title: Spring security authorization without authentication using role only
body: <p>I am trying to implement the authorization element of spring security into our application. We have an external authentication process, and just want to use spring security to stop people without certain roles from accessing certain URLs. We wish to pass the users role as a header in the http request, and determine whether the user can view the url without knowing anything about their name or password.</p>
  
  <p>Having looked at a lot of documentation, I am yet to see an example of somebody doing this, but I believe that the way to go with it would be to extend the AbstractPreAuthenticatedProcessingFilter and get the role out of the request like so:</p>
  
  <pre><code>public class RequestHeaderPreAuthenticatedProcessingFilterImpl extends
      AbstractPreAuthenticatedProcessingFilter {
  
     private final String PRINCIPAL_REQUEST_HEADER = "user-role";
  
     private final boolean EXCEPTION_IF_HEADER_MISSING = true;
  
     @Override
     protected Object getPreAuthenticatedPrincipal(HttpServletRequest request) {
         String principal = request.getHeader(PRINCIPAL_REQUEST_HEADER);
         if (principal == null &amp;&amp; EXCEPTION_IF_HEADER_MISSING) {
             throw new PreAuthenticatedCredentialsNotFoundException(PRINCIPAL_REQUEST_HEADER
                  + " header not found in request.");
         }
         return principal;
  
     }
  
     @Override
     protected Object getPreAuthenticatedCredentials(HttpServletRequest request) {
         return "N/A";
     }
  
  }
  </code></pre>
  
  <p>My questions are:<br>
  1) Is this the correct way to go about solving the problem?<br>
  2) What would be the right thing to return as the principal? Would it be the role, or a UserDetails object containing information about a dummy user?<br>
  3) Will I be able to plug this into predefined Spring objects, or will I have to create concrete implementations for the Authentication Manager, provider etc?</p>