package org.datavaultplatform.broker.authentication;

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter;
import org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationToken;
import org.springframework.security.web.authentication.preauth.PreAuthenticatedCredentialsNotFoundException;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;

/**
 * User: Robin Taylor
 * Date: 18/02/2016
 * Time: 10:45
 */
public class RestAuthenticationFilter extends AbstractAuthenticationProcessingFilter {

    private static final Logger logger = LoggerFactory.getLogger(RestAuthenticationFilter.class);

    // Can be overridden in Spring config
    private String principalRequestHeader = "X-UserID";


    public RestAuthenticationFilter() {
        // Doesn't matter what goes in here as it should be overridden in the Spring config
        super("/dummy");
    }


    public void setPrincipalRequestHeader(String principalRequestHeader) {
        this.principalRequestHeader = principalRequestHeader;
    }


    public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response)
            throws AuthenticationException, IOException, ServletException {

        Object principal = getPreAuthenticatedPrincipal(request);
        Object credentials = getPreAuthenticatedCredentials(request);

        PreAuthenticatedAuthenticationToken authRequest = new PreAuthenticatedAuthenticationToken(principal, credentials);
        authRequest.setDetails(authenticationDetailsSource.buildDetails(request));
        return this.getAuthenticationManager().authenticate(authRequest);

    }

    /**
     * Read and returns the header named by {@code apiKeyRequestHeader} from the
     * request.
     *
     * @throws PreAuthenticatedCredentialsNotFoundException if the header is missing and
     * {@code exceptionIfHeaderMissing} is set to {@code true}.
     */
    private Object getPreAuthenticatedPrincipal(HttpServletRequest request) {
        return request.getHeader(principalRequestHeader);
    }

    /**
     * Credentials aren't usually applicable, but if a {@code credentialsRequestHeader} is
     * set, this will be read and used as the credentials value. Otherwise a dummy value
     * will be used.
     */
    private Object getPreAuthenticatedCredentials(HttpServletRequest request) {
        return "N/A";
    }
}

@@ -104,16 +104,107 @@
 actory;%0A
+import org.springframework.security.authentication.InternalAuthenticationServiceException;%0A
 import o
@@ -248,24 +248,24 @@
 entication;%0A
-
 import org.s
@@ -619,24 +619,58 @@
 Exception;%0A%0A
+import javax.servlet.FilterChain;%0A
 import javax
@@ -692,24 +692,99 @@
 tException;%0A
+import javax.servlet.ServletRequest;%0Aimport javax.servlet.ServletResponse;%0A
 import javax
@@ -1547,32 +1547,1571 @@
 Header;%0A    %7D%0A%0A%0A
+    public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)%0A            throws IOException, ServletException %7B%0A%0A        HttpServletRequest request = (HttpServletRequest) req;%0A        HttpServletResponse response = (HttpServletResponse) res;%0A%0A        if (!requiresAuthentication(request, response)) %7B%0A            chain.doFilter(request, response);%0A%0A            return;%0A        %7D%0A%0A        if (logger.isDebugEnabled()) %7B%0A            logger.debug(%22Request is to process authentication%22);%0A        %7D%0A%0A        Authentication authResult;%0A%0A        try %7B%0A            authResult = attemptAuthentication(request, response);%0A            if (authResult == null) %7B%0A                // return immediately as subclass has indicated that it hasn't completed%0A                // authentication%0A                return;%0A            %7D%0A            //sessionStrategy.onAuthentication(authResult, request, response);%0A        %7D%0A        catch (InternalAuthenticationServiceException failed) %7B%0A            logger.error(%0A                    %22An internal error occurred while trying to authenticate the user.%22,%0A                    failed);%0A            unsuccessfulAuthentication(request, response, failed);%0A%0A            return;%0A        %7D%0A        catch (AuthenticationException failed) %7B%0A            // Authentication failed%0A            unsuccessfulAuthentication(request, response, failed);%0A%0A            return;%0A        %7D%0A%0A        successfulAuthentication(request, response, chain, authResult);%0A%0A        chain.doFilter(request, response);%0A    %7D%0A%0A
     public Authe

Fix Broker security - continue filter chain after successful authentication