title: How to setup pre-authentication header-based authentication in Spring Boot?
body: <p>My app gets an AUTH_USER request header with username from Oracle Access Manager SSO.  Spring Security "Additional Topics" 2.2.1 has an example of "PreAuth" that seems to be what I need, but not a full working example.</p>
  
  <p><strong>Snippets below are from docs/examples, not working annotation-based configuration.</strong></p>
  
  <p>Siteminder Example Configuration - using XML with a <strong>RequestHeaderAuthenticationFilter</strong> and <strong>PreAuthenticatedAuthenticationProvider</strong> and a UserDetailsService to lookup users. </p>
  
  <p>How does this map to Java-based config?</p>
  
  <pre><code>&lt;security:http&gt;
    &lt;!-- Additional http configuration omitted --&gt;
    &lt;security:custom-filter position="PRE_AUTH_FILTER" ref="siteminderFilter" /&gt;
  &lt;/security:http&gt;
  
  &lt;bean id="siteminderFilter" class="org.springframework.security.web.authentication.preauth.RequestHeaderAuthenticationFilter"&gt;
    &lt;property name="principalRequestHeader" value="AUTH_USER"/&gt;
    &lt;property name="authenticationManager" ref="authenticationManager" /&gt;
  &lt;/bean&gt;
  
  &lt;bean id="preauthAuthProvider" class="org.springframework.security.web.authentication.preauth.    PreAuthenticatedAuthenticationProvider"&gt;
    &lt;property name="preAuthenticatedUserDetailsService"&gt;
      &lt;bean id="userDetailsServiceWrapper"
            class="org.springframework.security.core.userdetails.UserDetailsByNameServiceWrapper"&gt;
        &lt;property name="userDetailsService" ref="userDetailsService"/&gt;
      &lt;/bean&gt;
    &lt;/property&gt;
  &lt;/bean&gt;
  
  &lt;security:authentication-manager alias="authenticationManager"&gt;
     &lt;security:authentication-provider ref="preauthAuthProvider" /&gt;
  &lt;/security:authentication-manager&gt;
  </code></pre>
  
  <p>The Spring Security preauth example has a completely different setup (the XML config is even more intimidating). No mention of the pre-auth filter or how to set the header name.</p>
  
  <pre><code>@Configuration
  @EnableWebMvcSecurity
  public class SecurityConfig extends WebSecurityConfigurerAdapter {
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http
              .authorizeRequests()
                  .antMatchers("/login","/resources/**").permitAll()
                  .anyRequest().authenticated()
                  .and()
              .jee()
                  .mappableRoles("USER","ADMIN");
      }
  }
  </code></pre>
  
  <p>The spring-boot-sample-web-secure extends WebMvcConfigurerAdapter instead of WebSecurityConfigurerAdapter, and just does basic form-based logins, no info on how to get userid from pre-auth AUTH_USER header.</p>
  
  <pre><code>public class SampleWebSecureApplication extends WebMvcConfigurerAdapter {
  
  ... omitted...
  
      @Bean
      public ApplicationSecurity applicationSecurity() {
          return new ApplicationSecurity();
      }
  
      @Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)
      protected static class ApplicationSecurity extends WebSecurityConfigurerAdapter {
  
          @Autowired
          private SecurityProperties security;
  
          @Override
          protected void configure(HttpSecurity http) throws Exception {
              http.authorizeRequests().anyRequest().fullyAuthenticated().and().formLogin()
                      .loginPage("/login").failureUrl("/login?error").permitAll();
          }
      }
  
  }
  </code></pre>
  
  <p>I've read many references/articles but they do not seem to related to current code and Spring-boot, so stuck trying to understand how to configure the app pre-auth security. </p>