spring security - custom filter positioning -

i need customize authentication process in such manner:

1. client sends request (rest api) "special" url param
2. server calls third-party service passing param , receiving user name
3. server lookups database name , authenticated principal.

i split server side (2+3) on 2 parts - custom filter (2), obtains user name - , custom userdetailservice for(3) builds principal looking name in database.

but cannot build security.xml correctly - every time seems doesn't process filter @ all. think problem in first (http) node, cannot understand position should set filter. here config:

<http use-expressions="true" auto-config="true" authentication-manager-ref="authenticationmanager">     <intercept-url pattern="/*" access="isauthenticated" />     <custom-filter ref="casserviceticketfilter" position="first"/> </http>  <authentication-manager alias="authenticationmanager">     <authentication-provider user-service-ref="wliauthenticationservice"/> </authentication-manager>  <b:bean id="casserviceticketfilter" class="org.wlicasauthenticationfilter">     <b:property name="casticketvalidateurl" value="${cas.ticket.validate.url}"/>     <b:property name="authenticationmanager" ref="authenticationmanager"/> </b:bean>  <b:bean id="wliauthenticationservice" class="org.wliuserdetailservice"/> 

ps- please don't tell me spring has cas support out-of-the-box. it's bit various configuration need create own implementation of service ticket validator

your custom authentication filter shouldn't first in filter chain. needs come after securitycontextpersistencefilter. use

<custom-filter ref="casserviceticketfilter" after="security_context_filter"/> 

instead.

if enable debug logging, should able see order filters called in each request , whether yours invoked.