What you need to do is to tweak Spring Security configuration. Below an example with XML config (I'm much more used to it); however, it is doable also in JavaConfig.
Basically, Spring security is fired by the
<http ....> ... </http>
element. You'll need to write it like that (or something like that)
<beans:bean id="authenticatedVoter" class="org.springframework.security.web.access.expression.WebExpressionVoter"> <beans:property name="expressionHandler" ref="..." /> </beans:bean> <beans:bean id="roleVoter" class="org.springframework.security.access.vote.RoleVoter"> <beans:property name="rolePrefix" value="" /> <!-- if you want to customize role prefix --> </beans:bean> <beans:bean id="accessDecisionManager" class="org.springframework.security.access.vote.AffirmativeBased"> <beans:constructor-arg> <beans:list> <beans:ref bean="roleVoter" /> <beans:ref bean="authenticatedVoter" /> </beans:list> </beans:constructor-arg> </beans:bean> <!-- use-expressions enables the @PreAuthorize --> <http use-expressions="true" access-decision-manager-ref="accessDecisionManager"> .... </http>
Note the beans added: they are three Spring components.
The first holds an unspecified reference. It expects something implementing SecurityExpressionHandler: in your case you'll have to provide a DefaultMethodSecurityExpressionHandler
Then, to add your custom token configuration, you'll need to write a filter of your own and wire it into the HTTP element. You can do it quite easily by extending Spring classes and then customizing its behaviour
public class MyClientAuthenticationFilter extends OncePerRequestFilter { .... @Override protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws ServletException, IOException { // custom logics here // throw exception for not authenticated } }
and then wire it up
<bean class="x.y.z.MyClientAuthenticationFilter" id="myClientAuthenticationFilter" /> <http ....> <custom-filter ref="myClientAuthenticationFilter" before="BASIC_AUTH_FILTER" /> </http>
You should be basically done.
Just remember to include spring-security-aspects in your build: Spring security @PreAuthorize and other annotations are intercepted via AOP, hence you'll need to provide these aspects in your classpath.
Also, keep in mind that this is not the full configuration: it would take a very long post to wire everything up: it is jut an example about how to start.
For deeper infos, rely on Spring Security documentation itself.
Last note: if you're using JvaConfig instead of XML, there should be annotations that can rid you of part of thi config, but the custom filter.
Hope it helps.
