Spring Security combine Container Security and JWT Token - spring-security

Question

Is it possible to have a login rest service that authenticates with Spring Security the container security and if successful then returns a JWT Token. Call to other services then would use JWT Filter.
The basic idea is this.
I have React Application that has a login Page. It sends a login request (via rest service) with username and password. The security is container based (an example would be Tomcat users). Spring security should authenticate via container and if the username and password are ok, then the login service returns a JWT Token.
All other services use Spring Security JWT Token Filter security.
I can't find examples of this situation when I google.

Answer 1

What you are trying to find is what Spring Security calls Pre-Authentication.
You can enable it for different scenarios, I will show an example Java EE container.
#Bean
SecurityFilterChain appSecurity(HttpSecurity http) throws Exception {
http
...
.jee(Customizer.withDefaults())
...
return http.build();
}
What the jee() will do is registering a J2eePreAuthenticatedProcessingFilter in your SecurityFilterChain, and the filter itself will extract the Principal from the HttpServletRequest and call the PreAuthenticatedAuthenticationProvider to authenticate it.
Then, in your controller, you can inject the Principal and build the JWT using the Principal's details.