title: Spring Security: External authentication and internal authentication
body: <p>I have a REST service which relies on an external system for authenticating the token but needs to do authorization(API level access using like @Secured) by itself.</p>
  
  <p>Requirement:</p>
  
  <ol>
  <li>UI generates the token using an external system.</li>
  <li>UI makes REST calls with the token to my service.</li>
  <li>My service validates the token using the external system but authentication for API calls is done by my service</li>
  </ol>
  
  <p>One possible solution was to do this using a filter:</p>
  
  <ol>
  <li>UI generates the token using an external system.</li>
  <li>UI makes REST calls with the token to my service.</li>
  <li>My service has a filter that invokes the external system with the token. </li>
  <li>The external system for valid token sends back the user details.</li>
  <li><p>My service on successful call set's the SecurityContextHolder like</p>
  
  <p>SecurityContextHolder.getContext().setAuthentication(new 
  AuthorizedUser("test", Arrays.asList(new 
  SimpleGrantedAuthority("test_role")), "test",null));</p></li>
  </ol>
  
  <p>Is there any other way this can be achieved?</p>