title: SpringSecurity - Custom automatic authentication
body: <p>This is my scenario:</p>
  
  <ul>
  <li>a web-app perform a sort-of SSO for many applications</li>
  <li>logged-in user than click on a link and the app makes a post with user informations (name, pwd [useless], roles) toward the proper application</li>
  <li>I am implementing SpringSecurity on one of these application to benefit from its power (authorities in session, methods provided by its classes, etc)</li>
  </ul>
  
  <p>So, I need to develop a <strong>custom filter</strong> - I guess - that is able to retrieve user informations from request, retrieve from database, through a custom <strong>DetailsUserService</strong>, further information about the user (email, etc...) and then perform authentication of that user, according to the role retrieved from the request.</p>
  
  <p>I was looking at <a href="http://static.springsource.org/spring-security/site/docs/3.0.x/reference/preauth.html" rel="noreferrer">Pre-Authentication</a> filters, but I'm not sure that it is the right choice. It seems that those object are expected to be used when the principal is already in session, put by some previous authentication machanism (is it right?).</p>
  
  <p>I think that, once identified the correct filter, I should need to perform within something like:</p>
  
  <pre><code>GrantedAuthority[] ga= new GrantedAuthority[1];
  ga[0] = new GrantedAuthorityImpl(myUser.getRole());
  
  SecurityContext sc = SecurityContextHolder.getContext();
  Authentication a = new UsernamePasswordAuthenticationToken(userName, userPwd, ga);
  a = authenticationManager.authenticate(a);
  sc.setAuthentication(a);
  </code></pre>
  
  <p>Is it the proper direction to solve my problem? Do you have suggestions to help me find what's missing?</p>
  
  <p>Thank you all,</p>
  
  <p>Luca</p>
  
  <p><em><strong>ADDITION:</em></strong></p>
  
  <p>Hi Xearxess! Sorry to bother you again but it seems that the translation of your code according to SpringSecurity 2.0.4 is more difficult than I thought :S The problem is the XML... I tried different configuration but I ran always into namespace problems, missing attributes, etc...</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;beans xmlns="http://www.springframework.org/schema/beans"
    xmlns:security="http://www.springframework.org/schema/security"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.0.xsd
                http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-2.0.4.xsd"&gt;  
  
      &lt;security:http&gt;
          &lt;security:intercept-url pattern="/**" access="isAuthenticated()" /&gt;
          &lt;security:logout logout-url="/logout" logout-success-url="http://milan-ias-vs.usersad.everis.int/DMTest/" invalidate-session="true" /&gt;
          &lt;security:custom-filter position="PRE_AUTH_FILTER" ref="preAuthenticatedProcessingFilter" /&gt;
      &lt;/security:http&gt;
  
      &lt;bean id="preAuthenticatedProcessingFilter" class="it.novartis.ram.authentication.PreAuthenticatedProcessingFilter"&gt;
          &lt;custom-filter position="PRE_AUTH_FILTER"/&gt;
          &lt;property name="authenticationManager" ref="authenticationManager" /&gt;
      &lt;/bean&gt;
  
      &lt;bean id="preauthAuthProvider" class="org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationProvider"&gt;
          &lt;property name="preAuthenticatedUserDetailsService"&gt;
              &lt;bean class="it.novartis.ram.authentication.PreAuthenticatedUserDetailsService" /&gt;
          &lt;/property&gt;
      &lt;/bean&gt;
  
      &lt;security:authentication-manager alias="authenticationManager"&gt;
          &lt;security:authentication-provider ref="preauthAuthProvider" /&gt;
      &lt;/security:authentication-manager&gt;
  
  &lt;/beans&gt;
  </code></pre>
  
  <p>The 2 rows referencing CUSTOM-FILTER element are two different tries, both of them signed as error. How can I specify the position of my filter as a property?</p>
  
  <p>Also the authentication provider reference on auth manager definition is marked as error. I think that I need to specify it like a property too, right?</p>
  
  <p>Hope you can give me the last push ;)
  Thank you again,</p>
  
  <p><em>Luca</em></p>