How to get a reference to SessionAuthenticationStrategy without configuring the strategy explicit?

java, spring, spring-security

Solution

I have had a look at the `HttpSecurityBeanDefinitionParser` (and the `HttpConfigurationBuilder.createSessionManagementFilters()`) that is the class responsible to parse the `security:http` tag and for creating of `SessionAuthenticationStrategy` bean.

Therefore I know that Spring Security 3.2.5.RELEASE create (in my configuration) a `CompositeSessionAuthenticationStrategy` bean and uses this as session strategy. This bean will get the default name: `org.springframework.security.web.authentication.session.CompositeSessionAuthenticationStrategy#0`

So my current workaround is to have a reference to this bean, by its name:

<bean id="usernamePasswordAuthenticationFilter"
     class=" o.s.scurity.web.authentication.UsernamePasswordAuthenticationFilter">

    <property name="sessionAuthenticationStrategy">
        <ref
           bean="org.springframework.security.web.authentication.session.CompositeSessionAuthenticationStrategy#0"/>                
    </property>
    ...
 </bean>

This workaround has some serious limitations:

- when a newer version of spring security works in an other way (creating an other bean) then it will fail.

- when there is an other `CompositeSessionAuthenticationStrategy` thats name is created with `ReaderContext.generateBeanName` then this approach may fail, because of `#0` maybe become `#1` (depends on the order in which the beans are created)

Problem

In a Spring Security 3.2 based application I have a explicit configured `UsernamePasswordAuthenticationFilter`, that need an reference to the `sessionAuthenticationStrategy` (in order to invoke `.onAuthentication`).* The `sessionAuthenticationStrategy` is the default one created by `<security:http>` (`HttpSecurityBeanDefinitionParser`). My question: Is how can I get an reference to the `SessionAuthenticationStrategy` without configuring the complete `SessionAuthenticationStrategy` explicite, so that I can inject this reference in XML configuration? ``` <security:http auto-config="false" use-expressions="true" entry-point-ref="loginUrlAuthenticationEntryPoint" access-decision-manager-ref="httpAccessDecisionManager"> ... <security:custom-filter ref="usernamePasswordAuthenticationFilter" position="FORM_LOGIN_FILTER"/> ... </security:http> ... <bean id="usernamePasswordAuthenticationFilter" class=" o.s.scurity.web.authentication.UsernamePasswordAuthenticationFilter"> <property name="sessionAuthenticationStrategy" ref="????"> <!-- ?? -> ... </bean> ``` *my real `UsernamePasswordAuthenticationFilter` is a customized subclass, but that should not matter for this question

Original source