Spring Boot with read-only session for single sign on

We have a legacy Spring application (A) (that is not using spring-boot) that handles authentication and writes the session to Redis using spring-session (the data in Redis is stored as XML).

We now want to introduce a new application (B), using spring-boot 2.2.6.RELEASE and spring-session Corn-RC1, that should be useable if a user has signed into (A) with ROLE_ADMIN. I.e. this can be regarded as a very crude way of doing single sign on. A user should never be able to authenticate in B (it'd like to disable authentication if possible), it should only check that an existing user is authenticated in the session repository (redis) and has ROLE_ADMIN. Both A and B will be located under the same domain so cookies will be propagated by the browser. I've tried various different ways of getting this to work, for example:

@Configuration
@EnableWebSecurity
class ServiceBSpringSecurityConfig : WebSecurityConfigurerAdapter() {

    @Autowired
    fun configureGlobal(auth: AuthenticationManagerBuilder) {
        auth.inMemoryAuthentication()
    }

    override fun configure(http: HttpSecurity) {
        http
            .authorizeRequests()
                .anyRequest().hasRole("ADMIN")
                .and()
            .formLogin()
                .and()
            .httpBasic().disable()
    }
}

but this will show the default login screen:

I've also tried removing this part entirely:

@Autowired
fun configureGlobal(auth: AuthenticationManagerBuilder) {
    auth.inMemoryAuthentication()
}

but then it'll generate a default user and password and it does not seem to call the configure method (or the configuration doesn't work regardless).

How can I solve this?

What you need is to disable formLogin and httBasic on Application B and add a filter before spring's authentication filter AnonymousAuthenticationFilter or UsernamePasswordAuthenticationFilter. In the custom filter you will extract the cookie/header/token from the request object and based on that reach out to the redis cache for session details. This filter would then validate the session and create object of type org.springframework.security.core.Authentication and set that in the current SpringSecurityContext.

Below is the sudo code for this;

ServiceBSpringSecurityConfig

@Configuration
@EnableWebSecurity
public class ServiceBSpringSecurityConfig extends WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity http) throws Exception {
	http.cors().and().csrf().disable()
		.exceptionHandling().authenticationEntryPoint(authEntryPoint()).and()
		.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()
        .httpBasic().disabled().and()
        .formLogin().disabled().and()
		.authorizeRequests().anyRequest().hasRole("ADMIN")

	http.addFilterBefore(authTokenFilter(), UsernamePasswordAuthenticationFilter.class);
    }

    @Bean
	public AuthTokenFilter authTokenFilter() {
    	return new AuthTokenFilter();
	}

    @Bean
    public AuthEntryPoint authEntryPoint() {
        return new AuthEntryPoint()
    }
}

AuthEntryPoint

public class AuthEntryPoint implements AuthenticationEntryPoint {

    private static final Logger logger = LoggerFactory.getLogger(AuthEntryPoint.class);

    @Override
    public void commence(HttpServletRequest request, HttpServletResponse response,
            AuthenticationException authException) throws IOException, ServletException {
        // Very generic authEntryPoint which simply returns unauthorized
        // Could implement additional functionality of forwarding the Application A login-page
        logger.error("Unauthorized error: {}", authException.getMessage());
        response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Error: Unauthorized");
    }
}

AuthTokenFilter

public class AuthTokenFilter extends OncePerRequestFilter {

	@Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
        // extract some sort of token or cookie value from request
        token = request.getHeader("Token");
        if (token != null) {
            // Validate the token by retrieving session from redis cache
            // Create org.springframework.security.core.Authentication from the token
            Authentication auth = authFactory.getAuthentication(token);

            // Set the spring security context with the auth
            SecurityContextHolder.getContext().setAuthentication(auth);
        } else {
            // Do something if token not present at all
        }
        // Continue to to filter chain
        filterChain.doFilter(request, response);
    }
}

As mentioned this is sudo code so some adjustment might be required. However the general gist of token based auth remains the same.