title: Spring security authorization without authentication
body: <p>I have a Java JSF 2, Spring 3, Hibernate 4 Java EE Application which uses a third party library to authenticate the users. I imported the required CA certs into my JVM, added the third library to the project and configured in web.xml. The library reads the users details from smart card. This whole setup is working and users are taken to the home page by the third party library.</p>
  
  <p>Here are my requirements to secure the application.</p>
  
  <ul>
  <li>Check one more time if the user exist in the application specific database</li>
  <li>Get the roles of that user from the application database</li>
  <li>Protect my JSF pages</li>
  <li>Protect my application services</li>
  </ul>
  
  <p>I looked at this link and it seems "AuthenticationProcessingFilter" is deprecated and not applicable for Spring 3!</p>
  
  <p><a href="http://codersatwork.wordpress.com/2010/02/13/use-spring-security-for-authorization-only-not-for-authentication/" rel="nofollow noreferrer">http://codersatwork.wordpress.com/2010/02/13/use-spring-security-for-authorization-only-not-for-authentication/</a></p>
  
  <p>I also looked this one but I did not understand what other steps/configuration is needed.</p>
  
  <p><a href="https://stackoverflow.com/questions/1322135/spring-security-authorization-without-authentication">spring-security: authorization without authentication</a></p>
  
  <p>I would really appreciate if someone can outline what are all the items I need to implement Spring Security with Authorization only. This is what I came up with.</p>
  
  <p>1) Update pom with spring 3 security, add a filter (which filter I should pick)</p>
  
  <p>2) Custom User Detail</p>
  
  <p>3) Custom  DaoAuthenticationProvider</p>
  
  <p>4) register this custom authentication provider in application-context.xml</p>
  
  <p>5) register access decision managers for authorization</p>