Support For ReactiveAnonymousAuthentication In Reactive Web Security

[ankurpathak]

I coudn't find the support for Reactive Anonymous Authentication In Reactice Web Security.
We should add support for Reactive Annonymous Authentication and Reactive Remember
Me Authentication. This will make the security for Servlet Stack and Netty Stack similar.

[rwinch]

Thanks for the suggestion. Would you be interested in providing a PR for this?

[ankurpathak]

Sure I will work on PR but I need some clues from you before that:
In Servlet Based Security we have AbstractAuthenticationFilter and

1. AnonymousAuthenticationFilter extends it
2. RemembeMeAuthenticationFilter also extend it
   And then we plug in these filters into filter chain

But In FluxBasedSecurity we don't have equivalent of AbstractAuthenticationFilter. We have one
AuthenticationWebFilter and user different AuthenticationConverter based on type of Authentication like
HttpBasis, Form etc. How we will plug all kind of Authentication like Anonymous, RemberMe in One Filter. If you can clear this point, I am good to go and will start work on PR.

[rwinch]

I think it just becomes a new WebFilter that is placed after AuthenticationWebFilter and populates AnonymousAuthenticationToken if the Authentication is empty. There is no need to force it into using a ReactiveAuthenticationManager since we are not really authenticating anonymous users.

[ankurpathak]

AnonymousAuthenticationFilter can be implemented as normal Filter extending WebFilter.
RemberrMeAuthenticationFilter can also be implemented as nrmal Filter extending WebFilter.
But we will have to plugin support for RemberMeSevices in AuthenticationFilter the
way we do in AbstractAuthenticationProcesingFilter.

protected void successfulAuthentication(HttpServletRequest request, HttpServletResponse response, FilterChain chain, Authentication authResult) throws IOException, ServletException {
if (this.logger.isDebugEnabled()) {
this.logger.debug("Authentication success. Updating SecurityContextHolder to contain: " + authResult);
}

    SecurityContextHolder.getContext().setAuthentication(authResult);
    this.rememberMeServices.loginSuccess(request, response, authResult);
    if (this.eventPublisher != null) {
        this.eventPublisher.publishEvent(new InteractiveAuthenticationSuccessEvent(authResult, this.getClass()));
    }

    this.successHandler.onAuthenticationSuccess(request, response, authResult);
}

protected void unsuccessfulAuthentication(HttpServletRequest request, HttpServletResponse response, AuthenticationException failed) throws IOException, ServletException {
    SecurityContextHolder.clearContext();
    if (this.logger.isDebugEnabled()) {
        this.logger.debug("Authentication request failed: " + failed.toString(), failed);
        this.logger.debug("Updated SecurityContextHolder to contain null Authentication");
        this.logger.debug("Delegating to authentication failure handler " + this.failureHandler);
    }

    this.rememberMeServices.loginFail(request, response);
    this.failureHandler.onAuthenticationFailure(request, response, failed);
}

[rwinch]

I'd like to stick with one thing at a time. Let's focus this issue on anonymous support.

[ankurpathak]

@rwinch Ya sure we can have this issue for Anonymous thing. But we already have very old issue for RememberMe Here at:
#5504

[rwinch]

@ankurpathak I responded there.

[ankurpathak]

@rwinch Here is my PR for this issue:
#6198
Please guide me if it reuires improvements, modifications or corrections.