title: Spring security custom token filter
body: <p>I'm trying to perform a custom filter to get a token and validate it. I'm following the approach in this <a href="https://stackoverflow.com/questions/19791406/spring-security-authentication-based-on-request-parameter/19792636#19792636">response</a>.</p>
  
  <p>This is the relevant configuration:</p>
  
  <p>SecurityConfig:</p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  @ComponentScan(basePackages = {"com.company.app"})
  public class SecurityConfig extends WebSecurityConfigurerAdapter {
  
  @Inject
  AuthenticationTokenFilter authenticationTokenFilter;
  
  @Inject
  TokenAuthenticationProvider tokenAuthenticationProvider;
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http
              .addFilterBefore(authenticationTokenFilter, BasicAuthenticationFilter.class)
                  .antMatcher("/*")
                  .authenticationProvider(tokenAuthenticationProvider)
                  .authorizeRequests()
                      .anyRequest().authenticated();
      }
  
  }
  </code></pre>
  
  <p>AuthenticationTokenFilter:</p>
  
  <pre><code>@Component
  public class AuthenticationTokenFilter implements Filter {
  
  private static final Logger logger = LoggerFactory.getLogger(AuthenticationTokenFilter.class);
  
  @Override
  public void init(FilterConfig fc) throws ServletException {
      logger.info("Init AuthenticationTokenFilter");
  }
  
  @Override
  public void doFilter(ServletRequest req, ServletResponse res, FilterChain fc) throws IOException, ServletException {
      SecurityContext context = SecurityContextHolder.getContext();
      if (context.getAuthentication() != null &amp;&amp; context.getAuthentication().isAuthenticated()) {
          // do nothing
      } else {
          Map&lt;String,String[]&gt; params = req.getParameterMap();
          if (!params.isEmpty() &amp;&amp; params.containsKey("auth_token")) {
              String token = params.get("auth_token")[0];
              if (token != null) {
                  Authentication auth = new TokenAuthentication(token);
                  SecurityContextHolder.getContext().setAuthentication(auth);
              }
          }
      }
  
      fc.doFilter(req, res);
  }
  
  @Override
  public void destroy() {
  
  }
  }
  </code></pre>
  
  <p>TokenAuthentication:</p>
  
  <pre><code>public class TokenAuthentication implements Authentication {
  private String token;
  
  public TokenAuthentication(String token) {
      this.token = token;
  }
  @Override
  public Collection&lt;? extends GrantedAuthority&gt; getAuthorities() {
      return new ArrayList&lt;GrantedAuthority&gt;(0);
  }
  @Override
  public Object getCredentials() {
      return token;
  }
  @Override
  public Object getDetails() {
      return null;
  }
  @Override
  public Object getPrincipal() {
      return null;
  }
  @Override
  public boolean isAuthenticated() {
      return false;
  }
  @Override
  public void setAuthenticated(boolean isAuthenticated) throws IllegalArgumentException {
  }
  @Override
  public String getName() {
      return null;
  }
  }
  </code></pre>
  
  <p>TokenAuthenticationProvider:</p>
  
  <pre><code>@Component
  public class TokenAuthenticationProvider implements AuthenticationProvider {
  
  private static final Logger logger = LoggerFactory.getLogger(TokenAuthenticationProvider.class);
  
  @Override
  public Authentication authenticate(Authentication auth) throws AuthenticationException {
      if (auth.isAuthenticated())
          return auth;
  
      String token = auth.getCredentials().toString();
      User user = userSvc.validateApiAuthenticationToken(token);
      if (user != null) {
          auth = new PreAuthenticatedAuthenticationToken(user, token);
          auth.setAuthenticated(true);
          logger.debug("Token authentication. Token: ");
      } else
          throw new BadCredentialsException("Invalid token " + token);
      return auth;
  }
  
  @Override
  public boolean supports(Class&lt;?&gt; aClass) {
      return true;
  }
  
  }
  </code></pre>
  
  <p>But it's like the AuthenticationTokenFilter is not being added to the chain. Debugging I can see that when I do a call it enters to the SecurityConfig and configure method but not to the filter.
  What is missing?</p>