Spring Boot Application

Question

我正在开发一个REST WebService。现在根据要求，我需要确保Web服务的安全。为此，我厌倦了通过启用基本身份验证在我的应用程序中使用Spring Security。但我还是可以在没有身份验证的情我只使用注释来完成所有配置。请帮帮我

UPDATE1：我在JBOSS EAP 6.4上部署它

这是启用安全性的WebSecurityConfig.java

@Configuration
@EnableGlobalMethodSecurity
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Value("${ldap.url}")
    private String ldapUrl;

    @Value("${ldap.userDN}")
    private String ldapuserDN;


    @Value("${ldap.password}")
    private String ldapPassword;


    @Override
    @Order(1)
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests().anyRequest().authenticated().and().httpBasic();
        //.and().csrf().disable();
    }

    @Override
    @Order(2)
    protected void configure(AuthenticationManagerBuilder authManagerBuilder) throws Exception {
        authManagerBuilder.authenticationProvider(activeDirectoryLdapAuthenticationProvider());
    }
    @Bean
    public AuthenticationManager authenticationManager() {
        return new ProviderManager(Arrays.asList(activeDirectoryLdapAuthenticationProvider()));
    }
    @Bean
    public AuthenticationProvider activeDirectoryLdapAuthenticationProvider() {
        LdapAuthenticationProvider provider = new LdapAuthenticationProvider(bindAuth());
        return provider;
    }
    @Bean
    public BindAuthenticator bindAuth(){
        BindAuthenticator bindAuther=new BindAuthenticator(ldapContext());
        String [] patternList=new String[1];
        patternList[0]="cn={0},ou=ColtUsers,dc=eu,dc=colt";
        bindAuther.setUserDnPatterns(patternList);
        return bindAuther;
    }
    @Bean
    public  DefaultSpringSecurityContextSource ldapContext(){
        DefaultSpringSecurityContextSource context= new DefaultSpringSecurityContextSource("ldap://host:390");
        context.setUserDn("dndeatils");
        context.setPassword("password");
        return context;
    }
}

这是appconfig.java

@Configuration 
@ComponentScan("package") 
@EnableWebMvc

public class AppConfig {  
} 

这是WebAppInitializer

public class WebAppInitializer implements WebApplicationInitializer {
    public void onStartup(ServletContext servletContext) throws ServletException {  
        AnnotationConfigWebApplicationContext ctx = new AnnotationConfigWebApplicationContext();  
        ctx.register(AppConfig.class);  
        ctx.register(WebSecurityConfig.class);
        ctx.setServletContext(servletContext);    
        Dynamic dynamic = servletContext.addServlet("dispatcher", new DispatcherServlet(ctx));  
        dynamic.addMapping("/*");  
        dynamic.setLoadOnStartup(1);  
   }  
} 

Answer 1

您需要在DelegatingFilterProxy

中添加WebAppInitializer

public class WebAppInitializer implements WebApplicationInitializer {
    public void onStartup(ServletContext servletContext) throws ServletException {  
        AnnotationConfigWebApplicationContext ctx = new AnnotationConfigWebApplicationContext();  
        ctx.register(AppConfig.class);  
        ctx.register(WebSecurityConfig.class);

        ctx.setServletContext(servletContext);    

        // This ContextLoaderListener 
        servletContext.addListener(new ContextLoaderListener(ctx));

        // This Filter 
        servletContext.addFilter("springSecurityFilterChain", new DelegatingFilterProxy("springSecurityFilterChain")).addMappingForUrlPatterns(null, false, "/*");

        Dynamic dynamic = servletContext.addServlet("dispatcher", new DispatcherServlet(ctx));  
        dynamic.addMapping("/*");  
        dynamic.setLoadOnStartup(1);  
   }  
}