title: How to make spring security to call the requested resource after a successful authentication?
body: <p>The title might be a bit misleading and might give you the impression this is an easy one so I will elaborate.</p>
  
  <p>I have a set of endpoints (REST services) that I want to secure without using the regular login way that Spring security provides. Usually you would first aim to the login endpoint (j_pring_security_check by default), authenticate and then send the request to the service endpoint along with the JSESSIONID.</p>
  
  <p>In this case i want to work without redirections.</p>
  
  <p>From the client-side I want to send a Header with an API-Key and an HMAC directly to the service endpoint, and then on the server authenticate the requester against these parameters and then proceed to process the request. I dont want to use sessions (similar to what the BasicAuthenticationFilter does).</p>
  
  <p>To summarize, i want to be able to authenticate and process the request in one shot.</p>
  
  <p>So I created my own filter:</p>
  
  <pre><code>public class HMACFilter extends BasicAuthenticationFilter {
  private static final Logger LOGGER = Logger.getLogger(HMACFilter.class);
  
  public static final String HMAC_SECURITY_HEADER_APIKEY_FIELD = "VU-API-Key";
  public static final String HMAC_SECURITY_HEADER_HMAC_FIELD = "VU-HMAC";
  public static final String HMAC_SECURITY_HEADER_TIMESTAMP_FIELD = "VU-Timestamp";
  public static final String HMAC_SECURITY_URL_AFFILIATEID_FIELD = "affiliateid";
  
  public HMACFilter() {
      //super("/api_security");
  }
  
  @Override
  public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {
  
      HttpServletRequest request = (HttpServletRequest)req;
      HttpServletResponse response = (HttpServletResponse)res;
  
      String headerApiKey = obtainApiKey(request);
      String headerHmac = obtainHMACSignature(request);
      String headerTimestamp = obtainRequestDate(request);
      int requestAffiliateId = obtainAffiliateId(request);
      String requestMessage = obtainMessage(request);
  
      VUHMACCredentials credentials = new VUHMACCredentials();
  
      if (headerHmac == null || headerApiKey == null || headerTimestamp == null) {
          throw new AuthenticationServiceException("Authentication Headers cannot be null");
      }
  
      credentials.setApiKey(headerApiKey);
      credentials.setHMACSignature(headerHmac);
      credentials.setTimestamp(Long.valueOf(headerTimestamp));
  
  
          VUCustomHMACAuthenticationToken authRequest = new VUCustomHMACAuthenticationToken(requestAffiliateId, credentials, requestMessage);
          try{
              Authentication authResult =  this.getAuthenticationManager().authenticate(authRequest);
          SecurityContextHolder.getContext().setAuthentication(authResult);
  
          } catch (AuthenticationException var12) {
              SecurityContextHolder.clearContext();
              this.onUnsuccessfulAuthentication(request, response, var12);
  
              return;
          }
          chain.doFilter(request, response);
  
  }
  </code></pre>
  
  <p>And the security.xml:</p>
  
  <pre><code>    &lt;security:http entry-point-ref="apiAuthenticationEntryPoint" pattern="/rest/api/**"&gt;
          &lt;security:intercept-url pattern="/rest/api/**"
              access="ROLE_APIUSER" /&gt;
          &lt;security:custom-filter position="FIRST"
              ref="hmacFilter" /&gt;
  
      &lt;/security:http&gt;
  
      &lt;bean id="hmacFilter" class="com.vu.acs.edge.external.api.security.HMACFilter"
            p:authenticationEntryPoint-ref="apiAuthenticationEntryPoint"
            p:authenticationManager-ref="hmacAuthenticationManager"/&gt;
  </code></pre>
  
  
  
  
  
  <pre><code>    &lt;bean id="hmacAuthenticationManager" class="com.vu.acs.edge.external.spring.security.VUCustomHMACAuthenticationManager"
              /&gt;
  </code></pre>
  
  <p>This xmls overrides the j_spring_security_check url and authenticates on every URL that matches the pattern /rest/api/**</p>
  
  <p>The issue here is that spring security is authenticating and returning a 200 RC but not calling the rest service. So, how can i make the framework to call the rest services after authentication? I need kinda what the SavedRequestAwareAuthenticationSuccessHandler does but without using redirections, everything should be done with just one request from the client.</p>