Question

我要求在登录页面上我有一个userId，密码字段以及另一个名为customer的文本输入字段。如果用户使用userId和密码登录，我的弹簧安全配置效果很好。第二种登录方案是如果客户只输入他们的客户ID，他们也应该登录到不同的页面。如何使两个不同的登录使用来自同一登录页面的相同spring-security xml配置。

    <security:http auto-config="true" use-expressions="true" >
     <!-- URL restrictions (order is important!) Most specific matches should be at top -->

     <!-- Don't set any role restrictions on login.jsp.  Any requests for the login page should be available for anonymous users -->    
     <security:intercept-url pattern="/login.jsp*" access="isAuthenticated()" /> 


     <security:access-denied-handler error-page="/noaccess.jsp" />
     <security:intercept-url pattern="/board.htm" access="hasRole('ROLE_ALL_USER')"  />
     <security:intercept-url pattern="/AddItems.htm*" access="hasRole('ROLE_USER')" />


     <!-- Set the login page and what to do if login fails -->    
     <security:form-login login-page="/login.jsp" authentication-failure-url="/login.jsp?login_error=1"  />

      <!-- Set the logout page and where to go after logout is successful -->   

      <security:logout logout-url="/logout" logout-success-url="/logoutSuccess.jsp" />

      <security:custom-filter position="PRE_AUTH_FILTER" ref="customPreAuthFilter" />

      <security:custom-filter ref="switchUserFilter" position="SWITCH_USER_FILTER" />

</security:http>
<security:http>

</security:http>



<beans:bean id="customPreAuthFilter" class="org.springframework.security.web.authentication.preauth.j2ee.J2eePreAuthenticatedProcessingFilter">
    <beans:property name="authenticationManager" ref="authenticationManager" />
</beans:bean>

<security:authentication-manager alias="authenticationManager">
    <security:authentication-provider ref="preauthAuthProvider" />
</security:authentication-manager>

<!-- Load the UserDetails object for the user. -->
<beans:bean id="preauthAuthProvider" class="org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationProvider">
    <beans:property name="preAuthenticatedUserDetailsService">
      <beans:bean id="userDetailsServiceWrapper" class="org.springframework.security.core.userdetails.UserDetailsByNameServiceWrapper">
        <beans:property name="userDetailsService" ref="currentUserDetailsService"/>
      </beans:bean>
    </beans:property>
</beans:bean>

<!-- Aliasing (Switch User) -->
<beans:bean id="switchUserFilter" class="org.springframework.security.web.authentication.switchuser.SwitchUserFilter">
    <beans:property name="userDetailsService" ref="currentUserDetailsService" />
  </beans:bean>

由于 Dhiren

@Ritesh 感谢您的链接..我尝试了您的解决方案，但我的过滤器未被调用。是否需要修改web.xml。我试图实现整个springSecurityFilterChain的任何方式，但我仍然无法从我的登录表单调用我的过滤器。我需要调用的过滤器是customBadgeAuthFilter

<beans:bean id="springSecurityFilterChain" class="org.springframework.security.web.FilterChainProxy">
    <beans:constructor-arg>
        <beans:list>

            <security:filter-chain pattern="/resources/**" filters="none"/>
            <security:filter-chain pattern="/**"
                filters="securityContextPersistenceFilterWithASCTrue,    
                                                      logoutFilter,   
                                                      customBadgeAuthFilter,   
                                                         formLoginFilter, 
                                                         formLoginExceptionTranslationFilter,
                                                         filterSecurityInterceptor" />
        </beans:list>
    </beans:constructor-arg>
</beans:bean>

<beans:bean id="securityContextPersistenceFilterWithASCTrue"
    class="org.springframework.security.web.context.SecurityContextPersistenceFilter">
    <beans:constructor-arg>
        <beans:bean class="org.springframework.security.web.context.HttpSessionSecurityContextRepository"/>
    </beans:constructor-arg>
</beans:bean>

<beans:bean id="formLoginExceptionTranslationFilter"
    class="org.springframework.security.web.access.ExceptionTranslationFilter">
    <beans:constructor-arg>
        <beans:bean
            class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint">
            <beans:constructor-arg value="/login"/>                
        </beans:bean>
    </beans:constructor-arg>
    <beans:property name="accessDeniedHandler">
        <beans:bean
            class="org.springframework.security.web.access.AccessDeniedHandlerImpl">
            <beans:property name="errorPage" value="/exception" />
        </beans:bean>
    </beans:property>
</beans:bean>

<beans:bean id="formLoginFilter"
    class="org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter">
    <beans:property name="authenticationManager" ref="authenticationManager"/>
    <beans:property name="allowSessionCreation" value="true"/>
    <beans:property name="authenticationSuccessHandler">
        <beans:bean class="org.springframework.security.web.authentication.SimpleUrlAuthenticationSuccessHandler">
            <beans:constructor-arg value="/"/>
            <beans:property name="alwaysUseDefaultTargetUrl" value="true"/>
        </beans:bean>
    </beans:property>
    <beans:property name="authenticationFailureHandler">
        <beans:bean class="org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler">
            <beans:constructor-arg value="/login?error=true"/>
        </beans:bean>
    </beans:property>
</beans:bean>

<beans:bean id="filterSecurityInterceptor"
    class="org.springframework.security.web.access.intercept.FilterSecurityInterceptor">
    <beans:property name="authenticationManager" ref="authenticationManager" />
    <beans:property name="accessDecisionManager" ref="accessDecisionManager" />
    <beans:property name="runAsManager" ref="runAsManager" />
    <beans:property name="securityMetadataSource">
        <security:filter-security-metadata-source use-expressions="true">
            <security:intercept-url pattern="/**"
                access="isAuthenticated()" />
        </security:filter-security-metadata-source>
    </beans:property>
</beans:bean>

<beans:bean id="accessDecisionManager"
    class="org.springframework.security.access.vote.AffirmativeBased">
    <beans:constructor-arg>
        <beans:list>
            <beans:bean class="org.springframework.security.access.vote.RoleVoter"/>
            <beans:bean class="org.springframework.security.web.access.expression.WebExpressionVoter"/>
        </beans:list>
    </beans:constructor-arg>
    <beans:property name="allowIfAllAbstainDecisions" value="false"/>
</beans:bean>

<beans:bean id="runAsManager"
    class="org.springframework.security.access.intercept.RunAsManagerImpl">
    <beans:property name="key" value="TELCO_RUN_AS"/>
</beans:bean>

<beans:bean id="logoutFilter" class="org.springframework.security.web.authentication.logout.LogoutFilter">
    <beans:constructor-arg value="/login"/>        
    <beans:constructor-arg>
        <beans:list>
            <beans:bean class="org.springframework.security.web.authentication.logout.CookieClearingLogoutHandler">
                <beans:constructor-arg>
                    <beans:list>
                        <beans:value>JSESSIONID</beans:value>
                    </beans:list>                        
                </beans:constructor-arg>
            </beans:bean>
            <beans:bean class="org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler"/>
        </beans:list>
    </beans:constructor-arg>
</beans:bean>
<beans:bean id="customBadgeAuthFilter" class="com.company.security.filter.BadgeProcessingSecurityFilter">
<beans:constructor-arg value="/login.jsp"></beans:constructor-arg>
    <beans:property name="authenticationManager" ref="authManager" />
</beans:bean>

<security:authentication-manager alias="authManager" >
    <security:authentication-provider ref='normalAuthenticationProvider ' />
    <security:authentication-provider ref='badgeAuthenticationProvider ' />
    <security:authentication-provider ref="preauthAuthProvider" />
</security:authentication-manager>

 <beans:bean id="loginUrlAuthenticationEntryPoint"
      class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint">
    <beans:property name="loginFormUrl" value="/login.jsp"/>
</beans:bean>
<beans:bean id="badgeAuthenticationProvider" class="com.company.security.filter.BadgeAuthenticationProvider">
</beans:bean>

我想我终于想出了如何让我的securityFilter被调用。我正在进行调试以查看springsecurity流程并看到有一个名为的方法。 requestAuthenticationProcessingFilter子类中的requestAuthorization。它比较了为调用过滤器的默认值配置的uri以及它们是否与过滤器不匹配。出于某种原因，甚至认为POSt请求是/ j_security_check ..它在被比较时转换为FSS / home.htm，因此过滤器被绕过了。

如何从同一登录表单

0 个答案: