circumventing spring security -

in our app spring security uses ldap provider.

i working on change let flip flag in dev allow log in if user/pass matches value database. ldap server might down , can still log in.

what ive realized though urls secured with

@secured( {"role_user","role_merchant"}) 

so need still have dealings spring security in order logins work. how go doing this?

you can configure 2 providers: 1 ldap provider , dao provider.

<sec:authentication-manager alias="authenticationmanager">     <sec:authentication-provider ref="yourldapauthenticationprovider" />     <sec:authentication-provider ref="yourdaoauthenticationprovider" /> </sec:authentication-manager> 

if ldap fails, fall dao authentication provider.

you need configure own authentication filter inject flag yourdaoauthenticationprovider when authentication falls yourdaoauthenticationprovider, can check whether proceed further authentication (say, in development) or ignore (say, in production). so, in authenticationfilter, override setdetails() store flag:-

myauthenticationfilter bean

@override protected void setdetails(httpservletrequest request, usernamepasswordauthenticationtoken authrequest) {     yourobject yourobject = new yourobject(request.getparameter("devauthagainstdao"));     authrequest.setdetails(yourobject); } 

with this, have yourdaoauthenticationprovider check against flag before proceeding further authentication.

in end, configuration this:-

<sec:http auto-config="false" entry-point-ref="loginurlauthenticationentrypoint">     <sec:logout logout-success-url="/login.jsp"/>     <sec:intercept-url ... />      <sec:custom-filter position="form_login_filter" ref="myauthenticationfilter"/> </sec:http>  <bean id="myauthenticationfilter" class="[your_custom_authentication_filter]">     <property name="authenticationmanager" ref="authenticationmanager"/>     <property name="authenticationfailurehandler" ref="failurehandler"/>     <property name="authenticationsuccesshandler" ref="successhandler"/> </bean>  <bean id="loginurlauthenticationentrypoint"       class="org.springframework.security.web.authentication.loginurlauthenticationentrypoint">     <property name="loginformurl" value="/login.jsp"/> </bean>  <bean id="successhandler"       class="org.springframework.security.web.authentication.savedrequestawareauthenticationsuccesshandler">     <property name="defaulttargeturl" value="/welcome.jsp"/>     <property name="alwaysusedefaulttargeturl" value="true"/> </bean>  <bean id="failurehandler"       class="org.springframework.security.web.authentication.simpleurlauthenticationfailurehandler">     <property name="defaultfailureurl" value="/login.jsp?login_error=1"/> </bean>   <bean id="yourldapauthenticationprovider" ... />  <bean id="yourdaoauthenticationprovider" ... />  <sec:authentication-manager alias="authenticationmanager">     <sec:authentication-provider ref="yourldapauthenticationprovider"/>     <sec:authentication-provider ref="yourdaoauthenticationprovider"/> </sec:authentication-manager>