title: Spring Security custom authentication and remember me
body: <p>I used <a href="http://krams915.blogspot.de/2010/12/spring-security-mvc-integration-using_26.html" rel="nofollow noreferrer">this</a> tutorial to implement a custom authentication manager. Login and logout works fine. </p>
  
  <p>Now I want to use spring security remember-me authentication. As far as I know, remember-me requires a userDetailService. So I implemented a custom <code>userDetailService</code>. </p>
  
  <p>On the login page I added a checkbox with name <code>_spring_security_remember_me</code>. But, remember-me doesn't work. The remember-me cookie is not set after succesful login. I think this is a configuration problem or do I need to implement a custom remember me to work with custom authentication ?</p>
  
  <pre><code>&lt;input type="checkbox" name="_spring_security_remember_me"&gt;stay signed in
  </code></pre>
  
  <p>My Spring-Security.xml:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;beans xmlns="http://www.springframework.org/schema/beans"
      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
      xmlns:security="http://www.springframework.org/schema/security"
      xmlns:p="http://www.springframework.org/schema/p" 
      xmlns:jee="http://www.springframework.org/schema/jee"
      xsi:schemaLocation="http://www.springframework.org/schema/beans 
              http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
              http://www.springframework.org/schema/security 
              http://www.springframework.org/schema/security/spring-security-3.0.xsd
              http://www.springframework.org/schema/jee http://www.springframework.org/schema/jee/spring-jee-3.0.xsd"&gt;
  
      &lt;security:http auto-config="false" use-expressions="true" access-denied-page="/login?error=true"
              entry-point-ref="authenticationEntryPoint" &gt;
  
          &lt;!-- Zugriff auf /login für alle erlauben --&gt;   
          &lt;security:intercept-url pattern="/login" access="permitAll"/&gt;
          &lt;!-- resources --&gt;
          &lt;security:intercept-url pattern="/resources/**" access="permitAll"/&gt;
          &lt;!--&lt;security:intercept-url pattern="/**" access="permitAll"/&gt; --&gt;
          &lt;security:intercept-url pattern="/**" access="hasRole('ROLE_USER')"/&gt;
          &lt;!-- Zugriff auf /admin/** einschränken --&gt;
          &lt;security:intercept-url pattern="/admin/**" access="hasRole('ROLE_ADMIN')"/&gt;
  
  
          &lt;security:logout 
                  invalidate-session="true" 
                  logout-success-url="/login?logout=true" 
                  logout-url="/j_spring_security_logout"/&gt;
  
          &lt;security:custom-filter ref="blacklistFilter" before="FILTER_SECURITY_INTERCEPTOR"/&gt;
          &lt;security:custom-filter ref="authenticationFilter" position="FORM_LOGIN_FILTER"/&gt;
  
          &lt;!-- Session Timeout Seite setzen und
              Session Fixation Attack Protection einschalten --&gt; 
          &lt;security:session-management invalid-session-url="/login?timeout=true"
              session-fixation-protection="migrateSession"&gt;
  
               &lt;!-- Maxmale Anzahl von Session per User (Doppelanmeldung) --&gt; 
               &lt;security:concurrency-control max-sessions="3"
                  error-if-maximum-exceeded="false" /&gt;
          &lt;/security:session-management&gt; 
          &lt;security:remember-me key="myAppKey" token-validity-seconds="864000" user-service-ref="customUserDetailService"/&gt;
      &lt;/security:http&gt;
  
      &lt;!-- custom user service --&gt;
      &lt;bean id="customUserDetailService" class="com.stefan.app.security.CustomUserDetailsService"&gt;
          &lt;property name="userBean" ref="userBean" /&gt;
      &lt;/bean&gt;
  
      &lt;!--  Custom filter to deny unwanted users even though registered --&gt;
      &lt;bean id="blacklistFilter" class="com.stefan.app.security.filter.BlacklistFilter" /&gt;
  
      &lt;!-- Custom filter for username and password. The real customization is done in the customAthenticationManager --&gt;
      &lt;bean id="authenticationFilter" class="org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter"
          p:authenticationManager-ref="customAuthenticationManager"
          p:authenticationFailureHandler-ref="customAuthenticationFailureHandler"
          p:authenticationSuccessHandler-ref="customAuthenticationSuccessHandler" /&gt;
  
      &lt;!-- Custom authentication manager. In order to authenticate, username and password must not be the same --&gt;
      &lt;bean id="customAuthenticationManager" class="com.stefan.app.security.CustomAuthenticationManager"&gt;
          &lt;property name="userBean" ref="userBean" /&gt;
      &lt;/bean&gt;
  
      &lt;jee:local-slsb id="userBean" jndi-name="java:global/com.stefan.auctionnsiper-ear/app.ejb/UserBean!com.stefan.app.user.UserBeanLocal"
                  business-interface="com.stefan.app.user.UserBeanLocal"/&gt;
  
      &lt;!-- We just actually need to set the default failure url here --&gt;
      &lt;bean id="customAuthenticationFailureHandler" class="org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler"
          p:defaultFailureUrl="/login?error=true" /&gt;
  
       &lt;!-- We just actually need to set the default target url here --&gt;
      &lt;bean id="customAuthenticationSuccessHandler" class="org.springframework.security.web.authentication.SimpleUrlAuthenticationSuccessHandler"
          p:defaultTargetUrl="/products" /&gt;
  
      &lt;!-- The AuthenticationEntryPoint is responsible for redirecting the user to a particular page, like a login page,
              whenever the server sends back a response requiring authentication --&gt;
      &lt;!-- See Spring-Security Reference 5.4.1 for more info --&gt;
      &lt;bean id="authenticationEntryPoint"  class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint"
          p:loginFormUrl="/login"/&gt;
  
      &lt;!-- The tag below has no use but Spring Security needs it to autowire the parent property of 
              org.springframework.security.authentication.ProviderManager. Otherwise we get an error 
              A probable bug. This is still under investigation--&gt;
      &lt;security:authentication-manager/&gt;
  &lt;/beans&gt;   
  </code></pre>