How to implement remember me using acegi

I have extended the example application showing how to do form based login using acegi.

You need to apply the following changes to the securityContext.xml:

securityContext.xml (download)

Remember me beans:

<!-- remember me processing filter -->
<bean id="rememberMeProcessingFilter"
      class="org.acegisecurity.ui.rememberme.RememberMeProcessingFilter">
  <property name="rememberMeServices" ref="rememberMeServices" />
  <property name="authenticationManager" ref="authenticationManager" />
</bean>

<bean id="rememberMeServices"
      class="org.acegisecurity.ui.rememberme.TokenBasedRememberMeServices">
  <property name="userDetailsService"> <ref local="memoryAuthenticationDao"/>
  </property>
  <property name="key" value="someTokenName"/>
</bean>

<bean id="rememberMeAuthenticationProvider"
      class="org.acegisecurity.providers.rememberme.RememberMeAuthenticationProvider">
  <property name="key" value="someTokenName"/>
</bean>

Apply the following changes to existing beans:
Add the rememberMeServices to the logoutfilter for the logout filter to invalidate the remember me cookie.

<bean id="logoutFilter"
      class="org.acegisecurity.ui.logout.LogoutFilter">
  <constructor-arg index="0" value="/index.jsp"/>
  <constructor-arg index="1">
    <list>
      <ref local="securityContextLogoutHandler"/>
      <ref local="rememberMeServices"/>
    </list>
  </constructor-arg>
</bean>

Add the rememberMeProcessingFilter to the filterchain for the remember me checks to be performed when a user hits a acegi protected URI:

<bean id="filterChainProxy"
      class="org.acegisecurity.util.FilterChainProxy">
  <property name="filterInvocationDefinitionSource">
    <value>
      CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON
      PATTERN_TYPE_APACHE_ANT
      /**=httpSessionContextIntegrationFilter,rememberMeProcessingFilter,authenticationProcessingFilter,logoutFilter,exceptionTranslationFilter,filterInvocationInterceptor
    </value>
  </property>
</bean>

Also remember to set the rememberMeServices at the authenticationProcessingFilter to overwrite the default NullRememberMeServices with your rememberMeServices. That will provide acegi with a service to handle remember me token validation (took me a bit of debugging to find this error)

<bean id="authenticationProcessingFilter"
      class="org.acegisecurity.ui.webapp.AuthenticationProcessingFilter">
  <property name="authenticationManager" ref="authenticationManager"/>
  <property name="authenticationFailureUrl" value="/index.jsp?login_error=1"/>
  <property name="defaultTargetUrl" value="/secure/securecontent.jsp"/>
  <property name="filterProcessesUrl" value="/j_acegi_security_check"/>
  <property name="rememberMeServices" ref="rememberMeServices"/>
</bean>

Finally extend your login form with a checkbox to let your end user be remembered. The default parameter name is _acegi_security_remember_me:

<tr>
  <td>Remember me:</td>
  <td><input type="checkbox" name="_acegi_security_remember_me"/></td>
</tr>

Sample (download)
I also provided a simple webapp demonstrating the implementation, just:

1. download
2. unzip
   
3. type $mvn jetty:run
4. go to: http://localhost:8080/basicAcegiExample
5. type user, password as credentials