Question

当我使用基本网址http://localhost:8180/MyProject/启动我的应用程序或访问时，它是通过登录页面并显示实际主页，我将用户视为匿名，但它应首先加载登录页面然后验证后，它应显示主页。建议将不胜感激！

**** **** SecurityConfig

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationProvider;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.ldap.authentication.ad.ActiveDirectoryLdapAuthenticationProvider;

@Configuration
@EnableWebSecurity
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Autowired
    protected void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {

        auth.authenticationProvider(activeDirectoryLdapAuthenticationProvider());
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
      http.authorizeRequests()
        .antMatchers("/", "/home").permitAll()
        .antMatchers("/admin/**").access("hasRole('ADMIN')")
        .and().formLogin().loginPage("/login")
        .usernameParameter("ssoId").passwordParameter("password")
        .and().csrf()
        .and().exceptionHandling().accessDeniedPage("/Access_Denied");
    }

    @Bean
    public AuthenticationProvider activeDirectoryLdapAuthenticationProvider() {
        ActiveDirectoryLdapAuthenticationProvider authenticationProvider = 
            new ActiveDirectoryLdapAuthenticationProvider("", "");

        authenticationProvider.setConvertSubErrorCodesToExceptions(true);
        authenticationProvider.setUseAuthenticationRequestCredentials(true);

        return authenticationProvider;
    }    
}

myController的

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.springframework.security.core.Authentication;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler;
import org.springframework.stereotype.Controller;
import org.springframework.ui.ModelMap;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.ResponseBody;




@Controller
public class MyController{


    @RequestMapping(value="/processAccount", method = RequestMethod.POST)
    public @ResponseBody String processRequestAccount(ModelMap model,@RequestParam("accountNumber") String accountNumber,@RequestParam("companyNumber") String companyNumber) {
        //String accountNumber = request.getParameter("accountNumber");

        String responseMessage = null;
          //String companyNumber = request.getParameter("companyNumber");
          System.out.println(companyNumber);
          MyServiceImpl accService = new MyServiceImpl();
          boolean responseFlag = accService.verifyAndProcessAccount(accountNumber, companyNumber);
          System.out.println(responseFlag);

          if(responseFlag)
          {
                //model.addAttribute("message", "The account number"+" "+accountNumber+" "+"is processed successfully!");

              responseMessage = "The account number"+" "+accountNumber+" "+"is processed successfully!";
          }
          else
          {

             responseMessage = "Account number"+" "+accountNumber+" "+"cannot not be found, email has sent to the support team";

          }



        return responseMessage;

    }


    @RequestMapping(value = { "/", "/home" }, method = RequestMethod.GET)
    public String homePage(ModelMap model) {
        model.addAttribute("user", getPrincipal());
        model.addAttribute("companyNumber","1");
        return "accountsearch";
    }

    @RequestMapping(value = "/admin", method = RequestMethod.GET)
    public String adminPage(ModelMap model) {
        model.addAttribute("user", getPrincipal());
        return "admin";
    }

    @RequestMapping(value = "/db", method = RequestMethod.GET)
    public String dbaPage(ModelMap model) {
        model.addAttribute("user", getPrincipal());
        return "dba";
    }

    @RequestMapping(value = "/Access_Denied", method = RequestMethod.GET)
    public String accessDeniedPage(ModelMap model) {
        model.addAttribute("user", getPrincipal());
        return "accessDenied";
    }

    @RequestMapping(value = "/login", method = RequestMethod.GET)
    public String loginPage() {
        return "login";
    }

    @RequestMapping(value="/logout", method = RequestMethod.GET)
    public String logoutPage (HttpServletRequest request, HttpServletResponse response) {
        Authentication auth = SecurityContextHolder.getContext().getAuthentication();
        if (auth != null){    
            new SecurityContextLogoutHandler().logout(request, response, auth);
        }
        return "redirect:/login?logout";
    }

    private String getPrincipal(){
        String userName = null;
        Object principal = SecurityContextHolder.getContext().getAuthentication().getPrincipal();

        if (principal instanceof UserDetails) {
            userName = ((UserDetails)principal).getUsername();
        } else {
            userName = principal.toString();
        }
        return userName;
    }



}

Answer 1

如果您想首先进行身份验证，则需要将Spring权限表达式.permitAll()更改为.isAuthenticated()。

试试这个

http.authorizeRequests()
    .antMatchers("/login").isAnonymous() // anonymous user access this page
    .antMatchers("/", "/home").isAuthenticated() // now home will be check authentication first
    .antMatchers("/admin/**").access("hasRole('ADMIN')")
    .and().formLogin().loginPage("/login")
    .usernameParameter("ssoId").passwordParameter("password")
    .and().csrf()
    .and().exceptionHandling().accessDeniedPage("/Access_Denied");

登录问题弹簧安全

1 个答案: