How to implement Spring Form Based Authenticationand Authorization without session scope ?

[kumar shinde]

Hello Ranchers ,

We are working on a web based application using Springs .
This application will be handling request using load balancing servers .
Due to some issues in load balancing servers for request , the client does not want to use anything in Springs kept in session scope or Application Context scope.

Now we are trying to use Form Based Authentication and Authorization in springs .
But looking out the examples based on spring authentication it seems that spring security context executes in session scope
We want to implement form based authentication in springs without a session scope .



The sample code in security file (Security using database) will be something like this :-

<beans:beans xmlns="http://www.springframework.org/schema/security"
	xmlns:beans="http://www.springframework.org/schema/beans" 
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xsi:schemaLocation="http://www.springframework.org/schema/beans
	http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
	http://www.springframework.org/schema/security
	http://www.springframework.org/schema/security/spring-security-3.0.3.xsd">
 
	<http auto-config="true">
		<intercept-url pattern="/welcome*" access="ROLE_USER" />
		<form-login login-page="/login" default-target-url="/welcome"
			authentication-failure-url="/loginfailed" />
		<logout logout-success-url="/logout" />
	</http>
 
	<authentication-manager>
	   <authentication-provider>
		<jdbc-user-service data-source-ref="dataSource"
 
		   users-by-username-query="
		      select username,password, enabled 
		      from users where username=?" 
 
		   authorities-by-username-query="
		      select u.username, ur.authority from users u, user_roles ur 
		      where u.user_id = ur.user_id and u.username =?  " 
 
		/>
	   </authentication-provider>
	</authentication-manager>
 
</beans:beans>

Hence, I want to know, is there any way to implement spring form base authentication and authorization without session scope ... maybe request scope or cookies ?

Any pointer or help in this regard will be very helpful as this is now major blocker for our app

Thanks in Advance

[Vyas Sanzgiri]

wait a minute..so your load balancer config is such that user can flip flop between load balancers at every hit? In that case, how do load balancers sync with each other? Do you want to send the cookie around every time?

In our case, once user sticks to one load balancer he is served until there is no session left for that user. He does not switch from one to another.

Cookies and request scope is the only other way I see this working but I feel that is overkill for your app...unless it is high security tool

[kumar shinde]

Yes exactly Vyas !!!

Each time a request comes it may or may not flip flop between load balancer's , hence we cannot use session .

I know that cookies or request will be overkill, but this is how the client wants .

Hence I want to know how can spring based authentication and authorization as mentioned previously can be implemented using cookies or request .