title: Custom Authentication Manager with Spring Security and Java Configuration
body: <p>I am using Spring Security with SpringMVC to create a web application (I will refer to this as the WebApp for clarity) that speaks to an existing application (I will refer to this as BackendApp).</p>
  
  <p>I want to delegate authentication responsibilities to the BackendApp (so that I don't need to synchronise the two applications). </p>
  
  <p>To implement this, I would like the WebApp (running spring security) to communicate to the BackendApp via REST with the username and password provided by the user in a form and authenticate based on whether the BackendApp's response is 200 OK or 401 Unauthorised.</p>
  
  <p>I understand I will need to write a custom Authentication Manager to do this however I am very new to spring and can't find any information on how to implement it.</p>
  
  <p>I believe I will need to do something like this:</p>
  
  <pre><code>public class CustomAuthenticationManager implements AuthenticationManager{
  
      @Override
      public Authentication authenticate(Authentication authentication) throws AuthenticationException {
  
          String username = authentication.getName();
          String pw       = authentication.getCredentials().toString();
  
          // Code to make rest call here and check for OK or Unauthorised.
          // What do I return?
  
      }
  
  }
  </code></pre>
  
  <p>Do I set authentication.setAuthenticated(true) if successful and false if otherwise and thats it?</p>
  
  <p>Once this is written, how do I configure spring security to use this authentication manager using a java configuration file?</p>
  
  <p>Thanks in advance for any assistance.</p>