Question

我正在创建一个自定义身份验证提供程序，使用第三方系统对用户进行身份验证。用户名和密码以json格式发送到服务器。为了实现我已经创建了一个自定义过滤器 - UsernamePasswordAuthenticationFilter，它在位置FORM_LOGIN_FILTER处调用。在此之后，我创建了一个自定义身份验证提供程序，以使用第三方系统对用户进但是，每次请求都会调用此身份验证过滤器，这会导致每次请求都会调用第三方系统。我做错了什么？

CustomUsernamePasswordAuthenticationFilter：

@Override
public Authentication attemptAuthentication( HttpServletRequest request, HttpServletResponse response)
{
    //Get username password from request
    UsernamePasswordAuthenticationToken token = 
            new UsernamePasswordAuthenticationToken( username, password);
    setDetails(request, token);
    return this.getAuthenticationManager().authenticate(token);
}

自定义身份验证提供程序：

@Override
public Authentication authenticate(Authentication authentication) {
      String username = authentication.getName();
      String password = authentication.getCredentials().toString();
      boolean flag = //use the credentials to try to authenticate against the third party system
    if(flag) {
        return new UsernamePasswordAuthenticationToken(username, password);
    }
    else
        throw new BadCredentialsException("Bad Credentials");
}

@Override
public boolean supports(Class<?> authentication) {
    return true;
}

安全context.xml中

<http pattern="/resources/**" security="none"/>
<http auto-config="false" use-expressions="true" access-denied-page="/welcome"
      create-session="always" disable-url-rewriting="true" entry-point-ref="customEntryPoint">
    <intercept-url pattern="/" access='permitAll'/>
    <custom-filter ref="loginFilter" position="FORM_LOGIN_FILTER" />
    <intercept-url pattern="/**" access="isAuthenticated()" />
    <logout logout-success-url="/" delete-cookies="JSESSIONID" logout-url="/logout"  invalidate-session="true" />
</http>

<bean id="loginFilter" class="org.temp.secure.CustomUsernamePasswordAuthenticationFilter">
    <beans:property name="requiresAuthenticationRequestMatcher" ref="loginRequestUrlHandler" />
    <beans:property name="authenticationManager" ref="authenticationManager" />
    <beans:property name="usernameParameter" value="username" />
    <beans:property name="passwordParameter" value="password" />
</beans:bean>

<authentication-manager alias="authenticationManager">
    <authentication-provider ref="customAuthenticationProvider" />
</authentication-manager>

<bean id="loginRequestUrlHandler" class="org.springframework.security.web.util.matcher.RegexRequestMatcher">
    <constructor-arg index="0" value="/login" />
    <constructor-arg index="1" value="POST" />
    <constructor-arg index="2" value="false" />
</bean>

<bean id="customEntryPoint" class="org.temp.secure.CustomEntryPoint" />

<bean id="customAuthenticationProvider" class="org.temp.secure.MyAuthenticationProvider"/>

Answer 1

没关系，明白了，问题是我没有设置任何角色，因此它将身份验证显示为false。在UsernamePasswordAuthenticationToken中设置角色后，它不再调用自定义身份验证提供程序..

@Override
public Authentication authenticate(Authentication authentication) {
    String username = authentication.getName();
    String password = authentication.getCredentials().toString();
    boolean flag = //use the credentials to try to authenticate against the third party system
    if(flag) {
        List<GrantedAuthority> authorities = new ArrayList<GrantedAuthority>();
        authorities.add(new SimpleGrantedAuthority("ROLE_ONE"));
        authorities.add(new SimpleGrantedAuthority("ROLE_TWO"));
        return new UsernamePasswordAuthenticationToken(username, password, authorities);
   }
   else
       throw new BadCredentialsException("Bad Credentials"); 
}

@Override
public boolean supports(Class<?> authentication) {
    return true;
}

自定义身份验证提供程序随每个请求调用

1 个答案: