This version is still in development and is not considered stable yet. For the latest stable version, please use Spring Security 6.4.1!spring-doc.cn

Authentication Events

For each authentication that succeeds or fails, a AuthenticationSuccessEvent or AuthenticationFailureEvent, respectively, is fired.spring-doc.cn

To listen for these events, you must first publish an AuthenticationEventPublisher. Spring Security’s DefaultAuthenticationEventPublisher works fine for this purpose:spring-doc.cn

Javaspring-doc.cn
Kotlinspring-doc.cn

@Bean
public AuthenticationEventPublisher authenticationEventPublisher
        (ApplicationEventPublisher applicationEventPublisher) {
    return new DefaultAuthenticationEventPublisher(applicationEventPublisher);
}

@Bean
fun authenticationEventPublisher
        (applicationEventPublisher: ApplicationEventPublisher?): AuthenticationEventPublisher {
    return DefaultAuthenticationEventPublisher(applicationEventPublisher)
}

Then you can use Spring’s @EventListener support:spring-doc.cn

Javaspring-doc.cn
Kotlinspring-doc.cn

@Component
public class AuthenticationEvents {
	@EventListener
    public void onSuccess(AuthenticationSuccessEvent success) {
		// ...
    }

    @EventListener
    public void onFailure(AbstractAuthenticationFailureEvent failures) {
		// ...
    }
}

@Component
class AuthenticationEvents {
    @EventListener
    fun onSuccess(success: AuthenticationSuccessEvent?) {
        // ...
    }

    @EventListener
    fun onFailure(failures: AbstractAuthenticationFailureEvent?) {
        // ...
    }
}

While similar to AuthenticationSuccessHandler and AuthenticationFailureHandler, these are nice in that they can be used independently from the servlet API.spring-doc.cn

Adding Exception Mappings

By default, DefaultAuthenticationEventPublisher publishes an AuthenticationFailureEvent for the following events:spring-doc.cn

Exceptionspring-doc.cn

Eventspring-doc.cn

BadCredentialsExceptionspring-doc.cn

AuthenticationFailureBadCredentialsEventspring-doc.cn

UsernameNotFoundExceptionspring-doc.cn

AuthenticationFailureBadCredentialsEventspring-doc.cn

AccountExpiredExceptionspring-doc.cn

AuthenticationFailureExpiredEventspring-doc.cn

ProviderNotFoundExceptionspring-doc.cn

AuthenticationFailureProviderNotFoundEventspring-doc.cn

DisabledExceptionspring-doc.cn

AuthenticationFailureDisabledEventspring-doc.cn

LockedExceptionspring-doc.cn

AuthenticationFailureLockedEventspring-doc.cn

AuthenticationServiceExceptionspring-doc.cn

AuthenticationFailureServiceExceptionEventspring-doc.cn

CredentialsExpiredExceptionspring-doc.cn

AuthenticationFailureCredentialsExpiredEventspring-doc.cn

InvalidBearerTokenExceptionspring-doc.cn

AuthenticationFailureBadCredentialsEventspring-doc.cn

The publisher does an exact Exception match, which means that sub-classes of these exceptions do not also produce events.spring-doc.cn

To that end, you may want to supply additional mappings to the publisher through the setAdditionalExceptionMappings method:spring-doc.cn

Javaspring-doc.cn
Kotlinspring-doc.cn

@Bean
public AuthenticationEventPublisher authenticationEventPublisher
        (ApplicationEventPublisher applicationEventPublisher) {
    Map<Class<? extends AuthenticationException>,
        Class<? extends AbstractAuthenticationFailureEvent>> mapping =
            Collections.singletonMap(FooException.class, FooEvent.class);
    AuthenticationEventPublisher authenticationEventPublisher =
        new DefaultAuthenticationEventPublisher(applicationEventPublisher);
    authenticationEventPublisher.setAdditionalExceptionMappings(mapping);
    return authenticationEventPublisher;
}

@Bean
fun authenticationEventPublisher
        (applicationEventPublisher: ApplicationEventPublisher?): AuthenticationEventPublisher {
    val mapping: Map<Class<out AuthenticationException>, Class<out AbstractAuthenticationFailureEvent>> =
            mapOf(Pair(FooException::class.java, FooEvent::class.java))
    val authenticationEventPublisher = DefaultAuthenticationEventPublisher(applicationEventPublisher)
    authenticationEventPublisher.setAdditionalExceptionMappings(mapping)
    return authenticationEventPublisher
}

Default Event

You can also supply a catch-all event to fire in the case of any AuthenticationException:spring-doc.cn

Javaspring-doc.cn
Kotlinspring-doc.cn

@Bean
public AuthenticationEventPublisher authenticationEventPublisher
        (ApplicationEventPublisher applicationEventPublisher) {
    AuthenticationEventPublisher authenticationEventPublisher =
        new DefaultAuthenticationEventPublisher(applicationEventPublisher);
    authenticationEventPublisher.setDefaultAuthenticationFailureEvent
        (GenericAuthenticationFailureEvent.class);
    return authenticationEventPublisher;
}

@Bean
fun authenticationEventPublisher
        (applicationEventPublisher: ApplicationEventPublisher?): AuthenticationEventPublisher {
    val authenticationEventPublisher = DefaultAuthenticationEventPublisher(applicationEventPublisher)
    authenticationEventPublisher.setDefaultAuthenticationFailureEvent(GenericAuthenticationFailureEvent::class.java)
    return authenticationEventPublisher
}