Add Multi-factor Authentication Support #17775

jzheaux · 2025-08-19T19:26:57Z

Related to spring-projects/spring-security-samples#351

Implement N authentication factors and they will be required in the order that they are declared:

http
    .authorizeHttpRequests((authorize) -> authorize.anyRequest()
        .access(allOf(hasAuthority("FACTOR_PASSWORD"), hasAuthority("FACTOR_OTT")))
    )
    .formLogin(Customizer.withDefaults())
    .oneTimeTokenLogin(Customizer.withDefaults())
    // ...

This will ask for a username/password first and a one-time token second. Thereafter, the user will be considered sufficiently authenticated.

Note that you can also publish an AuthorizationManagerFactory<Object> bean that checks for FACTOR_PASSWORD and FACTOR_OTT; however, this has not been added to this PR.

You can also specify a custom action to perform when a given factor is missing:

http
    .authorizeHttpRequests((authorize) -> authorize.anyRequest()
        .access(allOf(hasAuthority("FACTOR_PASSWORD"), hasAuthority("FACTOR_WEBAUTHN")))
    )
    .formLogin(Customizer.withDefaults())
    .webauthn((webauthn) -> ...)
    .exceptionHandling((exceptions) -> exceptions
        .defaultAuthenticationEntryPointFor(new LoginUrlAuthenticationEntryPoint("/webauthn"), "FACTOR_WEBAUTHN")
    )
    // ...

Note that authentication factors already integrate with defaultAuthenticationEntryPointFor in this PR. The above is needed for WebAuthn since it doesn't expose a custom entry point page in its DSL.

rwinch

Thanks for the PR @jzheaux! I've provided feedback inline.

rwinch · 2025-09-10T20:00:24Z

.../springframework/security/config/annotation/web/configurers/ExceptionHandlingConfigurer.java

@@ -263,4 +336,128 @@ private RequestCache getRequestCache(H http) {
 		return new HttpSessionRequestCache();
 	}

+	private static final class AuthenticationFactorDelegatingAuthenticationEntryPoint


I think that we can delete AuthenticationFactorDelegatingAuthenticationEntryPoint because we don't need to control the log in page based upon the factors.

rwinch · 2025-09-10T20:23:53Z

...main/java/org/springframework/security/config/annotation/web/configurers/X509Configurer.java

@@ -225,4 +235,28 @@ private <C> C getSharedOrBean(H http, Class<C> type) {
 		return context.getBeanProvider(type).getIfUnique();
 	}

+	private static final class AuthorityGrantingAuthenticationProvider implements AuthenticationProvider {


Can this be removed in favor of PreAuthenticatedAuthenticationProvider adding the additional factor? If the factor needs to vary, perhaps allow injecting it into PreAuthenticatedAuthenticationProvider.

rwinch · 2025-09-10T20:28:25Z

.../springframework/security/config/annotation/web/configurers/ExceptionHandlingConfigurer.java

@@ -165,6 +185,26 @@ public ExceptionHandlingConfigurer<H> defaultAuthenticationEntryPointFor(Authent
 		return this;
 	}

+	public ExceptionHandlingConfigurer<H> defaultAuthenticationEntryPointFor(AuthenticationEntryPoint entryPoint,


Remove this method. It is only used once and the value of preferredMatcher is AnyRequestMatcher. If users need an AuthenticationEntryPoint that can delegate by RequestMatcher, then they can inject DelegatingAuthenticationEntryPoint.

This should also allow changing the entryPoints member variable to be of type Map<String, AuthenticationEntryPoint>

rwinch · 2025-09-11T13:59:19Z

.../springframework/security/config/annotation/web/configurers/ExceptionHandlingConfigurer.java

@@ -75,6 +93,8 @@ public final class ExceptionHandlingConfigurer<H extends HttpSecurityBuilder<H>>

 	private LinkedHashMap<RequestMatcher, AccessDeniedHandler> defaultDeniedHandlerMappings = new LinkedHashMap<>();

+	private Map<String, LinkedHashMap<RequestMatcher, AuthenticationEntryPoint>> entryPoints = new LinkedHashMap<>();


Try renaming this to something that helps describe what it does. Something like missingAuthorityToEntryPoint makes it clear what the key is.

NOTE: They type can be simplified to Map<String, AuthenticationEntryPoint> as described in this comment.

rwinch · 2025-09-11T21:29:51Z

...ingframework/security/config/annotation/web/configurers/ott/OneTimeTokenLoginConfigurer.java

@@ -391,4 +410,52 @@ public ApplicationContext getContext() {
 		return this.context;
 	}

+	private static final class PostAuthenticationEntryPoint implements AuthenticationEntryPoint {


This introduces a CSRF attack that could lead to leaking the OTT through social engineering. Consider a user who is authenticated, but who has not performed MFA with OTT. They then go to evil.example.com which performs a request to a resource that requires OTT. This will automatically submit a token to the user which evil.example.com could say we sent you a OTT please paste it in this form on evil.example.com

What's more is there is no controls in place for how many OTT are created and submitted. I think that we want a confirmation page that looks much like the login page, but does not allow the username to be changed.

rwinch · 2025-09-11T22:09:05Z

.../springframework/security/config/annotation/web/configurers/ExceptionHandlingConfigurer.java

+		}
+
+		private Collection<GrantedAuthority> authorizationRequest(Exception ex) {
+			Throwable[] chain = this.throwableAnalyzer.determineCauseChain(ex);


This method is costly. If we keep the ThrowableAnalyzer logic in this class, we should do an instanceof check on the ex argument first. Perhaps we should have a way for this to be built into ThrowableAnalyzer if it isn't there already.

rwinch · 2025-09-11T22:12:05Z

.../springframework/security/config/annotation/web/configurers/ExceptionHandlingConfigurer.java

+
+	}
+
+	private static final class AuthenticationFactorDelegatingAccessDeniedHandler implements AccessDeniedHandler {


This should be extracted into a class in spring-security-web. I believe it makes sense as a sibling of AccessDeniedHandler, but change for tangles due to authentication APIs in here (access historically has had AuthenticationManager in it though so I think this works).

rwinch · 2025-09-11T22:13:16Z

...g/springframework/security/authentication/dao/AbstractUserDetailsAuthenticationProvider.java

+		UsernamePasswordAuthenticationToken result = UsernamePasswordAuthenticationToken
+			.authenticated(principal, authentication.getCredentials(),
+					this.authoritiesMapper.mapAuthorities(user.getAuthorities()))
+			.toBuilder()


Can we avoid creating twoUsernamePasswordAuthentiationToken instances?

rwinch · 2025-09-11T22:14:12Z

...ava/org/springframework/security/ldap/authentication/AbstractLdapAuthenticationProvider.java

-				this.authoritiesMapper.mapAuthorities(user.getAuthorities()));
+		UsernamePasswordAuthenticationToken result = UsernamePasswordAuthenticationToken
+			.authenticated(user, password, this.authoritiesMapper.mapAuthorities(user.getAuthorities()))
+			.toBuilder()


Can we avoid creating two instances of UsernamePasswordAuthenticationToken?

rwinch · 2025-09-11T22:16:05Z

.../springframework/security/config/annotation/web/configurers/ExceptionHandlingConfigurer.java

+			return this.defaults;
+		}
+
+		private Collection<GrantedAuthority> authorizationRequest(Exception ex) {


rename to something like missingAuthorities

jzheaux mentioned this pull request Aug 19, 2025

Add MFA Samples spring-projects/spring-security-samples#351

Draft

jzheaux force-pushed the mfa branch 2 times, most recently from d230b08 to a399b9f Compare September 9, 2025 21:08

jzheaux added 3 commits September 9, 2025 17:05

Provider Factors and Entry Points

ced9ad0

ExceptionHandlingConfigurer

710fafc

Add Method Security

a69e16f

jzheaux force-pushed the mfa branch from a399b9f to a69e16f Compare September 9, 2025 23:08

rwinch requested changes Sep 11, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Add Multi-factor Authentication Support #17775

Add Multi-factor Authentication Support #17775

jzheaux commented Aug 19, 2025 •

edited

Loading

Uh oh!

rwinch left a comment

Uh oh!

rwinch Sep 10, 2025

Uh oh!

rwinch Sep 10, 2025

Uh oh!

rwinch Sep 10, 2025

Uh oh!

rwinch Sep 11, 2025

Uh oh!

rwinch Sep 11, 2025

Uh oh!

rwinch Sep 11, 2025

Uh oh!

rwinch Sep 11, 2025

Uh oh!

rwinch Sep 11, 2025

Uh oh!

rwinch Sep 11, 2025

Uh oh!

rwinch Sep 11, 2025

Uh oh!

Uh oh!

		@@ -75,6 +93,8 @@ public final class ExceptionHandlingConfigurer<H extends HttpSecurityBuilder<H>>

		private LinkedHashMap<RequestMatcher, AccessDeniedHandler> defaultDeniedHandlerMappings = new LinkedHashMap<>();

		private Map<String, LinkedHashMap<RequestMatcher, AuthenticationEntryPoint>> entryPoints = new LinkedHashMap<>();


		}

		private static final class AuthenticationFactorDelegatingAccessDeniedHandler implements AccessDeniedHandler {

Add Multi-factor Authentication Support #17775

Are you sure you want to change the base?

Add Multi-factor Authentication Support #17775

Conversation

jzheaux commented Aug 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rwinch left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

jzheaux commented Aug 19, 2025 •

edited

Loading