Is there a way to have the repository load a Custom authentication provider programatically?

[bjconlan]

Before trying to seriously implement a spring security authentication provider for ModeShape 4 I was wondering if there was a way to programatically set or register an AuthenticationProvider impl. against a repository/engine. I've been looking though the repository configuration class and found it only exposes jaasSecurity and anonymousSecurity instances (getCustomProviders is protected).

Is it possible to register an instantiated AuthenticationProvider implementation (as it depends on some injected services)? Or is only loading via a configuration supported?

[hchiorean]

We have a Spring based authentication/authorization example here: modeshape-examples/modeshape-spring-security-example at master · ModeShape/modeshape-examples · GitHub

[bjconlan]

Horia! In no way was I expecting that! What magnificent solution! Thank you (and M.Sarhan) This has saved me more than a few hours (and honestly I think I never would have come to this solution which is as elegant as they come)

Thank you

[bjconlan]

I just thought I would add the following comments (I don't think it warrants a pull request as most web applications these days are stateless) but If you want to make use of Horia's ModeShapeSessionFactory all you need to do is modify 1 function (and annotate the class)

...

@Component

@Scope(value = WebApplicationContext.SCOPE_SESSION, proxyMode = ScopedProxyMode.TARGET_CLASS)

public class ModeShapeSessionFactory implements FactoryBean<Session> {

...

and

...

@Override

public Session getObject() throws Exception {

     if (session == null) {

          session = repository.login(new SpringSecurityCredentials(SecurityContextHolder.getContext().getAuthentication()));

     }

     return session;

}

...

Now all the injected JCR Session objects should work as per usual.

[hchiorean]

Thanks for update.