Autenticación en aplicaciones web y móviles con Spring Security

<security:http pattern="/api/**" realm="Protected API" use-expressions="true" create-session="stateless" entry-point-ref="unauthorizedEntryPoint" authentication-manager-ref="authenticationManager">
        <security:custom-filter ref="restAuthenticationFilter" position="FORM_LOGIN_FILTER" />
        <security:intercept-url pattern="/api/*/password" access="permitAll" />
        <security:intercept-url pattern="/api/*/*" access="hasRole('ADMIN')" />
</security:http>
<bean id="unauthorizedEntryPoint" class="com.cleventy.myapp.commons.controller.security.UnauthorizedEntryPoint" />
<bean id="userDetailService" class="com.cleventy.myapp.commons.controller.security.MyAppUserDetailsService" />
<bean id="tokenManager" class="com.cleventy.myapp.commons.controller.security.TokenManagerImpl">
        <property name="userDetailsService" ref="myappUserDetailsService" />
</bean>
<bean id="tokenAuthenticationService" class="com.cleventy.myapp.commons.controller.security.TokenAuthenticationServiceDefault" 
  c:authenticationManager-ref="authenticationManager" c:tokenManager-ref="tokenManager" />
<bean id="restAuthenticationFilter" class="com.cleventy.myapp.commons.controller.security.TokenAuthenticationFilter"
  c:authenticationService-ref="tokenAuthenticationService" c:loginLink="/login" c:logoutLink="/logout" />

<bean id="myappUserDetailsService" class="com.cleventy.myapp.commons.controller.security.MyAppUserDetailsService" />
<bean id="myappUserAuthenticationProvider" class="com.cleventy.myapp.commons.controller.security.MyAppAuthenticationProvider">
        <property name="userDetailsService" ref="myappUserDetailsService" />
</bean>
<bean id="authenticationManager" class="org.springframework.security.authentication.ProviderManager">
        <property name="providers">
                <list>
                        <ref bean="myappUserAuthenticationProvider" />
                </list>
        </property>
</bean>
<bean id="myappAuthenticationProcessingFilter" class="com.cleventy.myapp.commons.controller.security.MyAppUsernamePasswordAuthenticationFilter">
        <property name="authenticationManager" ref="authenticationManager" />
        <property name="filterProcessesUrl" value="/j_spring_security_check" />
        <property name="authenticationSuccessHandler">
                <bean class="com.cleventy.myapp.commons.controller.security.MyAppSavedRequestAwareAuthenticationSuccessHandler">
                        <property name="defaultTargetUrl" value="/" />
                </bean>
        </property>
        <property name="authenticationFailureHandler">
                <bean class="org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler">
                        <property name="defaultFailureUrl" value="/loginerror" />
                </bean>
        </property>
</bean>
<bean id="loginUserUrlAuthenticationEntryPoint" class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint">
        <property name="loginFormUrl" value="/login" />
</bean>
<security:http auto-config="false" use-expressions="true" authentication-manager-ref="authenticationManager" entry-point-ref="loginUserUrlAuthenticationEntryPoint">
        <security:custom-filter ref="myappAuthenticationProcessingFilter" position="FORM_LOGIN_FILTER" />
        <security:intercept-url pattern="/admin/**" access="hasRole('ADMIN')" />
        <security:intercept-url pattern="/user/**" access="hasRole('USER')" />
        <security:logout invalidate-session="true" delete-cookies="JSESSIONID" logout-success-url="/" logout-url="/j_spring_security_logout" />
</security:http>

public class MyAppUserDetailsService implements UserDetailsService {
@Override
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        User user = this.adminService.findUserByLogin(username);
        if ((user != null) && (user.getState().equals(User.REGISTERED_USER_STATE_ACTIVE))) {
                return new MyAppUserDetails(user.getId(), user.getLogin(), user.getPassword(), user.getLanguage()==null?null:user.getLanguage().getCode(), true, true, true, true, getUserAuthorities(user.getRol()));
        }
        throw new UsernameNotFoundException("User does not exist");
}
}

public final class UnauthorizedEntryPoint implements AuthenticationEntryPoint {
@Override
public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException authException) throws IOException {
        logger.debug(" *** UnauthorizedEntryPoint.commence: " + request.getRequestURI());
        response.sendError(HttpServletResponse.SC_UNAUTHORIZED);
}
}

public class MyAppAuthenticationProvider implements AuthenticationProvider {
public Authentication authenticate(Authentication authentication) throws AuthenticationException {
        UserDetails userDetails = this.userDetailsService.loadUserByUsername(authentication.getName().toLowerCase());
        if (userDetails != null
                        && new BasicPasswordEncryptor().checkPassword(authentication.getCredentials().toString(), userDetails.getPassword())
                        && userDetails.getAuthorities().contains(new SimpleGrantedAuthority(User.USER_ROL_ADMIN)) ) {
                return new MyAppUsernamePasswordAuthenticationToken(userDetails, null, userDetails.getAuthorities());
        }
        throw new BadCredentialsException("Bad credentials");
}
public boolean supports(Class<?> authentication) {
        return UsernamePasswordAuthenticationToken.class.isAssignableFrom(authentication);
}
}

public final class TokenAuthenticationFilter extends GenericFilterBean {
@Override
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
        HttpServletRequest httpRequest = (HttpServletRequest) request;
        HttpServletResponse httpResponse = (HttpServletResponse) response;
        if (currentLink(httpRequest).endsWith(this.loginLink)) {
                checkLogin(httpRequest, httpResponse);
        }
        else {
                boolean authenticated = checkToken(httpRequest, httpResponse);
                if (canRequestProcessingContinue(httpRequest)) {
                        if (authenticated) {
                                 if (currentLink(httpRequest).endsWith(this.logoutLink)) {
                                                logout(httpRequest);
                                 }
                        }
                }
        }
        if (canRequestProcessingContinue(httpRequest)) {
                chain.doFilter(request, response);
        }
}
private void checkLogin(HttpServletRequest httpRequest, HttpServletResponse httpResponse) throws IOException {
        String authorization = httpRequest.getHeader("Authorization");
        if (authorization != null) {
                checkBasicAuthorization(authorization, httpRequest, httpResponse);
        }
}
private void checkBasicAuthorization(String authorization, HttpServletRequest httpRequest, HttpServletResponse httpResponse) throws IOException {
        StringTokenizer tokenizer = new StringTokenizer(authorization);
        if (tokenizer.countTokens() < 2 || !tokenizer.nextToken().equalsIgnoreCase("Basic")) {
                httpResponse.sendError(HttpServletResponse.SC_UNAUTHORIZED);
                doNotContinueWithRequestProcessing(httpRequest);
                return;
        }
        String base64 = tokenizer.nextToken();
        String loginPassword = new String(Base64.decode(base64.getBytes()));
        tokenizer = new StringTokenizer(loginPassword, ":");
        if (tokenizer.countTokens()!=2) {
                httpResponse.sendError(HttpServletResponse.SC_UNAUTHORIZED);
                doNotContinueWithRequestProcessing(httpRequest);
                return;
        }
        checkUsernameAndPassword(tokenizer.nextToken(), tokenizer.nextToken(), httpRequest, httpResponse);
}
private void checkUsernameAndPassword(String username, String password, HttpServletRequest httpRequest, HttpServletResponse httpResponse) throws IOException {
        TokenInfo tokenInfo = this.authenticationService.authenticate(username, password);
        if (tokenInfo != null) {
                httpResponse.setHeader(HEADER_TOKEN, tokenInfo.getToken());
        } else {
                httpResponse.sendError(HttpServletResponse.SC_UNAUTHORIZED);
                doNotContinueWithRequestProcessing(httpRequest);
        }
}
/** Returns true, if request contains valid authentication token. */
private boolean checkToken(HttpServletRequest httpRequest, HttpServletResponse httpResponse) throws IOException {
        String token = httpRequest.getHeader(HEADER_TOKEN);
        if (token == null) {
                return false;
        }
        if (this.authenticationService.checkToken(token)) {
                this.logger.debug(" *** " + HEADER_TOKEN + " valid for " + ((UsernamePasswordAuthenticationToken)SecurityContextHolder.getContext().getAuthentication()).getName() +"; token="+token);
                return true;
        }
        this.logger.debug(" *** Invalid " + HEADER_TOKEN + ' ' + token);
        httpResponse.sendError(HttpServletResponse.SC_UNAUTHORIZED);
        doNotContinueWithRequestProcessing(httpRequest);
        return false;
}
private void logout(HttpServletRequest httpRequest) {
        String token = httpRequest.getHeader(HEADER_TOKEN);
        // we go here only authenticated, token must not be null
        this.authenticationService.logout(token);
        doNotContinueWithRequestProcessing(httpRequest);
}
private static String currentLink(HttpServletRequest httpRequest) {
        if (httpRequest.getPathInfo() == null) {
                return httpRequest.getServletPath();
        }
        return httpRequest.getServletPath() + httpRequest.getPathInfo();
}
/**
 * This is set in cases when we don't want to continue down the filter chain. This occurs
 * for any {@link HttpServletResponse#SC_UNAUTHORIZED} and also for login or logout.
 */
private static void doNotContinueWithRequestProcessing(HttpServletRequest httpRequest) {
        httpRequest.setAttribute(REQUEST_ATTR_DO_NOT_CONTINUE, "");
}
private static boolean canRequestProcessingContinue(HttpServletRequest httpRequest) {
        return httpRequest.getAttribute(REQUEST_ATTR_DO_NOT_CONTINUE) == null;
}
}

public interface TokenManager {
/**
 * Creates a new token for the user and returns its {@link TokenInfo}.
 * It may add it to the token list or replace the previous one for the user. Never returns {@code null}.
 */
TokenInfo createNewToken(UserDetails userDetails) throws GenericErrorException;
/** Returns user details for a token. */
UserDetails getUserDetails(String token);
}

public class TokenAuthenticationServiceDefault implements TokenAuthenticationService {
@Override
public TokenInfo authenticate(String login, String password) {
        logger.debug(" *** AuthenticationServiceImpl.authenticate");
        // Here principal=username, credentials=password
        Authentication authentication = new UsernamePasswordAuthenticationToken(login, password);
        try {
                authentication = authenticationManager.authenticate(authentication);
                // Here principal=UserDetails (UserContext in our case), credentials=null (security reasons)
                SecurityContextHolder.getContext().setAuthentication(authentication);
 
                if (authentication.getPrincipal() != null) {
                        UserDetails userContext = (UserDetails) authentication.getPrincipal();
                        TokenInfo newToken = null;
                        try {
                                newToken = tokenManager.createNewToken(userContext);
                        } catch (GenericErrorException e) {
                        }
                        if (newToken == null) {
                                return null;
                        }
                        return newToken;
                }
        } catch (AuthenticationException e) {
                logger.debug(" *** AuthenticationServiceImpl.authenticate - FAILED: " + e.toString());
        }
        return null;
}
@Override
public boolean checkToken(String token) {
        logger.debug(" *** AuthenticationServiceImpl.checkToken");
        UserDetails userDetails = tokenManager.getUserDetails(token);
        if (userDetails == null) {
                return false;
        }
        UsernamePasswordAuthenticationToken securityToken = new UsernamePasswordAuthenticationToken(
                userDetails, null, userDetails.getAuthorities());
        SecurityContextHolder.getContext().setAuthentication(securityToken);
 
        return true;
}
 
@Override
public void logout(String token) {
        SecurityContextHolder.clearContext();
}
}