spring-projects / spring-projects/spring-security
SEC-2748: BasicAuthenticationFilter should allow customizing the Authentication created
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Rob Winch (Migrated from SEC-2748) said:
bjethwan commented on Jun 9
the extractAndDecodeHeader() is private and a lot of private instance variables, plus the authentication manager is used with instance variable rather than getter method.
Rob Winch
Collaborator
rwinch commented on Jun 9
What are you intending to extend it for?
Bipin Jethwani
bjethwan commented on Jun 9
to strip out the domain name from the username, eg bipin@test.ads.local username=bipin domain=test.ads.local. My AuthenticationManager needs those two param set before to get authManager.authenticate() to work.
Bipin Jethwani
bjethwan commented on Jun 10
And there's no constructor in BasicAuthenticationFilter taking authenticationDetailsSource as a param.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with BasicAuthenticationFilter, focusing on extractAndDecodeHeader(), its private state, and how the authentication manager is obtained. Determine the supported extension point or constructor needed to customize the Authentication and provide the username and domain separately for authentication; the issue is done when that customization is available.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- authentication, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 28/100