Question

我正在使用Spring Security和Spring Boot，并通过JASIG CAS对我的用户进行身份验证。有些页面需要显式身份验证（.authenticated（）），其中一些是针对所有用户的。

现在菜单中有一个区域，表示当前用户和可能的操作，例如登录/注销。

我的主要问题是主页面是公共的（permitAll（）），如果用户已经通过其他应用程序进行了CAS会话，那么他将被显示为＆＃34; anonymousUser＆＃34;直到手动点击登录或打开受保护的页面。

是否有人对如何使其发挥作用有任何想法？

我的安全配置：

import org.jasig.cas.client.validation.Cas20ServiceTicketValidator;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.env.Environment;
import org.springframework.security.cas.ServiceProperties;
import org.springframework.security.cas.authentication.CasAuthenticationProvider;
 import org.springframework.security.cas.web.CasAuthenticationEntryPoint;
import org.springframework.security.cas.web.CasAuthenticationFilter;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.method.configuration.GlobalMethodSecurityConfiguration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.builders.WebSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.userdetails.AuthenticationUserDetailsService;
import org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler;

@Configuration
@EnableWebSecurity
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

@Autowired
private Environment env;

@Autowired
private CasAuthenticationProvider authProvider;

@Bean
public ServiceProperties serviceProperties() {
    ServiceProperties sp = new ServiceProperties();
    sp.setSendRenew(false);
    sp.setService(env.getProperty("app.url") + "/j_spring_cas_security_check");
    return sp;
}

@SuppressWarnings("rawtypes")
@Autowired
private AuthenticationUserDetailsService customUserDetailsService() {
    return new CASUserDetailsService();
}


@Bean
public CasAuthenticationProvider casAuthenticationProvider() {
    CasAuthenticationProvider casAuthenticationProvider = new CasAuthenticationProvider();
    casAuthenticationProvider.setAuthenticationUserDetailsService(customUserDetailsService());
    casAuthenticationProvider.setServiceProperties(serviceProperties());
    casAuthenticationProvider.setTicketValidator(cas20ServiceTicketValidator());
    casAuthenticationProvider.setKey("an_id_for_this_auth_provider_only");
    return casAuthenticationProvider;
}

@Bean
public Cas20ServiceTicketValidator cas20ServiceTicketValidator() {
    return new Cas20ServiceTicketValidator(env.getProperty("cas.service.url"));
}

@Bean
public CasAuthenticationFilter casAuthenticationFilter() throws Exception {
    CasAuthenticationFilter casAuthenticationFilter = new CasAuthenticationFilter();
    casAuthenticationFilter.setAuthenticationManager(authenticationManager());
    casAuthenticationFilter.setAuthenticationSuccessHandler(savedRequestAwareAuthenticationSuccessHandler());
    return casAuthenticationFilter;
}

@Bean
public CasAuthenticationEntryPoint casAuthenticationEntryPoint() {
    CasAuthenticationEntryPoint ep = new CasAuthenticationEntryPoint();
    ep.setLoginUrl(env.getProperty("cas.service.url") + "/login");
    ep.setServiceProperties(serviceProperties());
    return ep;
}

@Autowired
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
    auth.authenticationProvider(authProvider);
}

@Override
public void configure(WebSecurity web) throws Exception {
    web.ignoring().antMatchers("/js/**").antMatchers("/fonts/**").antMatchers("/images/**").antMatchers("/css/**");
}

@Override
protected void configure(HttpSecurity http) throws Exception {
    http.exceptionHandling().
            authenticationEntryPoint(casAuthenticationEntryPoint()).and().addFilter(casAuthenticationFilter()).
            logout().logoutUrl("/caslogout").addLogoutHandler(logoutHandler()).logoutSuccessUrl("/").deleteCookies("JSESSIONID").permitAll().and().
            csrf().disable().headers().frameOptions().disable().authorizeRequests().antMatchers("/rest/**").permitAll().
            antMatchers("/login/**").authenticated().antMatchers("/settings/**").authenticated().
            antMatchers("/projects/*/settings").authenticated().antMatchers("/projects/*/role").authenticated().
            antMatchers("/projects/*/*/admin").authenticated().antMatchers("/**").permitAll();
}


@Bean
public SavedRequestAwareAuthenticationSuccessHandler savedRequestAwareAuthenticationSuccessHandler() {
    CASAuthSuccessHandler auth = new CASAuthSuccessHandler();
    return auth;
}

@Bean
public CASLogoutHandler logoutHandler() {
    CASLogoutHandler logout = new CASLogoutHandler();
    return logout;
}


@EnableGlobalMethodSecurity(prePostEnabled = true, jsr250Enabled = true)
private static class GlobalSecurityConfiguration extends GlobalMethodSecurityConfiguration {
}

}

Answer 1

您正在寻找的是CAS的网关功能。目前，Spring Security不支持此功能。记录了JIRA以支持它，Pull Request根据我对提交者的反馈等待其他修改。

我将看一下Pull Request，因为它演示了一些如何实现它的选项。请仔细阅读整篇文章，因为您需要对Pull Request进行一些更改，以确保您的应用程序能够正常运行。

在public（permitAll（））页面上自动确定CAS用户

1 个答案: