我使用的是Spring 4.0.8 RELEASE和Spring-Security 3.2.5 RELEASE
我正在使用只有注册用户才能访问的HTTP摘要构建REST WebService。
我的web.xml是这样的:
<servlet>
<servlet-name>rest</servlet-name>
<servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
<init-param>
<param-name>contextConfigLocation</param-name>
<param-value>/WEB-INF/applicationContext.xml</param-value>
</init-param>
<load-on-startup>1</load-on-startup>
</servlet>
<servlet-mapping>
<servlet-name>rest</servlet-name>
<url-pattern>/*</url-pattern>
</servlet-mapping>
<listener>
<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>
<filter>
<filter-name>springSecurityFilterChain</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
<filter-name>springSecurityFilterChain</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
applicationContext.xml包含我的Controller / DAO,对此只有这个:
<import resource="security-context.xml" />
<bean id="daoPersonal" class="com.test.dao.PersonalDAO">
<property name="dataSource" ref="dataSource" />
</bean>
现在security-context.xml看起来像这样:
<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security" xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="
http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans-4.0.xsd
http://www.springframework.org/schema/security
http://www.springframework.org/schema/security/spring-security-3.2.xsd">
<debug />
<http entry-point-ref="digestEntryPoint">
<headers />
<intercept-url pattern="/**" access="ROLE_USER" />
<custom-filter ref="digestFilter" after="BASIC_AUTH_FILTER" />
</http>
<beans:bean id="digestFilter" class="org.springframework.security.web.authentication.www.DigestAuthenticationFilter">
<beans:property name="userDetailsService" ref="daoPersonal" />
<beans:property name="authenticationEntryPoint" ref="digestEntryPoint" />
</beans:bean>
<beans:bean id="digestEntryPoint" class="org.springframework.security.web.authentication.www.DigestAuthenticationEntryPoint">
<beans:property name="realmName" value="Contacts Realm via Digest Authentication" />
<beans:property name="key" value="acegi" />
</beans:bean>
<beans:bean id="bcryptEncoder" class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder" />
<authentication-manager>
<authentication-provider user-service-ref="daoPersonal">
<password-encoder ref="bcryptEncoder" />
</authentication-provider>
</authentication-manager>
</beans:beans>
和我的PersonalDAO
public class PersonalDAO extends NamedParameterJdbcDaoSupport implements UserDetailsService {
/*my other code
...
*/
@Override
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
System.out.println(new Date() + " PersonalDAO loadUserByUsername: " + username);
List<UserDetails> users = getJdbcTemplate().query(USER_QUERY, new String[] {username}, new RowMapper<UserDetails>() {
public UserDetails mapRow(ResultSet rs, int rowNum) throws SQLException {
String username = rs.getString(1);
String password = rs.getString(2);
boolean enabled = true;
Collection<GrantedAuthority> auths = new ArrayList<GrantedAuthority>();
auths.add(new SimpleGrantedAuthority("ROLE_USER"));
return new User(username, password, enabled, true, true, true, auths);
}
});
if(users.size()==0){
throw new UsernameNotFoundException("");
}
System.out.println(new Date() + "Users Found: " + users.size());
return users.get(0);
}
}
如果没有身份验证提供程序中的密码编码器,则可以使用数据库中的明文密码按预期工作。但是使用密码编码器(并且db中的密码更改为bcrypt编码密码),浏览器会指出登录错误并再次提示。从我的输出中我可以看到我的PersonalDAO被调用并找到了用户。
我的数据库中还有另一个用户仍然有明文密码,我尝试使用该密码登录,同时仍然激活bcryptencoder我在服务器日志中得到这个:
org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder matches
WARNING: Encoded password does not look like BCrypt
现在我至少可以看到BCryptEncoder被调用了,但是它得到了一个匹配,意味着什么都没有被编码,我仍然无法进入。(这可能是预期的)。
我错过了什么?
编辑:
日志输出还有很多,但这里有:
Fri Dec 05 15:07:06 CET 2014 PersonalDAO loadUserByUsername: test
Fri Dec 05 15:07:06 CET 2014 Users Found: 1
db中的加密密码: $ 2A $ 10 $ HWX95PBi7pob2bmIHXka3ecMcfsSvEifV3Z6J0CAb3vpWs8N9j5xS
答案 0 :(得分:6)
无法使用HTTP摘要式身份验证和BCrypt密码编码器的组合。这是因为HTTP摘要算法要求密码以明文形式存储。您必须更改身份验证方法或删除密码编码。