagerly caching bean 'rememberMeAuthenticationProvider' to allow for resolving potential circular references
DEBUG [pool-2-thread-1] 2012-04-16 09:18:11,213 (AbstractAutowireCapableBeanFactory.java:1498) - org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory invokeInitMethods :
 Invoking afterPropertiesSet() on bean with name 'rememberMeAuthenticationProvider'
DEBUG [pool-2-thread-1] 2012-04-16 09:18:11,213 (AbstractBeanFactory.java:245) - org.springframework.beans.factory.support.AbstractBeanFactory doGetBean :
 Returning cached instance of singleton bean 'org.springframework.security.methodSecurityMetadataSourceAdvisor'
DEBUG [pool-2-thread-1] 2012-04-16 09:18:11,213 (AbstractBeanFactory.java:245) - org.springframework.beans.factory.support.AbstractBeanFactory doGetBean :
 Returning cached instance of singleton bean 'org.springframework.transaction.config.internalTransactionAdvisor'
DEBUG [pool-2-thread-1] 2012-04-16 09:18:11,213 (AbstractAutowireCapableBeanFactory.java:458) - org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory createBean :
 Finished creating instance of bean 'rememberMeAuthenticationProvider'

I have the following in my AuthenticationSuccessHandlerImpl:

System.out.println("_spring_security_remember_me after authentication = " + request.getParameter("_spring_security_remember_me"));

and the output is:

_spring_security_remember_me after authentication = on

But no remember-me cookie was created!

2012-04-04 21:31
by rapt

In what way doesn't it work? For example: Have you tracked the submission of the remember-me cookie from your browser? Does it get set when the user is authenticated? Do you get errors in the log - Shaun the Sheep 2012-04-04 22:50

@Luke Taylor: I checked out (Firebug) the response headers - no Cookie header. Request headers - only a header for JSESSIONID cookie. I checked Firefox' cookies for my domain (localhost) - only JSESSIONID cookie. I do not see error messages in Tomcat log. BTW I am also using an AuthenticationSuccessHandler, see above - rapt 2012-04-05 01:31

@Luke Taylor: I use Spring security together with JSF, following this example: http://tutorials.slackspace.de/tutorial/Custom-login-page-with-JSF-and-Spring-Security- - rapt 2012-04-05 07:55

Does the login request have the remember-me parameter set? If so, you should see the RememberMeServices being invoked in the debug log and the cookie should be set in your browser. You need to have debug logging enabled to be able to work out what's happening (or not happening) - Shaun the Sheep 2012-04-05 17:26

@Luke Taylor: Sorry for the delay: I had a problem to get the logging on Tomcat! Well, I've set org.springframework logging level to debug. So when Tomcat is restarting, I see Returning cached instance of singleton bean 'rememberMeServices'. Now, when I load the login form, and when I submit it - I do not see any text that includes remember in the debug output, and no remember-me cookie is created. How could I find out what the problem is? Please see UPDATE 2 above - rapt 2012-04-16 13:46

You can try to disable auto-config: auto-config="false" and declare RememberMeAuthenticationProvider directly:

<bean id="rememberMeFilter" class=
 "org.springframework.security.web.authentication.rememberme.RememberMeAuthenticationFilter">
  <property name="rememberMeServices" ref="rememberMeServices"/>
  <property name="authenticationManager" ref="authenticationManager" />
</bean>

<bean id="rememberMeServices" class=
 "org.springframework.security.web.authentication.rememberme.TokenBasedRememberMeServices">
  <property name="userDetailsService" ref="userService"/>
  <property name="key" value="some-string"/>
</bean>

<bean id="rememberMeAuthenticationProvider" class=
 "org.springframework.security.authentication.RememberMeAuthenticationProvider">
  <property name="key" value="some-string"/>
</bean>

2012-04-05 08:33
by vacuum

For latest version of Spring security, you can add config as below :

It will help you to create a filter, which will handle auto-login if there is no Credentials found in security context. and it also helps you to create rememberMeServices and rememberMeAuthenticationProvider.

You said, before you rewrite the CustomAuthenticationProviderImpl , it can work. So I think you have already set it.

Now the problem is, you rewrite CustomAuthenticationProviderImpl , then you break the original line about the remember-me. at first you need to set rememberMeService in your custom provider:

<beans:bean id="customFilter" class="..CustomAuthenticationProviderImpl ">
    <beans:property ... />
    <beans:property name="rememberMeServices" ref="rememberMeServices" />
</beans:bean>

And you can try with this, if it says that the "rememberMeServices" cann't find, then you should also set remember me service as the reply in above.

2012-09-10 12:26
by Mavlarn