Когда использовать doFilter и retreiveUser в Spring Security

Question

Я пытаюсь аутентифицировать запрос, содержащий сертификаты SSL, используя Spring security.

Я ищу поток, где я мог бы это реализовать

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(securedEnabled = true)
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired 
    private CertificateAuthenticationProvider certificateAuthenticationProvider;

    @Autowired
    private CustomX509AuthenticationFilter customX509AuthenticationFilter;

    @Autowired
    public SecurityConfig(CertificateAuthenticationProvider certificateAuthenticationProvider) {
        this.certificateAuthenticationProvider = certificateAuthenticationProvider;
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests().anyRequest().authenticated()
        .and()
            .exceptionHandling().authenticationEntryPoint(unauthorizedHandler)
        .and()
            .x509().x509AuthenticationFilter(MyX509AuthenticationFilter)
        .and()
            .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.NEVER)
        .and()
            .authorizeRequests().antMatchers("/").denyAll().anyRequest().authenticated();

    }

    @Bean
    @Override
    protected AuthenticationManager authenticationManager() {
        try {
            return super.authenticationManager();
        } catch (Exception ex) {
            throw new IllegalStateException("Failed to extract AuthenticationManager.", ex);
        }
    }
}

класс AuthenticationFilter

@Component
public class MyX509AuthenticationFilter extends X509AuthenticationFilter {

    @Autowired
    private AuthenticationManager authenticationManager;

    @Override
    @Autowired
    public void setAuthenticationManager(AuthenticationManager authenticationManager) {
        super.setAuthenticationManager(authenticationManager);
    }

    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
            throws IOException, ServletException {

        Authentication unauthenticatedToken = getUserCredentialsFromRequest(request);
        Authentication authenticatedToken = authenticationManager.authenticate(unauthenticatedToken);
        if(authenticatedToken.isAuthenticated()) {
            SecurityContextHolder.getContext().setAuthentication(authenticatedToken);
            chain.doFilter(request, response);
        }
        else {
            throw new BadCredentialsException("Invalid Credentials");
        }
    }

    private Authentication getUserCredentialsFromRequest(ServletRequest request) {
        // logic to retrieve user credentials from request and create initial
        // Authentication
        return ...;
    }
}

Класс AuthenticationProvider для обеспечения аутентификации

@Component
public class CertificateAuthenticationProvider extends AbstractUserDetailsAuthenticationProvider{

    @Override
    protected void additionalAuthenticationChecks(UserDetails userDetails,
            UsernamePasswordAuthenticationToken authentication) throws AuthenticationException {
        // TODO Auto-generated method stub

    }

    @Override
    protected UserDetails retrieveUser(String username, UsernamePasswordAuthenticationToken authentication)
            throws AuthenticationException {

        return new MyCertificateDetails("xc","cv");
    }

}

Где мне нужно для проверки подлинности сертификата. Здесь требуется MyX509AuthenticationFilter?