Spring Security + Vaadin: How to create custom non-JSP login form? - spring-security

Question

It's fairly easy to use custom JSP login page in Spring Security. Our application is based on Vaadin though and I don't want to have JSP login page. What I want is custom fancy login window created as Vaadin widget.
Well technically I can use Vaadin's FormLayout and name fields like j_username and j_password ... but this is Java class and not JSP file, so what do I specify in http Spring Security element? I mean:
<http auto-config='true'>
<intercept-url pattern="/**" access="ROLE_USER" />
<form-login login-page='MyLoginWindow.java or what?' />
</http>

Answer 1

I'm totally unfamiliar with Spring Security, but one of our guys at Vaadin made a demo application a couple of years ago https://github.com/peholmst/SpringSecurityDemo. I don't know if it's still up-to-date or if it even answers your question, but perhaps you could have a look and see for yourself if you can get any answers from there. Otherwise you could perhaps ping Petter personally and see if he has any fresh ideas about the topic.

Answer 2

Use LoginForm and in LoginListener use something like this
try {
val authentication = new UsernamePasswordAuthenticationToken(name, pass)
SecurityContextHolder.getContext.setAuthentication(authenticationManager.authenticate(authentication))
} catch {
case e: AuthenticationException => {
SecurityContextHolder.clearContext()
}
}

Answer 3

Please see below my approach. The code shows the functionality that occurs when clicking the login button.
loginBtn.addListener(new Button.ClickListener() {
#Override
public void buttonClick(ClickEvent event) {
// Getting the helper for working with spring context
// found here https://vaadin.com/wiki/-/wiki/Main/Spring%20Integration
SpringContextHelper helper = new SpringContextHelper(getApplication());
// Get the providerManagerBean
ProviderManager authenticationManager = (ProviderManager)helper
.getBean("authenticationManager");
// Get entered data for name and password
String name = usernameEntered;
String password = passwordEntered;
// Validation
if (StringUtils.isBlank(name) || StringUtils.isBlank(password)) {
getWindow().showNotification("Username or password cannot be empty",
Notification.TYPE_ERROR_MESSAGE);
} else {
try {
// Security functionality goes here
UsernamePasswordAuthenticationToken token =
new UsernamePasswordAuthenticationToken(name, password);
Authentication authentication = authenticationManager.authenticate(token);
// Set the authentication info to context
SecurityContextHolder.getContext().setAuthentication(authentication);
// During the authentification the AppUser instance was set as
// details, for more info about the user
AppUser user = (AppUser) authentication.getDetails();
if (user != null) {
// Switch the view after succesfull login
getApplication().getMainWindow().setContent(new ComboBoxUserStartsWith());
}
} catch (AuthenticationException e) {
// Display error occured during logining
getWindow().showNotification(e.getMessage(), Notification.TYPE_ERROR_MESSAGE);
}
}
}
});