title: How to create a custom authentication filter in Spring Security?
body: <p>I'm trying to create a custom Spring Security Authentication Filter in order to implement a custom authentication scheme. I've spent a couple hours reading up on Spring Security, but all of the guides I've found explain how to configure basic setups; I'm trying to write a custom setup, and I'm having trouble finding documentation on how to do so.</p>
  <p>For the sake of example, lets say that my custom authentication scheme is as follows:
  If the client provides a &quot;foo_username&quot; header and a &quot;foo_password&quot; header in the http request (both unencrypted for the sake of example), then my custom filter needs to construct a UsernamePasswordAuthenticationToken. Of course if the password is wrong, that's an authentication error. If either header is missing that's an authentication error. If both headers are missing, I want to delegate down the filter chain without changing anything.</p>
  <p>That seems simple enough in theory, but I don't know how to implement that in Spring. Am I intended to check the password against the DB myself? or is that the reponsibility of the UserDetailsPasswordService? Am I intended to modify the SecurityContextHolder.getContext().authentication field myself? What responsibilities do I delegate to the AuthenticationManager? Which exceptions do I throw when authentication fails in various ways? Do I implement Filter, OncePerRequestFilter, or AbstractAuthenticationFilter? Is there any documentation on how to do all this???</p>
  <p>Admittedly, this is a duplciate of <a href="https://stackoverflow.com/questions/38940761">How to create your own security filter using Spring security?</a>, but I'm not him, and he got no answers.</p>
  <p>Thanks for the help!</p>