Create Two Factor Authentication in Spring MVC - spring-mvc

Question

Currently our webapps use Spring Security (Acegi Security 1.0.3) with username and password authentication. I have recently been given the task of plugging in two factor authentication (grid cards or tokens) into the framework.
However, there are many extension points in Spring Security - so I would appreciate it if you could give me some pointers as to whether I have gone about it in the right way.
The work flow would be: User logs in with their username and password > User is issued with a grid card challenge > Upon successful authentication they are granted access.
Here is the solution I have working at the moment.
Firstly I created a SimpleFormController (I called it GridChallengeController) that handles the two-factor authentication). If successful, users will be assigned the GridUser role and will be redirected to the page they originally requested.
Code:
Authentication auth = SecurityContextHolder.getContext().getAuthentication();
AcegiCrowdUserDetails details = (AcegiCrowdUserDetails) auth.getPrincipal();
details.addAuthority("GridUser");
UsernamePasswordAuthenticationToken existing = (UsernamePasswordAuthenticationToken) SecurityContextHolder.getContext().getAuthentication();
SecurityContextHolder.getContext().setAuthentication(new UsernamePasswordAuthenticationToken(SecurityContextHolder.getContext().getAuthentication().getPrincipal(),
existing.getCredentials(), details.getAuthorities()));
SavedRequest saved = (SavedRequest) request.getSession().getAttribute(AbstractProcessingFilter.ACEGI_SAVED_REQUEST_KEY);
return new ModelAndView(new RedirectView(saved.getFullRequestUrl()));
Then I extend the org.acegisecurity.ui.ExceptionTranslationFilter to allow for another authentication entry point. It will be triggered when the accessDecisionManager throws a TwoFactorAccessDeniedException (extends org.acegisecurity.AuthenticationException). Here are the relevant methods:
Code:
#Override
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
private AuthenticationEntryPoint twoFactorAuthenticationEntryPoint;
...
try {
chain.doFilter(request, response);
} catch (TwoFactorAccessDeniedException ex) {
handleException(request, response, chain, ex);
} catch (AuthenticationException ex) {
handleException(request, response, chain, ex);
} catch (AccessDeniedException ex) {
handleException(request, response, chain, ex);
} catch (ServletException ex) {
...
}
}
private void handleException(ServletRequest request, ServletResponse response, FilterChain chain, AcegiSecurityException exception) throws IOException, ServletException {
if (exception instanceof TwoFactorAccessDeniedException) {
sendStartTwoFactorAuthentication(request, response, chain, (AuthenticationException) exception);
} else if (exception instanceof AuthenticationException) {
sendStartAuthentication(request, response, chain, (AuthenticationException) exception);
} else if (exception instanceof AccessDeniedException) {
...
}
}
private void sendStartTwoFactorAuthentication(ServletRequest request, ServletResponse response, FilterChain chain, AuthenticationException reason) throws ServletException, IOException {
twoFactorAuthenticationEntryPoint.commence((HttpServletRequest) request, (HttpServletResponse) response, reason);
}
Finally, I extend org.acegisecurity.vote.AffirmativeBased to throw a TwoFactorAccessDeniedException when a user has not passed two-factor authentication (Users are allocated the GridUser role when they are authenticated with their grid card).
Code:
#Override
public void decide(Authentication authentication, Object object, ConfigAttributeDefinition config) throws AccessDeniedException {
super.decide(authentication, object, config);
FilterInvocation f = (FilterInvocation) object;
if (!hasRole(authentication, "GridUser") && !hasRole(authentication, "ROLE_ANONYMOUS") && !f.getRequestUrl().equalsIgnoreCase("/gridchallenge.htm")) {
throw new TwoFactorAccessDeniedException("Need a grid logon");
}
}
Here are the relevant snippets of my security XML file:
Code:
<bean id="exceptionTranslationFilter" class="authentication.TwoFactorExceptionTranslationFilter">
<property name="authenticationEntryPoint">
<bean id="basicProcessingFilterEntryPoint" class="org.acegisecurity.ui.webapp.AuthenticationProcessingFilterEntryPoint">
<property name="loginFormUrl" value="/acegilogin.jsp"/>
<property name="forceHttps" value="false"/>
</bean>
</property>
<property name="twoFactorAuthenticationEntryPoint">
<bean id="gridProcessingFilterEntryPoint" class="org.acegisecurity.ui.webapp.AuthenticationProcessingFilterEntryPoint">
<property name="loginFormUrl" value="/gridchallenge.htm"/>
<property name="forceHttps" value="false"/>
</bean>
</property>
<property name="accessDeniedHandler">
<bean class="org.acegisecurity.ui.AccessDeniedHandlerImpl">
<property name="errorPage" value="/accessDenied.jsp"/>
</bean>
</property>
</bean>
<bean id="filterInvocationInterceptor" class="org.acegisecurity.intercept.web.FilterSecurityInterceptor">
<property name="authenticationManager" ref="authenticationManager"/>
<property name="accessDecisionManager">
<bean class="authentication.TwoFactorAffirmativeBased">
<property name="allowIfAllAbstainDecisions" value="false"/>
<property name="decisionVoters">
<list>
<ref bean="roleVoter"/>
<bean class="org.acegisecurity.vote.AuthenticatedVoter"/>
</list>
</property>
</bean>
</property>
<property name="objectDefinitionSource">
<value><![CDATA[
CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON
PATTERN_TYPE_APACHE_ANT
/admin/**=Vaas_Administrator
/guard/**=Guard
/acegilogin.jsp=IS_AUTHENTICATED_ANONYMOUSLY
/gridchallenge.htm=IS_AUTHENTICATED_FULLY
/**=VaasUser
]]></value>
</property>
</bean>
Is there any thing should I add furthermore so that my app to work correctly?