SEC-2986: AbstractPreAuthenticatedProcessingFilter could offer a way to reevaluate incoming requests

Jordi Llach Fernandez (Migrated from SEC-2986) said:

By now a previously authenticated request can be reevaluated by spring security filter chain if AbstractSecurityInterceptor.alwaysReauthenticate is to true.

Then when working with a DaoAuthenticationProvider the UserCache reference that AbstractUserDetailsAuthenticationProvider has can be customized in order to avoid hitting the database per each incoming request, AND allowing you to "refresh/reload" user roles for instance from time to time.

To achieve this behaviour one just needs to override
DaoAuthenticationProvider.additionalAuthenticationChecks(UserDetails, UsernamePasswordAuthenticationToken ) the following way

@Override
    @SuppressWarnings("deprecation")
    protected void additionalAuthenticationChecks(UserDetails userDetails, UsernamePasswordAuthenticationToken authentication) throws AuthenticationException {
        if (!authentication.isAuthenticated()) {
            super.additionalAuthenticationChecks(userDetails, authentication);
        }
    }

So far so good.

The same behaviour described above can not be achieved when working with AbstractPreAuthenticatedProcessingFilter in your spring's security filter chain because this class does not offer you a way to "force" the reevaluation of the incoming request. Because method requiresAuthentication is private and the class does not has any boolean like the one mentioned in AbstractSecurityInterceptor

Start with AbstractPreAuthenticatedProcessingFilter and its private requiresAuthentication path, then compare its behavior with AbstractSecurityInterceptor.alwaysReauthenticate and the described UserCache flow. Define what an exposed reevaluation option should mean for incoming requests and verify that the resulting behavior supports periodic authentication rechecks without changing normal pre-authentication processing.