Question

我在Spring启动应用程序中使用 spring security with LDAP 。

一切正常之前我在安全配置中进行了以下更改，如下所示。

覆盖 UserDetailsContextMapper 以为用户设置ROLE。
根据用户角色限制网址。

以下是实现上述两件事的代码更改。

1。的UserDetailsContextMapper：

@Component
public class UserDetailsContextMapperImpl implements UserDetailsContextMapper, Serializable{

    private static final long serialVersionUID = 3962976258168853954L;
    private static Logger logger = LoggerFactory.getLogger(UserDetailsContextMapperImpl.class);


    @SuppressWarnings("rawtypes")
    @Override
    public UserDetails mapUserFromContext(DirContextOperations ctx, String username, Collection<? extends GrantedAuthority> authority) {
        List<GrantedAuthority> mappedAuthorities = new ArrayList<GrantedAuthority>();

            try{
                Attributes attrListOuter = ctx.getAttributes();
                Attribute attrListInner = attrListOuter.get(UserConstant.MEMBER_OF);
                logger.info("memberOf: " + attrListInner.getID());
                for (NamingEnumeration enumInner = attrListInner.getAll(); enumInner.hasMore();){
                      String CN = (String)enumInner.next();
                      logger.info("CN value: " + CN);
                      if(CN.contains(UserConstant.MASTER_GROUP_PROJ_NAME)){
                          logger.info("Logged in user is authorized to acccess Rates Toronto application: {}", username );
                          mappedAuthorities.add(new SimpleGrantedAuthority(UserConstant.ROLE_ABC));// adding ROLE_ABC to APP/LDAP users.
                          logger.info("User {} Role set as : {}", username, UserConstant.ROLE_ABC );
                          break;
                      }else if(CN.contains(UserConstant.GROUP_XYZ)){
                          mappedAuthorities.add(new SimpleGrantedAuthority(UserConstant.ROLE_XYZ));
                          logger.info("User {} Role set as : {}", username, UserConstant.ROLE_XYZ );
                          break;
                      }
                   }

                  if(mappedAuthorities.isEmpty()){
                        logger.info("Logged in user is NOT authorized to access ABCD application : {}", username );
                   }

            }catch(Exception ex){
                logger.info("Exception while mapping UserDetails with LDAP" + ex.getMessage());
            }
        //Returning Spring Seurity's User object.
        return new org.springframework.security.core.userdetails.User(username, "", true, true, true, true, mappedAuthorities);

    }

2。根据用户角色限制URL：

在我的websecurity配置类中，

@Configuration
@EnableWebSecurity
public class AbcWebSecurityConfiguration extends WebSecurityConfigurerAdapter {

.......

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests().antMatchers("/api/**").hasAnyRole("REST","ABC").and().httpBasic().and().formLogin(); 
        http.authorizeRequests().antMatchers("/xyz/**").hasRole("XYZ").and().httpBasic(); 
        http.authorizeRequests().antMatchers("/abc/**").hasRole("ABC").and().httpBasic(); // Users who are accessing the URLS/application via application's UI. ie. Business User.
        http.headers().contentTypeOptions().xssProtection().cacheControl().httpStrictTransportSecurity().frameOptions().disable();
        http.headers().addHeaderWriter(new StaticHeadersWriter("Cache-Control","no-cache, no-store, max-age=0, must-revalidate"));
        http.headers().addHeaderWriter(new StaticHeadersWriter("Expires","0"));
        http.csrf().disable();
        http.sessionManagement().maximumSessions(1).sessionRegistry(sessionRegistry());
        super.configure(http);
    }

和......

@Autowired
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
    auth.ldapAuthentication().userDetailsContextMapper(userDetailsContextMapperImpl).userSearchFilter(SAM_ACC).userSearchBase(base).contextSource().url(url).managerDn(managerDn).managerPassword(password);
    auth.inMemoryAuthentication().withUser(restUserName).password(restPassword).roles(restRole);
    //This publisher will trigger AuthenticationFailureBadCredentialsEvent (AbstractAuthenticationFailureEvent)
    auth.authenticationEventPublisher(new DefaultAuthenticationEventPublisher(applicationEventPublisher));
}

上述更改后，让登录用户提供错误的用户（有时），

这是不每次发生，但间歇性地发生。

我使用以下代码获取当前登录用户。

Authentication authentication = securityContextHolder.getContext().getAuthentication(); if (authentication == null) return null; org.springframework.security.core.userdetails.User userDetails = (org.springframework.security.core.userdetails.User) authentication.getPrincipal(); String userName = userDetails.getUsername();

我无法找到我失踪的地方，任何指针/方向都会非常有用。

从已经过身份验证的用户返回错误的用户。

我正在使用弹簧启动 1.2.0 ，默认使用 spring security 3.2.5

Spring安全性返回错误的登录用户AFTER重写UserDetailsContextMapper

0 个答案: