Question

我是WebFlux的新手，我需要确保两个端点的安全，其中之一必须使用oauth JWT，另一个必须使用基本身份验证。

我有使用oauth身份验证的端点正常工作，问题是试图添加使用基本身份验证的端点。

这是我正在使用的WebSecurityConfig类。如您所见，我通过oauth对端点“ / alerts”进行了认证。但是我需要添加一个使用BASIC AUTH作为端点“ / notify”的新

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.context.annotation.Bean;
import org.springframework.http.HttpMethod;
import org.springframework.security.config.annotation.method.configuration.EnableReactiveMethodSecurity;
import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity;
import org.springframework.security.config.web.server.ServerHttpSecurity;
import org.springframework.security.core.userdetails.MapReactiveUserDetailsService;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.server.SecurityWebFilterChain;

@EnableWebFluxSecurity
@EnableReactiveMethodSecurity
public class WebSecurityConfig {

    /**
     * Role for basic authentication.
     */
    private static final String ROLE = "USER_BASIC_AUTH";

    /**
     * Username for basic authentication.
     */
    @Value("${notification.auth.basic.username}")
    private String basicAuthUsername;

    /**
     * Paswd for basic authentication.
     */
    @Value("${notification.auth.basic.paswd}")
    private String basicAuthPsswd;

    private AuthenticationManager authenticationManager;


    private SecurityContextRepository securityContextRepository;

    @Autowired
    public WebSecurityConfig(AuthenticationManager authenticationManager,
            SecurityContextRepository securityContextRepository) {
        this.authenticationManager = authenticationManager;
        this.securityContextRepository = securityContextRepository;
    }

     @Bean
     public SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
     return http.authenticationManager(authenticationManager)
     .securityContextRepository(securityContextRepository).authorizeExchange()
     .pathMatchers(HttpMethod.GET, "/alerts").authenticated().anyExchange().permitAll()
     .and().csrf().disable().build();
     }

    /**
     * Register user credentials on security context
     *
     * @param encoder the encoder to save the passwd
     * @return instance of {@link MapReactiveUserDetailsService}
     */
    @Bean
    public MapReactiveUserDetailsService userDetailsService(PasswordEncoder encoder) {

        UserDetails user = User.builder().username(basicAuthUsername)
                .password(encoder.encode(basicAuthPsswd)).roles(ROLE).build();

        return new MapReactiveUserDetailsService(user);
    }

    /**
     * Define the encoder to security context
     *
     * @return instance of {@link PasswordEncoder}
     */
    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

如我所说，我将不胜感激，enter code here我是Webflux和反应式编程的新手，而且文档种类有限。

感谢您的帮助。

将基本auth和oauth jwt与WebFluxSecurity混合

0 个答案: