I've created a custom authentication filter and gotten it working with our O

tmalaher over 10 years ago

I've created a custom authentication filter and gotten it working with our OpenSSO environment.
The only problem seems to be what to do when the user is a known SSO user, but does not have a corresponding Appian account. We are NOT auto-creating accounts, they have to be pre-provisioned by a separate process, which means that someone with a valid SSO token can end up hitting the class that extends AbstractAuthenticationProcessingFilter.

In the attemptAuthentication(req,res) method, I do a lookup to see if the SSO user has an account in Appian, and if not I throw a PreAuthenticatedCredentialsNotFoundException.

This then causes a "500 Server Error" page to display. Not very friendly.

What's the right way to do this? I want to be able to display a page with a useful message. Something like:
"Hello John Smith. I see you are trying to use Appain, but you have not requested access yet. Please visit [insert url here] in order to sign up."

Sin...

Discussion posts and replies are publicly visible

Parents

0 darbyk
Certified Lead Developer
over 10 years ago

I haven't done this in a while...but in your attemptAuthentication(request, response) method, on a failed login attempt, maybe you can try to set your response via a response.sendRedirect("yourFailedPageURL") to point to another page, (this could be a jsp page you insert in some Appian directory, and have that page whitelisted and/or added to your unsecured spring-security file, or it could be an external webpage).

Maybe another way to do it is to throw a "AuthenticationServiceException"? That exception might not throw a 500 error. Those are just two ideas...hope they help
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Reply

0 darbyk
Certified Lead Developer
over 10 years ago

I haven't done this in a while...but in your attemptAuthentication(request, response) method, on a failed login attempt, maybe you can try to set your response via a response.sendRedirect("yourFailedPageURL") to point to another page, (this could be a jsp page you insert in some Appian directory, and have that page whitelisted and/or added to your unsecured spring-security file, or it could be an external webpage).

Maybe another way to do it is to throw a "AuthenticationServiceException"? That exception might not throw a 500 error. Those are just two ideas...hope they help
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Children

No Data