Question

我正在尝试使用Spring Security 3.2.4在Spring 4.0.6应用程序中从Active Directory收集用户权限。

一些细节：

身份验证有效。我可以获得当前的用户名。
预认证由JBoss 7.2使用JCIFS（NTLM）完成。
LDAP服务器正常工作，因此主机和端口正确无误。
域名是正确的。

SecurityConfig.java

@Configuration
@EnableWebMvcSecurity
@PropertySource( "classpath:/resources/ldap-config.properties" )
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Value( "${domain}" )
    private String strDomain;

    @Value( "${ldap.host}" )
    private String strHost;

    @Value( "${ldap.basedn}" )
    private String strBaseDn;

    @Value( "${ldap.userdn}" )
    private String strUserDn;

    @Value( "${ldap.userdn.password}" )
    private String strUserDnPassword;

    @Bean
    public static PropertySourcesPlaceholderConfigurer propertySourcesPlaceholderConfigurer() {
        return new PropertySourcesPlaceholderConfigurer();
    }

    @Bean 
    public ActiveDirectoryGrantedAuthoritiesMapper grantedAuthoritiesMapper() {
        return new ActiveDirectoryGrantedAuthoritiesMapper();
    }

    @Bean
    public ActiveDirectoryLdapAuthenticationProvider activeDirectoryLdapAuthenticationProvider() {

        ActiveDirectoryLdapAuthenticationProvider activeDirectoryLdapAuthenticationProvider = new ActiveDirectoryLdapAuthenticationProvider(strDomain, strHost);
        activeDirectoryLdapAuthenticationProvider.setUseAuthenticationRequestCredentials(true);
        activeDirectoryLdapAuthenticationProvider.setConvertSubErrorCodesToExceptions(true);

        activeDirectoryLdapAuthenticationProvider.setAuthoritiesMapper(this.grantedAuthoritiesMapper());

        return activeDirectoryLdapAuthenticationProvider;
    }

    @Override
    public void configure(AuthenticationManagerBuilder authenticationManagerBuilder) throws Exception {

        authenticationManagerBuilder
        .authenticationProvider(this.activeDirectoryLdapAuthenticationProvider());
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {

        http
            .authorizeRequests()
                .anyRequest().authenticated()
            .and()
            .jee();
    }
}

ActiveDirectoryGrantedAuthoritiesMapper.java

public class ActiveDirectoryGrantedAuthoritiesMapper implements GrantedAuthoritiesMapper {

    // Constants for group defined in LDAP
    private final String ROLE_ADMIN = "A_SPECIFIC_ADMIN_GROUP_IN_AD";
    private final String ROLE_USER = "A_SPECIFIC_GROUP_IN_AD";

    public ActiveDirectoryGrantedAuthoritiesMapper() {
    }

    @Override
    public Collection<? extends GrantedAuthority> mapAuthorities(final Collection<? extends GrantedAuthority> authorities) {

        Set<SecurityContextAuthority> roles = EnumSet.noneOf(SecurityContextAuthority.class);

        for (GrantedAuthority authority : authorities) {

            System.out.println("GrantedAuthority : " + authority.getAuthority());

            if (ROLE_ADMIN.equals(authority.getAuthority())) {
                roles.add(SecurityContextAuthority.ROLE_ADMIN);
            }

            if (ROLE_USER.equals(authority.getAuthority())) {
                roles.add(SecurityContextAuthority.ROLE_USER);
            }
        }

        return roles;
    }

}

SecurityContextAuthority.java

public enum SecurityContextAuthority implements GrantedAuthority {

    ROLE_ADMIN, ROLE_USER;

    @Override
    public String getAuthority() {
        return name();
    }
}

我在控制台中得到了什么：

2014-10-14 14:04:02,557 INFO  [stdout] (http-localhost/127.0.0.1:8080-2) MY_DOMAIN\MY_USERNAME
2014-10-14 14:04:02,557 INFO  [stdout] (http-localhost/127.0.0.1:8080-2) Authorities: []
2014-10-14 14:04:02,557 INFO  [stdout] (http-localhost/127.0.0.1:8080-2) Auth Type: NTLM
2014-10-14 14:04:02,557 INFO  [stdout] (http-localhost/127.0.0.1:8080-2) Is Authenticated: true

打开调试后，我得到了更多详细信息：

2014-10-16 11:10:50,959 DEBUG [org.springframework.security.web.authentication.preauth.j2ee.J2eePreAuthenticatedProcessingFilter] (http-localhost/127.0.0.1:8080-1) Checking secure context token: null
2014-10-16 11:10:50,959 DEBUG [org.springframework.security.web.authentication.preauth.j2ee.J2eePreAuthenticatedProcessingFilter] (http-localhost/127.0.0.1:8080-1) PreAuthenticated J2EE principal: MY_DOMAIN\MY_USERNAME
2014-10-16 11:10:50,959 DEBUG [org.springframework.security.web.authentication.preauth.j2ee.J2eePreAuthenticatedProcessingFilter] (http-localhost/127.0.0.1:8080-1) preAuthenticatedPrincipal = MY_DOMAIN\MY_USERNAME, trying to authenticate
2014-10-16 11:10:50,959 DEBUG [org.springframework.security.web.authentication.preauth.j2ee.J2eeBasedPreAuthenticatedWebAuthenticationDetailsSource] (http-localhost/127.0.0.1:8080-1) J2EE roles [[]] mapped to Granted Authorities: [[]]
2014-10-16 11:10:50,960 DEBUG [org.springframework.security.authentication.ProviderManager] (http-localhost/127.0.0.1:8080-1) Authentication attempt using org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationProvider
2014-10-16 11:10:50,960 DEBUG [org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationProvider] (http-localhost/127.0.0.1:8080-1) PreAuthenticated authentication request: org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationToken@f99efc97: Principal: MY_DOMAIN\MY_USERNAME; Credentials: [PROTECTED]; Authenticated: false; Details: org.springframework.security.web.authentication.preauth.PreAuthenticatedGrantedAuthoritiesWebAuthenticationDetails@380f4: RemoteIpAddress: 127.0.0.1; SessionId: FaMwocWCdZawHD1GvwUcNg8S; []; Not granted any authorities
2014-10-16 11:10:50,960 DEBUG [org.springframework.security.web.authentication.preauth.j2ee.J2eePreAuthenticatedProcessingFilter] (http-localhost/127.0.0.1:8080-1) Authentication success: org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationToken@661034c: Principal: org.springframework.security.core.userdetails.User@f99c56bc: Username: MY_DOMAIN\MY_USERNAME; Password: [PROTECTED]; Enabled: true; AccountNonExpired: true; credentialsNonExpired: true; AccountNonLocked: true; Not granted any authorities; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.preauth.PreAuthenticatedGrantedAuthoritiesWebAuthenticationDetails@380f4: RemoteIpAddress: 127.0.0.1; SessionId: FaMwocWCdZawHD1GvwUcNg8S; []; Not granted any authorities

其他调试信息：

当局总是空的
似乎永远不会调用mapAuthorities和getAuthority。添加断点什么都不做。

非常感谢任何帮助。

Answer 1

我不知道你是否解决了问题。但是，你的描述帮我解决了我的问题。我几乎根据你的代码实现了权限映射器，它运行得很好。我唯一可以看到可能导致空权限字段的是调用映射器时字段为空，或者参数中没有任何权限映射到定义为ROLE_USER和ROLE_ADMIN的AD角色。

Spring Security授权机构总是空着

1 个答案: