The main interface which provides authentication services in Spring Security is the AuthenticationManager. This is usually an instance of Spring Security’s ProviderManager class, which you may already be familiar with if you’ve used the framework before. If not, it will be covered later, in the technical overview chapter. The bean instance is registered using the authentication-manager namespace element. You can’t use a custom AuthenticationManager if you are using either HTTP or method security through the namespace, but this should not be a problem as you have full control over the AuthenticationProvider s that are used.
AuthenticationProvider beans with the ProviderManager and you can do this using the <authentication-provider>element with the ref attribute, where the value of the attribute is the name of the provider bean you want to add. For example:<authentication-manager>
<authentication-provider ref="casAuthenticationProvider"/>
</authentication-manager> <bean id="casAuthenticationProvider"
class="org.springframework.security.cas.authentication.CasAuthenticationProvider">
...
</bean>
Another common requirement is that another bean in the context may require a reference to the AuthenticationManager. You can easily register an alias for the AuthenticationManager and use this name elsewhere in your application context.
<security:authentication-manager alias="authenticationManager">
...
</security:authentication-manager> <bean id="customizedFormLoginFilter"
class="com.somecompany.security.web.CustomFormLoginFilter">
<property name="authenticationManager" ref="authenticationManager"/>
...
</bean>
[1]You can find out more about the use of the ldap-server element in the chapter on Chapter 29, LDAP Authentication.
[2]See the section on Section 13.4, “Request Matching and HttpFirewall” in the Web Application Infrastructure chapter for more details on how matches are actually performed.
[3]See the chapter on Chapter 22, Anonymous Authentication
[4]The use of multiple <http> elements is an important feature, allowing the namespace to simultaneously support both stateful and stateless paths within the same application, for example. The previous syntax, using the attribute filters="none" on an intercept-url element is incompatible with this change and is no longer supported in 3.1.
[5]For more details on how channel-processing is implemented, see the Javadoc for ChannelProcessingFilter and related classes.