使用角色检查在Tomcat上集成Spring Security和Waffle

时间：2013-02-19 19:41:58

标签： java windows spring tomcat spring-security

正如标题所示，我正在尝试使用角色将Spring Security和Waffle集成到Tomcat上。该应用程序将部署到Windows环境，在该环境中用户已经过域身份验证，我想要进行单点登录。为了更进一步，我想检查经过身份验证的用户所属的组并配置拦截器，以防止不是已批准组成员的用户访问该Web应用程序。

这是应用程序上下文的样子：

<?xml version="1.0" encoding="UTF-8"?>

<beans xmlns="http://www.springframework.org/schema/beans"
    xmlns:p="http://www.springframework.org/schema/p"
    xmlns:cache="http://www.springframework.org/schema/cache"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:mvc="http://www.springframework.org/schema/mvc"
xmlns:sec="http://www.springframework.org/schema/security"
xmlns:context="http://www.springframework.org/schema/context"
xsi:schemaLocation="http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
http://www.springframework.org/schema/security
http://www.springframework.org/schema/security/spring-security-3.1.xsd
http://www.springframework.org/schema/mvc
http://www.springframework.org/schema/mvc/spring-mvc-3.0.xsd
http://www.springframework.org/schema/context
http://www.springframework.org/schema/context/spring-context-3.0.xsd
http://www.springframework.org/schema/cache http://www.springframework.org/schema/cache/spring-cache-3.1.xsd">


<mvc:annotation-driven />
<cache:annotation-driven />
<import resource="mvc-config.xml"/>


<!--WAFFLE CONFIG-->

<!-- windows authentication provider -->
<bean id="waffleWindowsAuthProvider" class="waffle.windows.auth.impl.WindowsAuthProviderImpl" />

<!-- collection of security filters -->
<bean id="negotiateSecurityFilterProvider" class="waffle.servlet.spi.NegotiateSecurityFilterProvider">
    <constructor-arg ref="waffleWindowsAuthProvider" />
</bean>

<bean id="waffleSecurityFilterProviderCollection" class="waffle.servlet.spi.SecurityFilterProviderCollection">
    <constructor-arg>
        <list>
            <ref bean="negotiateSecurityFilterProvider" />
            <ref bean="basicSecurityFilterProvider" />
        </list>
    </constructor-arg>
</bean>

<!-- spring filter entry point -->
<sec:http use-expressions="true" entry-point-ref="negotiateSecurityFilterEntryPoint">
    <sec:intercept-url pattern="/**" access="hasRole('APP_USER')" />
    <sec:custom-filter ref="waffleNegotiateSecurityFilter" position="BASIC_AUTH_FILTER" />
</sec:http>

<bean id="basicSecurityFilterProvider" class="waffle.servlet.spi.BasicSecurityFilterProvider">
    <constructor-arg ref="waffleWindowsAuthProvider" />
</bean>   

<bean id="negotiateSecurityFilterEntryPoint" class="waffle.spring.NegotiateSecurityFilterEntryPoint">
    <property name="Provider" ref="waffleSecurityFilterProviderCollection" />
</bean>

<!-- spring authentication provider -->
<sec:authentication-manager alias="authenticationProvider" />

<!-- spring security filter -->
<bean id="waffleNegotiateSecurityFilter" class="waffle.spring.NegotiateSecurityFilter">
    <property name="Provider" ref="waffleSecurityFilterProviderCollection" />
    <property name="AllowGuestLogin" value="false" />
    <property name="PrincipalFormat" value="fqn" />
    <property name="RoleFormat" value="both" />
</bean>

<!--END WAFFLE CONFIG-->


<!-- the mvc resources tag does the magic -->
<mvc:resources mapping="/css/**" location="/css/" />
<mvc:resources mapping="/js/**" location="/js/" />
<mvc:resources mapping="/img/**" location="/img/" />

    <bean id="multipartResolver"
    class="org.springframework.web.multipart.commons.CommonsMultipartResolver">
    <property name="maxUploadSize" value="1000000" />
</bean>

    <bean id="excelExportView" class="com.mycompany.appname.view.ExcelExportView"></bean>

<context:component-scan base-package="com.mycompany.appname" />
    <bean id="cacheManager" class="org.springframework.cache.support.SimpleCacheManager">
        <property name="caches">
        <set>
            <bean class="org.springframework.cache.concurrent.ConcurrentMapCacheFactoryBean" p:name="columnNames"/>
        </set>
        </property>
    </bean>

    <beans profile="dev">
        <bean id="dataSource" destroy-method="close" class="org.apache.commons.dbcp.BasicDataSource">
            <qualifier value="internal"/>
            <property name="driverClassName" value="${jdbc.driverClassName}" />
            <property name="url" value="${jdbc.internal.url}" />
            <property name="username" value="${jdbc.internal.username}" />
            <!--<property name="password" value="${jdbc.internal.password}"/>-->
            <property name="minEvictableIdleTimeMillis" value="120000"/>
            <property name="testOnBorrow" value="true" />
            <property name="timeBetweenEvictionRunsMillis" value="120000"/>
            <property name="minIdle" value="1"/>
        </bean>

        <bean id="dataSourceExternal" destroy-method="close" class="org.apache.commons.dbcp.BasicDataSource">
            <qualifier value="external"/>
            <property name="driverClassName" value="${jdbc.driverClassName}" />
            <property name="url" value="${jdbc.external.url}" />
            <property name="username" value="${jdbc.external.username}" />
            <!--<property name="password" value="${jdbc.external.password}"/>-->
            <property name="minEvictableIdleTimeMillis" value="120000"/>
            <property name="testOnBorrow" value="true" />
            <property name="timeBetweenEvictionRunsMillis" value="120000"/>
            <property name="minIdle" value="1"/>
        </bean>
        <bean class="org.springframework.beans.factory.config.PropertyPlaceholderConfigurer">
                <property name="location" value="/WEB-INF/db-dev.properties"></property>
        </bean>
    </beans>

    <beans profile="test">
        <bean id="dataSource" destroy-method="close" class="org.apache.commons.dbcp.BasicDataSource">
            <qualifier value="internal"/>
            <property name="driverClassName" value="${jdbc.driverClassName}" />
            <property name="url" value="${jdbc.internal.url}" />
            <property name="minEvictableIdleTimeMillis" value="120000"/>
            <property name="testOnBorrow" value="true" />
            <property name="timeBetweenEvictionRunsMillis" value="120000"/>
            <property name="minIdle" value="1"/>
        </bean>

        <bean id="dataSourceExternal" destroy-method="close" class="org.apache.commons.dbcp.BasicDataSource">
            <qualifier value="external"/>
            <property name="driverClassName" value="${jdbc.driverClassName}" />
            <property name="url" value="${jdbc.external.url}" />
            <property name="minEvictableIdleTimeMillis" value="120000"/>
            <property name="testOnBorrow" value="true" />
            <property name="timeBetweenEvictionRunsMillis" value="120000"/>
            <property name="minIdle" value="1"/>
        </bean>
        <bean class="org.springframework.beans.factory.config.PropertyPlaceholderConfigurer">
                <property name="location" value="/WEB-INF/db-test.properties"></property>
        </bean>
    </beans>

    <beans profile="production">
        <bean id="dataSource" destroy-method="close" class="org.apache.commons.dbcp.BasicDataSource">
            <qualifier value="internal"/>
            <property name="driverClassName" value="${jdbc.driverClassName}" />
            <property name="url" value="${jdbc.internal.url}" />
            <property name="minEvictableIdleTimeMillis" value="120000"/>
            <property name="testOnBorrow" value="true" />
            <property name="timeBetweenEvictionRunsMillis" value="120000"/>
            <property name="minIdle" value="1"/>
        </bean>

        <bean id="dataSourceExternal" destroy-method="close" class="org.apache.commons.dbcp.BasicDataSource">
            <qualifier value="external"/>
            <property name="driverClassName" value="${jdbc.driverClassName}" />
            <property name="url" value="${jdbc.external.url}" />
            <property name="minEvictableIdleTimeMillis" value="120000"/>
            <property name="testOnBorrow" value="true" />
            <property name="timeBetweenEvictionRunsMillis" value="120000"/>
            <property name="minIdle" value="1"/>
        </bean>
        <bean class="org.springframework.beans.factory.config.PropertyPlaceholderConfigurer">
                <property name="location" value="/WEB-INF/db-prod.properties"></property>
        </bean>
    </beans>

和web.xml 

<?xml version="1.0" encoding="ISO-8859-1"?>


<filter>
    <filter-name>springSecurityFilterChain</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
    <filter-name>springSecurityFilterChain</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

<!-- Beans in these files will makeup the configuration of the root web application context -->
<context-param>
    <param-name>contextConfigLocation</param-name>
    <param-value>/WEB-INF/appname-servlet.xml</param-value>     
</context-param>

<context-param>
    <param-name>log4jConfigLocation</param-name>
    <param-value>/WEB-INF/log4j.properties</param-value>
</context-param>

<listener>
    <listener-class>org.springframework.web.util.Log4jConfigListener</listener-class>
</listener>

<!--  Protect against XSS -->
<context-param>
    <param-name>defaultHtmlEscape</param-name>
    <param-value>true</param-value>
</context-param>

<listener>
    <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener> 


<!-- Deploys the 'accounts' dispatcher servlet whose configuration resides in /WEB-INF/mvc-config.xml -->
<servlet>
    <servlet-name>appname</servlet-name>
    <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
    <init-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>/WEB-INF/appname-servlet.xml</param-value>
    </init-param>
</servlet>

<!-- Maps all URLs to the 'appname' servlet -->
<servlet-mapping>
    <servlet-name>appname</servlet-name>
    <url-pattern>*.htm</url-pattern>
</servlet-mapping>

<!-- 
<error-page>
    <exception-type>java.lang.Exception</exception-type>
    <location>/error.jsp</location>
</error-page>
 -->
    <welcome-file-list>
        <welcome-file>/WEB-INF/views/appname_main.jsp</welcome-file>
    </welcome-file-list>     
<session-config>
    <session-timeout>60</session-timeout>
            <cookie-config>
              <http-only>true</http-only>
            </cookie-config>                
</session-config>

现在正在发生的是所有尝试点击应用“appName”的结果立即提示进行身份验证。通过阅读Waffle，我只能假设这是后备身份验证，因为它无法获取Windows令牌并对用户进行身份验证（通过尝试失败或凭据无效）。

以前的尝试包括不使用'hasRole'而是使用

access="IS_AUTHENTICATED_FULLY" />

这不会检查用户的角色，但至少会根据域身份验证限制对应用的访问。不幸的是，在这种情况下，它仍然会在用户每次点击应用时提示用户。至少这种配置实际上允许域用户访问应用程序，这与每次返回拒绝访问权限的'hasRole'方法不同。

任何见解都将受到赞赏......

[编辑：从我们的日志中添加一些细节]

事实证明，当我认为单点登录正在使用“IS_AUTHENTICATED_FULLY”时，我实际上得到了误报结果。浏览器正在缓存凭据并在请求中应用它们，因此SSO从未真正起作用。我一直得到提示。 ROLE_USER产生相同的结果：提示和接受凭证。

奇怪的是，我们在尝试从华夫饼中获取一些细节时遇到了麻烦。我们将以下行添加到Tomcat的conf logging.properties：

waffle.servlet.NegotiateSecurityFilter.level = FINE
waffle.servlet.spi.SecurityFilterProviderCollection.level = FINE
waffle.servlet.spi.NegotiateSecurityFilterProvider.level = FINE
waffle.servlet.spi.BasicSecurityFilterProvider.level = FINE

然而，localhost，catalina等没有提供关于华夫饼干的额外细节。

我们可以找到与游戏中角色相关的唯一日志信息是：

token:'org.springframework.security.authentication.AnonymousAuthenticationToken@905571d8:     Principal: anonymousUser; Credentials: [PROTECTED]; Authenticated: true; Details:     org.springframework.security.web.authentication.WebAuthenticationDetails@0:     RemoteIpAddress: 10.10.90.70; SessionId: null; Granted Authorities: ROLE_ANONYMOUS'>
2013-02-21 11:25:10,527 DEBUG [org.springframework.security.web.FilterChainProxy] -     </WEB-INF/views/ourappname_main.jsp at position 6 of 8 in additional filter chain; firing     Filter: 'SessionManagementFilter'>
2013-02-21 11:25:10,528 DEBUG [org.springframework.security.web.FilterChainProxy] -     </WEB-INF/views/ourappname_main.jsp at position 7 of 8 in additional filter chain; firing     Filter: 'ExceptionTranslationFilter'>
2013-02-21 11:25:10,528 DEBUG [org.springframework.security.web.FilterChainProxy] -     </WEB-INF/views/ourappname_main.jsp at position 8 of 8 in additional filter chain; firing     Filter: 'FilterSecurityInterceptor'>
2013-02-21 11:25:10,529 DEBUG    [org.springframework.security.web.access.intercept.FilterSecurityInterceptor] - <Secure     object: FilterInvocation: URL: /WEB-INF/views/ourappname_main.jsp; Attributes:     [IS_AUTHENTICATED_FULLY]>
   2013-02-21 11:25:10,529 DEBUG         [org.springframework.security.web.access.intercept.FilterSecurityInterceptor] - <Previously         Authenticated:        org.springframework.security.authentication.AnonymousAuthenticationToken@905571d8:         Principal: anonymous

从WFETCH我们捕获了这个：

User; Credentials: [PROTECTED]; 
Authenticated: true; 
Details: org.springframework.security.web.authentication.WebAuthenticationDetails@0: 
RemoteIpAddress: 10.10.10.10; 
SessionId: null; 
Granted Authorities: ROLE_ANONYMOUS>
http://10.10.10.10/ourappname/
Transfer-Encoding: chunked
Date: Thu, 21 Feb 2013 16:29:42 GMT

[再次编辑] 请求失败的呼叫中的标头信息。值得注意的是，Waffle-filter样本在使用localhost时根据需要正常工作，没有提示用户。使用IP或域时，会提示。我猜这是系统管理/可信主机问题？ 

GET /ourappnameHTTP/1.1
Accept: text/html, application/xhtml+xml, */*
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
Accept-Encoding: gzip, deflate
Host: localhost:8080
Connection: Keep-Alive

HTTP/1.1 302 Found
Server: Apache-Coyote/1.1
Location: http://localhost:8080/ourappname/
Transfer-Encoding: chunked
Date: Thu, 21 Feb 2013 20:15:51 GMT

GET /ourappname/ HTTP/1.1
Accept: text/html, application/xhtml+xml, */*
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
Accept-Encoding: gzip, deflate
Host: localhost:8080
Connection: Keep-Alive

HTTP/1.1 401 Unauthorized
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=F2216F75CBA6AC8476189DA48A63A872; Domain=.domain.tld;     Path=/something/; HttpOnly
Connection: keep-alive
WWW -Authenticate: Negotiate
WWW-Authenticate: NTLM
WWW-Authenticate: Basic realm="BasicSecurityFilterProvider"
Transfer-Encoding: chunked
Date: Thu, 21 Feb 2013 20:15:51 GMT

GET /fismacm/ HTTP/1.1
Accept: text/html, application/xhtml+xml, */*
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
Accept-Encoding: gzip, deflate
Host: localhost:8080
Connection: Keep-Alive
Authorization: Negotiate     YHkGBisGAQUFAqBvMG2gMDAuBgorBgEEAYI3AgIKBgkqhkiC9xIBAgIGCSqGSIb3EgECAgYKKwYBBAGCNwICHqI5BDd    OVExNU1NQAAEAAACXsgjiBAAEADMAAAALAAsAKAAAAAYBsR0AAAAPVzJLOFIyLURFVjFHT0xE

HTTP/1.1 401 Unauthorized
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=2CC0FDBF578629857113C6A72EE67FF5; Domain=.domain.tld;     Path=/something/; HttpOnly
Connection: keep-alive
WWW-Authenticate: Negotiate
WWW-Authenticate: NTLM
WWW-Authenticate: Basic realm="BasicSecurityFilterProvider"
Transfer-Encoding: chunked
Date: Thu, 21 Feb 2013 20:15:51 GMT

GET /favicon.ico HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
Host: localhost:8080
Connection: Keep-Alive

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Accept-Ranges: bytes
ETag: W/"21630-1349272326000"
Last-Modified: Wed, 03 Oct 2012 13:52:06 GMT
Content-Type: image/x-icon
Content-Length: 21630
Date: Thu, 21 Feb 2013 20:16:07 GMT

1 个答案:

答案 0 :(得分：0)

今天我遇到了同样的问题。

问题与Spring安全上下文中生成的 GrantedAuthority 的名称有关。默认情况下，这将设置为ROLE_“domain”\“role”，例如的 ROLE_MYDOMAIN \ MYROLE 即可。

这是你应该在hasRole检查中检查的名称。

请参阅以下文档：https://github.com/Waffle/waffle/blob/master/Docs/spring/SpringSecurityAuthenticationProvider.md，

授权机构

成功登录后，Waffle将使用GrantedAuthority实例填充Spring Security的Authentication对象。

默认情况下，Waffle将使用以下内容填充Authentication对象：

带有字符串ROLE_USER的GrantedAuthority。 用户所属的每个组一个GrantedAuthority。 GrantedAuthority字符串将是以ROLE_为前缀的大写组名称。例如，如果用户是Everyone组的成员，则他将获得授予ROLE_EVERYONE权限。 可以通过在waffleSpringAuthenticationProvider上配置不同的defaultGrantedAuthority和grantedAuthorityFactory来更改默认行为

相关问题
最新问题