Question

我们正在将项目从LDAP身份验证转换为简单的SAML身份验证。我们有自己的验证（“userValidation”），我们在LDAP身份验证中调用successhandler方法（下面的示例代码）。我们在将此验证方法转换为简单的SAML security-context.xml文件时遇到问题。您可以通过此验证帮助我在SAML中如何做到这一点吗？还提供基于XML开发的等效解决方案。

@Override
protected void configure(HttpSecurity http) throws Exception {

   http
            .csrf().disable()
            .authorizeRequests()
                .anyRequest().authenticated()
            .and()
            .formLogin().successHandler(userValidation)
                .loginPage("/login").permitAll()
            .and()
            .logout().permitAll();
}

Answer 1

这个在Spring安全配置的结构我希望它能帮助你为你的AuthenticationSuccuessHandler提供一个你需要放入一个类然后引用它

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.builders.WebSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import javax.sql.DataSource ;

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    //Pour l'authentification des Utilisateur de Table Utilisateur
@Autowired
Securityhandler Myauthen  ;


@Autowired  
public void GlobalConfig(AuthenticationManagerBuilder auth,DataSource dataSource) throws Exception {
auth.jdbcAuthentication()
    .dataSource(dataSource) 
    .usersByUsernameQuery("SELECT  \"Pseudo\" AS principal , \"Password\" AS  credentials , true FROM \"UTILISATEUR\" WHERE \"Pseudo\" =  ? ")
            .authoritiesByUsernameQuery("SELECT  u.\"Pseudo\" AS principal , r.role as role  FROM \"UTILISATEUR\" u ,\"Role\" r where u.id_role=r.id_role AND \"Pseudo\" = ?  ")
                .rolePrefix("_ROLE");
}
    //ne pas appliqué la securité sur les ressources 
@Override
public void configure(WebSecurity web) throws Exception {
    web.ignoring()
    .antMatchers("/bootstrap/**","/css/**");

}
@Override
protected void configure(HttpSecurity http) throws Exception {
http

    .csrf().disable()   
    .authorizeRequests()

    .anyRequest()   
        .authenticated()        
            .and()
            .formLogin()
            .loginPage("/login")
            .permitAll()
            .successHandler(Myauthen);

}

}

简单的SAML Successhandler

1 个答案: