title: can I authenticate a user via a custom method?
body: <p>An app currently uses spring security with a simple username and password handled by a login form that spring generates automatically.  The username is a valid email address.  </p>
  
  <p>I have other code that sends the user an email with a session id in a url to validate the email address.  And that also sends the user a text message with a custom pin code to validate their phone number.  The steps of registering for the site, validating email, and validating phone number require several controller methods and steps.  </p>
  
  <p><strong>Is there a quick and easy way to add code to an existing controller method that simply declares the user as logged in?</strong>  This would use the existing spring security configurations, and simply augment by declaring the user as logged in.</p>
  
  <p>For example, in a controller method:  </p>
  
  <pre><code>//confirmed email
  //confirmed phone number
  //confirmed password
  loggedin = true;
  </code></pre>
  
  <hr>
  
  <p><strong>CLARIFICATION:</strong>  </p>
  
  <hr>
  
  <p>The confirmation text pin code and confirmation email need to be sent and validated <strong>every time</strong> the user logs in.  If it is not possible to log someone in with a simple programmatic statement, can I at least change the user's role with a simple programmatic statement?  So they log in to limited, conditional status with username and password and they get assigned "StepOneRole". Then they validate the pin code that is sent to them and they get "StepTwoRole".  Then they validate an email link sent to them, and their role is changed to  "FullUser", in which they can actually use the secured parts of the site.  </p>
  
  <p>I am trying to avoid adding unnecessary complexity, but the user needs to validate n factors <strong>every time</strong>.  </p>
  
  <p>Also, note that my <code>SecurityConfig.java</code> is as follows, and uses <code>UserDetailService</code>, which is mentioned in one of the answers below:  </p>
  
  <pre><code>import org.springframework.beans.factory.annotation.Autowired;
  import org.springframework.context.annotation.Configuration;
  import org.springframework.security.config.annotation.web.builders.HttpSecurity;
  import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
  import org.springframework.security.config.annotation.web.servlet.configuration.EnableWebMvcSecurity;
  import org.springframework.security.core.userdetails.UserDetailsService;
  
  @Configuration
  @EnableWebMvcSecurity
  public class SecurityConfig extends WebSecurityConfigurerAdapter {
  
  @Autowired
  private UserDetailsService userDetailsService;
  
  @Override
  protected void configure(HttpSecurity http) throws Exception {
      http
          .csrf().disable()
          .formLogin()
              .loginPage("/login")
              .defaultSuccessUrl("/user-home")
              .usernameParameter("j_username")
              .passwordParameter("j_password")
              .loginProcessingUrl("/j_spring_security_check")
              .failureUrl("/login")
              .permitAll()
              .and()
          .logout()
              .logoutUrl("/logout")
              .logoutSuccessUrl("/login")
              .and()
          .authorizeRequests()
              .antMatchers("/user-home").hasAuthority("USER")
              .antMatchers("/j_spring_security_check").permitAll()
              .and()
          .userDetailsService(userDetailsService);
  
  }
  
  }
  </code></pre>