Authentication Success and Failure Handlers in AbstractPreAuthenticatedProcessingFilter

[shazin]

Fixes #3389

[rwinch]

Thanks for the PR!

I'm curious what your scenario is for needing authentication success / failure handlers in pre authentication? Pre authenticated scenarios means that authentication has already occurred (i.e. using container based authentication, a proxy server like SiteMinder, etc). This means if there is success or failure in authentication it would happen outside of Spring Security (just as authentication did).

Another concern I have is that we cannot make non-passive changes to our default values. The changes in existing tests tells me that we need to restore the default behavior.

[shazin]

One of the Reasons I worked on this issue after seeing this is that I actually had to override unsuccessfulAuthenticationof AbstractPreAuthenticatedProcessingFilter in my previous job.

The use case we have was indeed a Pre Authenticated Header Token but the Header Token was mapped to a user in the DB. And a user must be activated after registration before he is allowed to login into the system. In that use case we have to manually do this.

Similar use cases may be applied for this change.

[rwinch]

@shazin Thanks for the response. I am ok with adding the handlers, but the default behavior would need to be the same.

[shazin]

The default behavior is restored with the ability have an Optional Authentication Success and Failure Handler.

[rwinch]

Thanks for the PR! This is now merged into master via 1bc7060