How to generate and manage token after spring security authentication - authentication

Question

I have an android application where i am using spring security for authentication and authorization purpose at the server end.At first user enters the user name and password and send it via request using Rest Template to the server controller for authentication.I have done the authentication part for this user name password request.Now i have to generate a token for successive request authentication.But i don't know how to do this.Here is what I was thinking of-
a) Have an AES key generated and stored.
b) encrypt the username + timestamp with this AES key (you my have to base64 encode after this step to avoid any special characters). This will be your user token.
c) sign this token with an HMAC key (again store this in keystore).
d) send the token along with the signature (use ; as the delimiter).
e) store the token which you got in step c against the username in the DB.
The token would be send to the client as part of the response.
I don't know how to implement the above method.I have searched all over the web but didn't find anything usefull.
Below is my code that i have used for authentication.
try{
System.out.println("Request received... ");
Gson gson = new Gson();
TestUser userChk=new TestUser();
userChk=gson.fromJson(coaObj, TestUser.class);
Authentication authenticationToken = new UsernamePasswordAuthenticationToken(userChk.getUserName(), userChk.getPassword());
Authentication authentication = authenticationManager.authenticate(authenticationToken);
SecurityContextHolder.getContext().setAuthentication(authentication);
System.out.println("getAuthorities is "+authentication.getAuthorities()+" getCredentials "+authentication.getCredentials()+" getDetails "+authentication.getDetails()+" getPrincipal "+authentication.getPrincipal());
return "Authenticated";
}catch(Exception er){
System.out.println("Authentication error "+er);
return "Authentication failure";
}
Someone please help me to generate the token in this approach and managing this.

Answer 1

Recently I worked on a project in which we exposed REST APIs for web and mobile apps. You can send cookies after authentication success (to maintain session). It works for mobile apps as well. You will need to extend SimpleUrlAuthenticationSuccessHandler and send cookies in response, you can also set cookie age, if you want the session to persisted for a longer time.
package com.arjun.security;
import java.io.IOException;
import javax.servlet.ServletException;
import javax.servlet.http.Cookie;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.Authentication;
import org.springframework.security.web.RedirectStrategy;
import org.springframework.security.web.authentication.SimpleUrlAuthenticationSuccessHandler;
import org.springframework.security.web.savedrequest.HttpSessionRequestCache;
import org.springframework.security.web.savedrequest.RequestCache;
import com.google.gson.Gson;
import com.google.gson.GsonBuilder;
import com.informage.arnav.dto.response.LoginUserResponseDto;
import com.informage.arnav.service.UserService;
import com.informage.arnav.util.ApplicationUtil;
public class AppSimpleUrlAuthenticationSuccessHandler extends SimpleUrlAuthenticationSuccessHandler {
#Autowired
ApplicationUtil applicationUtil;
#Autowired
UserService userService;
private RequestCache requestCache = new HttpSessionRequestCache();
public AppSimpleUrlAuthenticationSuccessHandler() {
super();
setRedirectStrategy(new NoRedirectStrategy());
}
#Override
public void onAuthenticationSuccess(HttpServletRequest request,
HttpServletResponse response,
Authentication authentication) throws ServletException,
IOException {
super.onAuthenticationSuccess(request, response, authentication);
AppUserDetails appUserDetails = applicationUtil.getCurrentUser();
appUserDetails.setSessionId(request.getSession().getId());
Cookie[] cookies = request.getCookies();
if (cookies.length > 0) {
for (Cookie cookie : cookies) {
if (cookie != null) {
if (cookie.getName().equals("JSESSIONID")) {
String value = cookie.getValue();
cookie.setMaxAge(1555200000);
cookie.setPath("/");
//cookie.setHttpOnly(true);
response.addCookie(cookie);
}
}
}
}
LoginUserResponseDto dto = userService.getDtoFromUserName(appUserDetails.getUsername());
Gson gson = new GsonBuilder().create();
String json = gson.toJson(dto);
response.getWriter().write(json);
response.addHeader("Content-Type", "application/json");
response.getWriter().flush();
}
}
code for getCurrentUser method is:
public AppUserDetails getCurrentUser() {
final Object principal = SecurityContextHolder.getContext()
.getAuthentication()
.getPrincipal();
final AppUserDetails appUserDetails;
if (principal != null && principal instanceof AppUserDetails) {
appUserDetails = (AppUserDetails) principal;
} else {
appUserDetails = null;
}
return appUserDetails;
}
Finally you need to configure this in your security.xml file.
<beans:property name="authenticationSuccessHandler"
ref="mySuccessHandler" />
<beans:bean id="mySuccessHandler"
class="com.informage.arnav.security.AppSimpleUrlAuthenticationSuccessHandler" />