Question

我在Grails应用程序中实现了一个spring security preathentication过滤器，以便与Tivoli Access Manager集成。

为我的Web应用程序中的每个请求调用过滤器 - 但即使过滤器返回与先前请求相同的主体，它似乎也会创建一个新会话。我创建了一个ApplicationListener来监听身份验证事件，我可以看到一个新的AuthenticationSuccessEvent，每个请求都有一个新的会话ID。

这意味着我的所有会话变量都会被清除每个请求 - 这不会是一个大问题，但会打破上传者插件。

当我为我的预身份验证过滤器启用调试日志记录时，我发现它认为主体已更改，即使它没有：

2015-03-04 11:34:57.769 foobar.TamAuthenticationFilter Checking secure context token: org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationToken@f0666480: Principal: grails.plugin.springsecurity.userdetails.GrailsUser@3125618: Username: 66734; Password: [PROTECTED]; Enabled: true; AccountNonExpired: true; credentialsNonExpired: true; AccountNonLocked: true; Granted Authorities: ROLE_ADMIN,ROLE_APPROVER; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@fffde5d4: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: 87928D9E25D98DD3CCFAC5D67689E609; Granted Authorities: ROLE_ADMIN, ROLE_APPROVER
2015-03-04 11:34:57.770 foobar.TamAuthenticationFilter Pre-authenticated principal has changed to 66734 and will be reauthenticated
2015-03-04 11:34:57.770 foobar.TamAuthenticationFilter Invalidating existing session
2015-03-04 11:34:57.771 foobar.TamAuthenticationFilter preAuthenticatedPrincipal = 66734, trying to authenticate

如何让spring security对预身份验证过滤器返回的每个主体使用相同的会话，而不是为每个请求创建一个新会话？

这是我的过滤器：

package foobar

import org.springframework.security.web.authentication.preauth.AbstractPreAuthenticatedProcessingFilter
import grails.util.Environment
import grails.util.Holders
import groovy.util.logging.Log4j

@Log4j
class TamAuthenticationFilter extends   AbstractPreAuthenticatedProcessingFilter {

java.lang.Object getPreAuthenticatedCredentials(javax.servlet.http.HttpServletRequest request)
{
    "N/A"
}

java.lang.Object getPreAuthenticatedPrincipal(javax.servlet.http.HttpServletRequest request)
{
    Long staffId = getStaffIdFromTamHeader(request)
    if(!staffId)
        log.error "iv-user header not found"

    return staffId
}

/**
 * Get Staff ID from the ivUser Tamheader.
 * @param request
 * @return
 */
static public Long getStaffIdFromTamHeader(request) {
    return request.getHeader("iv-user")
}

}

LoggingSecurityEventListener：

 package foobar

 import groovy.util.logging.Log4j
 import org.springframework.context.ApplicationListener
 import org.springframework.security.authentication.event.AbstractAuthenticationEvent


 @Log4j
 class LoggingSecurityEventListener implements
    ApplicationListener<AbstractAuthenticationEvent> {

void onApplicationEvent(AbstractAuthenticationEvent event) {

    def username = event.authentication.principal
    def address = event.authentication.details.remoteAddress
    def sessionId = event.authentication.details.sessionId

    log.info "event=${event.class.simpleName} username=${username} remoteAddress=${address} sessionId=${sessionId}"

}

 }

resources.groovy：

beans = {
//
// grabs the user id from the tam headers 
//
tamAuthenticationFilter(TamAuthenticationFilter) {
    authenticationManager = ref('authenticationManager')
    checkForPrincipalChanges = true
}

tamAuthenticationProvider(PreAuthenticatedAuthenticationProvider) {
   preAuthenticatedUserDetailsService = ref('authenticationUserDetailsService')
}

//
// we do not want to redirect to the auth/login page since we are using tam
//
authenticationEntryPoint(Http403ForbiddenEntryPoint)

securityEventListener(LoggingSecurityEventListener)
}

Config.groovy中：

 grails.plugin.springsecurity.useSecurityEventListener = true
 grails.plugin.springsecurity.providerNames = ['tamAuthenticationProvider']

 grails.plugin.springsecurity.userLookup.userDomainClassName = 'strobe.auth.User'
 grails.plugin.springsecurity.userLookup.authorityJoinClassName = 'strobe.auth.UserRole'
 grails.plugin.springsecurity.authority.className = 'strobe.auth.Role'
 grails.plugin.springsecurity.securityConfigType="InterceptUrlMap"
 grails.plugin.springsecurity.interceptUrlMap = [
                                            '/foobar/**':                   ['ROLE_USER']]

BootStrap.groovy中：

 def init = { servletContext ->                   SpringSecurityUtils.clientRegisterFilter('tamAuthenticationFilter',
            SecurityFilterPosition.PRE_AUTH_FILTER.order + 10)
 }

Answer 1

我找到了解决问题的方法 - 我从getPreauthenticatedPrincipal（）返回了一个Long，它混淆了spring安全性，因为方法要求AbstractPreauthenticatedProcessingFilter中的Authentication（）有这行代码：

    if ((principal instanceof String) && currentUser.getName().equals(principal)) {
        return false;
    }

它希望主体是一个String。每当我回来很长时间，它都会重新进行认证并给我一个新的会议。

我无法相信解决方案就这么简单，我花了2天才弄明白!!!

我认为部分问题是关于春季预身份验证的文档以及方法签名：

java.lang.Object getPreAuthenticatedPrincipal(javax.servlet.http.HttpServletRequest request)

没有明确建议返回类型。

Spring Security预身份验证 - 即使主体未更改，也会为我提供一个新会话

1 个答案: