Question

我有配置了SpringSecurity的Spring Boot应用程序。它使用由UUID.randomUUID（）。toString（）生成的令牌，该令牌由AuthUser对象的UUIDAuthenticationService类中的方法login返回。授权用户保留在LoggedInUsers类中。当我向API令牌发送请求时，已通过UUIDAuthenticationService类中的findByToken方法进行了验证。

最后，我添加了令牌验证超时。现在，我想添加IP地址验证。如果用户从地址X.X.X.X（保存在AuthUser对象中）登录，则仅使用地址X.X.X.X来授权他的令牌。怎么做？

我的SecurityConfig.java：

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
@FieldDefaults(level = PRIVATE, makeFinal = true)
class SecurityConfig extends WebSecurityConfigurerAdapter {

private static final RequestMatcher PUBLIC_URLS = new OrRequestMatcher(
        new AntPathRequestMatcher("/api/login/login"),
);
private static final RequestMatcher PROTECTED_URLS = new NegatedRequestMatcher(PUBLIC_URLS);

TokenAuthenticationProvider provider;

SecurityConfig(final TokenAuthenticationProvider provider) {
    super();
    this.provider = requireNonNull(provider);
}

@Override
protected void configure(final AuthenticationManagerBuilder auth) {
    auth.authenticationProvider(provider);
}

@Override
public void configure(final WebSecurity web) {
    web.ignoring()
            .requestMatchers(PUBLIC_URLS);
    web.httpFirewall(defaultHttpFirewall());    
}

@Override
protected void configure(final HttpSecurity http) throws Exception {
    http
            .sessionManagement()
            .sessionCreationPolicy(STATELESS)
            .and()
            .exceptionHandling()
            // this entry point handles when you request a protected page and you are not yet
            // authenticated
            .defaultAuthenticationEntryPointFor(forbiddenEntryPoint(), PROTECTED_URLS)
            .and()
            .authenticationProvider(provider)
            .addFilterBefore(restAuthenticationFilter(), AnonymousAuthenticationFilter.class)
            .authorizeRequests()
            .antMatchers("/api/admin/**").hasAuthority("ROLE_ADMIN")
            .antMatchers("/api/application/**").hasAnyAuthority("ROLE_ADMIN", "ROLE_EMPLOYEE", "ROLE_PORTAL")
            .antMatchers("/api/rezerwacja/**").hasAnyAuthority("ROLE_ADMIN", "ROLE_EMPLOYEE")
            .anyRequest()
            .authenticated()
            .and()
            .csrf().disable()
            .formLogin().disable()
            .httpBasic().disable()
            .logout().disable();

}

@Bean
TokenAuthenticationFilter restAuthenticationFilter() throws Exception {
    final TokenAuthenticationFilter filter = new TokenAuthenticationFilter(PROTECTED_URLS);
    filter.setAuthenticationManager(authenticationManager());
    filter.setAuthenticationSuccessHandler(successHandler());
    return filter;
}

@Bean
SimpleUrlAuthenticationSuccessHandler successHandler() {
    final SimpleUrlAuthenticationSuccessHandler successHandler = new SimpleUrlAuthenticationSuccessHandler();
    successHandler.setRedirectStrategy(new NoRedirectStrategy());
    return successHandler;
}

/**
 * Disable Spring boot automatic filter registration.
 */
@Bean
FilterRegistrationBean disableAutoRegistration(final TokenAuthenticationFilter filter) {
    final FilterRegistrationBean registration = new FilterRegistrationBean(filter);
    registration.setEnabled(false);
    return registration;
}

@Bean
AuthenticationEntryPoint forbiddenEntryPoint() {
    return new HttpStatusEntryPoint(FORBIDDEN);
}

@Bean                                                 
public HttpFirewall defaultHttpFirewall() {
    return new DefaultHttpFirewall();
}
}

AbstractAuthenticationProcessingFilter.java：

@FieldDefaults(level = PRIVATE, makeFinal = true)
public final class TokenAuthenticationFilter extends AbstractAuthenticationProcessingFilter {
private static final String BEARER = "Bearer";

public TokenAuthenticationFilter(final RequestMatcher requiresAuth) {
    super(requiresAuth);
}

@Override
public Authentication attemptAuthentication(
        final HttpServletRequest request,
        final HttpServletResponse response) {
    final String param = ofNullable(request.getHeader(AUTHORIZATION))
            .orElse(request.getParameter("t"));

    final String token = ofNullable(param)
            .map(value -> removeStart(value, BEARER))
            .map(String::trim)
            .orElseThrow(() -> new BadCredentialsException("Missing Authentication Token"));

    final Authentication auth = new UsernamePasswordAuthenticationToken(token, token);
    return getAuthenticationManager().authenticate(auth);
}

@Override
protected void successfulAuthentication(
        final HttpServletRequest request,
        final HttpServletResponse response,
        final FilterChain chain,
        final Authentication authResult) throws IOException, ServletException {
    super.successfulAuthentication(request, response, chain, authResult);
    chain.doFilter(request, response);
}
}

TokenAuthenticationProvider / java：

@Component
@AllArgsConstructor(access = PACKAGE)
@FieldDefaults(level = PRIVATE, makeFinal = true)
public final class TokenAuthenticationProvider extends AbstractUserDetailsAuthenticationProvider {
@NonNull
UserAuthenticationService auth;

@Override
protected void additionalAuthenticationChecks(final UserDetails d, final UsernamePasswordAuthenticationToken auth) {
    // Nothing to do
}

@Override
protected UserDetails retrieveUser(final String username, final UsernamePasswordAuthenticationToken authentication) {
    final Object token = authentication.getCredentials();
    return Optional
            .ofNullable(token)
            .map(String::valueOf)
            .flatMap(auth::findByToken)
            .orElseThrow(() -> new UsernameNotFoundException("Cannot find user with authentication token=" + token));
}
}

UUIDAuthenticationService.java：

@Service
@AllArgsConstructor(access = PACKAGE)
@FieldDefaults(level = PRIVATE, makeFinal = true)
public final class UUIDAuthenticationService implements UserAuthenticationService {

private static final Logger log = LoggerFactory.getLogger(UUIDAuthenticationService.class);

@NonNull
UserCrudService users;

@Autowired
LoginManager loginMgr;

@Override
public AuthUser login(final String username, final String password) throws Exception { //throws Exception {

    AuthUser user = loginMgr.loginUser(username, password);
    if (user != null) {
        users.delete(user);
        users.save(user);
        log.info("Zalogowano użytkownika {}, przydzielono token: {}", user.getUsername(), user.getUuid());
    }

    return Optional
            .ofNullable(user)
            .orElseThrow(() -> new RuntimeException("Błędny login lub hasło"));
}

@Override
public Optional<AuthUser> findByToken(final String token) {

    AuthUser user = users.find(token).orElse(null); // get();
    if (user != null) {
        Date now = Date.from(OffsetDateTime.now(ZoneOffset.UTC).toInstant());
        int ileSekund = Math.round((now.getTime() - user.getLastAccess().getTime()) / 1000);        // timeout dla tokena
        if (ileSekund > finals.tokenTimeout) {
            log.info("Token {} dla użytkownika {} przekroczył timeout", user.getUuid(), user.getUsername());
            users.delete(user);
            user = null;
        }
        else {
            user.ping();
        }
    }
    return Optional.ofNullable(user); //users.find(token);
}

@Override
public void logout(final AuthUser user) {

    users.delete(user);
}
}

我曾考虑过在UUIDAuthenticationService中创建方法findByTokenAndIp，但是我不知道如何在UUIDAuthenticationService中登录登录方法时查找发送请求的用户的IP地址以及如何获取IP地址（我在创建AuthUser时需要它对象）。

Answer 1

您可以访问过滤器中的HttpServletRequest request，以便可以从中提取IP。

请参见https://www.mkyong.com/java/how-to-get-client-ip-address-in-java/

拥有IP后，您可以随时拒绝请求！

Answer 2

我将简要地执行以下步骤：

在UUIDAuthenticationService中保存IP。如果您使用的是控制器/请求映射，则可以将HttpServletRequest request添加为参数，因为它是自动注入的：

@RequestMapping("/login")
public void lgin(@RequestBody Credentials cred, HttpServletRequest request){
    String ip = request.getRemoteAddr();
    //...
}

在身份验证筛选器中，将IP用作UsernamePasswordAuthenticationToken的“用户名”，并将令牌用作“密码”。已经有HttpServletRequest request通过getRemoteAddr()为您提供IP。也可以创建自己的AbstractAuthenticationToken甚至UsernamePasswordAuthenticationToken实例，该实例明确持有IP甚至是身份验证管理器的请求。

然后，您只需要使更改适应您的retrieveUser方法即可。

Answer 3

我修改了控制器以使用HttpServletRequest参数获取IP地址，并将参数ipAddress添加到登录方法中。

@PostMapping("/login")
public AuthUser login(InputStream inputStream, HttpServletRequest request) throws Exception {

    final String ipAddress = request.getRemoteAddr();
    if (ipAddress == null || ipAddress.equals("")) {
        throw new Exception("Nie udało się ustalić adresu IP klienta");
    }

    Login login = loginMgr.prepareLogin(inputStream);
    return authentication
            .login(login.getUsername(), login.getPasword(), ipAddress);
}

修改后的方法TokenAuthenticationProvider中的检索用户

@Override
protected UserDetails retrieveUser(final String username, final UsernamePasswordAuthenticationToken authentication) {

    System.out.println("Verification: "+authentication.getPrincipal()+" => "+authentication.getCredentials());

    final Object token = authentication.getCredentials();
    final String ipAddress= Optional
            .ofNullable(authentication.getPrincipal())
            .map(String::valueOf)
            .orElse("");

    return Optional
            .ofNullable(token)
            .map(String::valueOf)
            .flatMap(auth::findByToken)
            .filter(user -> user.ipAddress.equals(ipAddress))   // weryfikacja adresu ip
            .orElseThrow(() -> new UsernameNotFoundException("Cannot find user with authentication token=" + token));
}

它有效。感谢您的帮助。

带有SpringSecurity的REST API中的IP地址验证

3 个答案: