Spring Security 6 & JWT Authentication · Lección

Integración de AuthenticationManager y Provider

Conecte su filtro JWT con `AuthenticationManager` de Spring Security y proveedores de autenticación personalizados.

Integración de AuthenticationManager y Provider es una lección gratuita de Spring Security 6 & JWT Authentication en CoddyKit. Esta es la lección 3 de 4. Puedes leer la lección completa abajo gratuitamente — luego la practicas en el navegador con un editor de código integrado y un tutor de IA 24/7. Forma parte de la ruta de aprendizaje de Spring Security 6 & JWT Authentication, y tu progreso se sincroniza en la web y la app de CoddyKit. El curso de Spring Security 6 & JWT Authentication incluye 4 lecciones en total.

Partes de esta lección aún no han sido traducidas y se muestran en inglés.

Orchestrating Authentication

Welcome to the core of Spring Security's authentication process! Today, we'll connect our JWT filter with two vital components: the AuthenticationManager and AuthenticationProvider.

These components work together to verify a user's identity and establish their security context.

The Manager's Core Responsibility

The AuthenticationManager is the central interface in Spring Security for handling authentication requests. Think of it as the conductor of an orchestra.

It receives an Authentication object (representing a user's credentials).
It delegates the actual authentication task to one or more AuthenticationProviders.
If successful, it returns a fully authenticated Authentication object.

The Role of AuthenticationProvider

While the AuthenticationManager orchestrates, AuthenticationProviders are the specialized workers.

Each provider knows how to authenticate a specific type of user or credential (e.g., username/password, LDAP, or in our case, a JWT). It contains the logic to validate the credentials.

Crafting a JWT Token Object

For our JWT flow, we need a way to represent an unauthenticated JWT within Spring Security. We'll create a custom Authentication implementation, often called JwtAuthenticationToken.

It will hold the raw JWT string when unauthenticated.
After authentication, it will hold the authenticated user's details (UserDetails) and authorities.

Building Our JWT Provider

Now, let's create our own JwtAuthenticationProvider. This class will implement the AuthenticationProvider interface.

Its main job is to take our JwtAuthenticationToken, validate the JWT, extract user details, and return a fully authenticated token.

JwtAuthenticationProvider Logic

Here's a simplified look at what our JwtAuthenticationProvider's authenticate method might do. It checks if the token is valid and then builds an authenticated object.

import org.springframework.security.authentication.AuthenticationProvider;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.GrantedAuthority;
import java.util.Collections;

public class CustomJwtAuthProvider implements AuthenticationProvider {

  @Override
  public Authentication authenticate(Authentication authentication)
      throws AuthenticationException {
    // In a real app, you'd validate the JWT here.
    // For this example, we'll assume it's valid if it's our custom type.
    if (authentication instanceof JwtAuthenticationToken) {
      // Simulate successful JWT validation
      // Extract username and roles from the JWT payload
      String username = "coddykitUser"; // From JWT subject
      // Roles would also come from JWT claims
      // For simplicity, we grant a basic role
      GrantedAuthority role = () -> "ROLE_USER";
      User userDetails = new User(username, "", Collections.singletonList(role));

      // Return a fully authenticated token
      // The credentials (JWT string) are usually cleared
      return new JwtAuthenticationToken(userDetails, Collections.singletonList(role));
    }
    return null; // Not our type of authentication
  }

  @Override
  public boolean supports(Class<?> authentication) {
    // This provider supports our custom JwtAuthenticationToken
    return JwtAuthenticationToken.class.isAssignableFrom(authentication);
  }

  // Simple placeholder for our custom token
  static class JwtAuthenticationToken implements Authentication {
    private final User userDetails;
    private final String jwtToken;
    private boolean authenticated;
    private java.util.Collection<? extends GrantedAuthority> authorities;

    public JwtAuthenticationToken(String jwtToken) {
      this.jwtToken = jwtToken;
      this.userDetails = null;
      this.authenticated = false;
      this.authorities = Collections.emptyList();
    }

    public JwtAuthenticationToken(User userDetails,
                                  java.util.Collection<? extends GrantedAuthority> authorities) {
      this.userDetails = userDetails;
      this.jwtToken = null; // Token already validated
      this.authenticated = true;
      this.authorities = authorities;
    }

    @Override
    public java.util.Collection<? extends GrantedAuthority> getAuthorities() {
      return authorities;
    }

    @Override
    public Object getCredentials() {
      return jwtToken; // The raw JWT string (if unauthenticated)
    }

    @Override
    public Object getDetails() {
      return userDetails;
    }

    @Override
    public Object getPrincipal() {
      return userDetails; // The authenticated user object
    }

    @Override
    public boolean isAuthenticated() {
      return authenticated;
    }

    @Override
    public void setAuthenticated(boolean isAuthenticated)
        throws IllegalArgumentException {
      this.authenticated = isAuthenticated;
    }

    @Override
    public String getName() {
      return userDetails != null ? userDetails.getUsername() : "N/A";
    }
  }

  public static void main(String[] args) {
    System.out.println("CustomJwtAuthProvider initialized.");
    // In a real app, Spring Security would call authenticate()
    // We're just demonstrating the class structure here.
  }
}

Wiring Up the Provider

For our JwtAuthenticationProvider to be used, we must register it with Spring Security's configuration. This is typically done in your security configuration class.

Spring Boot often auto-configures the AuthenticationManager, but we can add custom providers to it.

Filter-Manager Interaction

Remember our custom JwtAuthenticationFilter from the previous lesson? Now we connect it to the AuthenticationManager.

The filter will extract the JWT from the request.
It will create an unauthenticated JwtAuthenticationToken.
It will then pass this token to the AuthenticationManager for processing.

The manager, in turn, will find and use our JwtAuthenticationProvider.

JWT Authentication Journey

Let's trace the full authentication flow with our new components:

Client sends request with JWT in the Authorization header.
Our JwtAuthenticationFilter intercepts the request, extracts the JWT.
Filter creates an unauthenticated JwtAuthenticationToken.
Filter calls AuthenticationManager.authenticate() with this token.
AuthenticationManager finds our JwtAuthenticationProvider (because supports() returns true).
JwtAuthenticationProvider validates the JWT and builds a fully authenticated JwtAuthenticationToken (containing UserDetails and authorities).
The filter receives the authenticated token and sets it in the SecurityContextHolder.
The request proceeds, now knowing who the user is and what they can do!

Understanding the Flow

Which statements accurately describe the roles of AuthenticationManager and AuthenticationProvider in a Spring Security JWT setup?

Bringing It All Together

In this lesson, we've explored how AuthenticationManager acts as the central orchestrator and how a custom AuthenticationProvider handles the specific logic for validating JWTs.

By integrating these components with our JwtAuthenticationFilter, we've established a robust and modular JWT authentication flow within Spring Security. This separation of concerns makes your security configuration flexible and maintainable!

Preguntas frecuentes

¿La lección «Integración de AuthenticationManager y Provider» es gratis?

Sí — el texto completo de «Integración de AuthenticationManager y Provider» es gratis para leer aquí en la web. Para practicarla de forma interactiva (editor de código integrado y tutor de IA 24/7) y desbloquear el resto del curso de Spring Security 6 & JWT Authentication, actualiza a CoddyKit PRO. El curso de Spring Security 6 & JWT Authentication incluye 4 lecciones en total.

¿Qué aprenderé en «Integración de AuthenticationManager y Provider»?

Conecte su filtro JWT con `AuthenticationManager` de Spring Security y proveedores de autenticación personalizados. Practicas Spring Security 6 & JWT Authentication con código real que ejecutas directamente en el navegador, y un tutor de IA 24/7 responde tus preguntas mientras trabajas en la lección.

¿Necesito experiencia previa para empezar Spring Security 6 & JWT Authentication?

No se requiere experiencia previa. Spring Security 6 & JWT Authentication en CoddyKit está estructurado para principiantes hasta estudiantes avanzados, así que puedes empezar aquí o desde el inicio y avanzar a tu ritmo. Esta es la lección 3 de 4.

¿Cuánto tiempo toma la lección «Integración de AuthenticationManager y Provider»?

La mayoría de las lecciones de CoddyKit toman alrededor de 5–10 minutos. Cada una es compacta e interactiva, así que avanzas constantemente y retomas exactamente por donde dejaste en la web y la app.

¿Puedo escribir y ejecutar código en esta lección de Spring Security 6 & JWT Authentication?

Sí. Cada lección de Spring Security 6 & JWT Authentication incluye un editor de código integrado, así que escribes y ejecutas código real directamente en tu navegador y obtienes retroalimentación instantánea de IA — sin configuración local necesaria.

Todas las lecciones de este curso

Diseño del flujo de autenticación con JWT
Implementación de un filtro JWT personalizado
Integración de AuthenticationManager y Provider
Gestión de errores de autenticación y puntos de entrada

← Volver a Spring Security 6 & JWT Authentication