SEC-1869: AuthenticationSuccessHandler and pre-authentication scenarios (i.e. X.509 or J2EE) #2101
Description
Luca Cito (Migrated from SEC-1869) said:
Post-login initialization logic implementing AuthenticationSuccessHandler works fine with form-based authentication, as Spring Security's classes come with a setter for such a AuthenticationSuccessHandler. However, pre-authentication scenarios like X.509 or J2EE authentication do not feature such setters out of the box. We had to create our own AuthencationFilter implementations again and again to integrate the AuthenticationSuccessHandler.
The implementation of an ApplicationListener for AuthenticationSuccessEvents is problematic (e.g. neither HttpServletRequest nor HttpServletResponse needed for the RedirectStrategy are accessible).
We would like to provide a patch, integrating AuthenticationFilters for J2EE and X.509 providing such SuccessHandlers.