我遇到了SpringBoot应用程序的问题。我的ICS在该API上报告了高响应时间,但是我的代码指标表明这一切都很好,例如,发送至我的API的查询仅需50毫秒即可运行“业务“代码,但有效响应需要500毫秒以上!
我的JVM的内部日志表明,即使凭据正确且API可以正常工作,但在每次请求时,我都有一个“ UsernameNotFoundExcption ”。这就是为什么我认为我的问题来自SpringSecurity层,但我无法确定原因。
我的切入点:
@Component
public class BasicAuthenticationPoint extends BasicAuthenticationEntryPoint {
@Override
public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException authEx)
throws IOException, ServletException {
response.addHeader("WWW-Authenticate", "Basic realm=" + getRealmName());
response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
response.setCharacterEncoding("utf-8");
PrintWriter writer = response.getWriter();
writer.println("HTTP Status 401 - " + authEx.getMessage());
}
@Override
public void afterPropertiesSet() throws Exception {
setRealmName("MYAPI");
super.afterPropertiesSet();
}
}
还有我的适配器:
@Configuration
@EnableWebSecurity
public class SpringSecurityConfig extends WebSecurityConfigurerAdapter {
@Autowired
private BasicAuthenticationPoint basicAuthenticationPoint;
@Bean
public BCryptPasswordEncoder encoder() {
return new BCryptPasswordEncoder();
}
@Override
protected void configure(HttpSecurity http) throws Exception {
HttpSecurity httpSec = http.csrf().disable();
httpSec = httpSec.authorizeRequests()
.antMatchers("/my-business-resources/**").hasRole("USER")
.antMatchers("/actuator/**").hasRole("ADMIN")
.and();
httpSec.httpBasic().authenticationEntryPoint(basicAuthenticationPoint).and()
.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
}
@Autowired
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
// Load users file
Resource confFile = resourceLoader.getResource("classpath:users.list");
// Returns users from the configuration file <username, password (BCrypted), admin (boolean)>
List<ApiUser> users = ApiUtils.getUsersFromFile(confFile);
for(ApiUser u : users){
// Add the username/password to the in-memory authentication manager
if (u.admin)
auth.inMemoryAuthentication().withUser(u.username).password(u.password).roles("USER", "ADMIN");
else
auth.inMemoryAuthentication().withUser(u.username).password(u.password).roles("USER");
}
}
}
我错过了什么吗?
PS:我的Spring Boot应用程序打包为WAR,并在Tomcat服务器内执行,以实现标准化目的。
编辑:
这是完整的UsernameNotFound堆栈跟踪(ICS格式):
Exception Details
Type: UsernameNotFoundException
Exception Class: org.springframework.security.core.userdetails.UsernameNotFoundException
API: Exception
Thread Name: https-openssl-apr-9343-exec-10 <522634598>
Exception StackTrace
Method Class Line File Name
loadUserByUsername org.springframework.security.provisioning.InMemoryUserDetailsManager 146 <unknown>
retrieveUser org.springframework.security.authentication.dao.DaoAuthenticationProvider 104 <unknown>
authenticate org.springframework.security.authentication.dao.AbstractUserDetailsAuthenticationProvider 144 <unknown>
authenticate org.springframework.security.authentication.ProviderManager 174 <unknown>
authenticate org.springframework.security.authentication.ProviderManager 199 <unknown>
doFilterInternal org.springframework.security.web.authentication.www.BasicAuthenticationFilter 180 <unknown>
doFilter org.springframework.web.filter.OncePerRequestFilter 107 <unknown>
doFilter org.springframework.security.web.FilterChainProxy$VirtualFilterChain 334 <unknown>
doFilter org.springframework.security.web.authentication.logout.LogoutFilter 116 <unknown>
doFilter org.springframework.security.web.FilterChainProxy$VirtualFilterChain 334 <unknown>
doFilterInternal org.springframework.security.web.header.HeaderWriterFilter 66 <unknown>
doFilter org.springframework.web.filter.OncePerRequestFilter 107 <unknown>
doFilter org.springframework.security.web.FilterChainProxy$VirtualFilterChain 334 <unknown>
doFilter org.springframework.security.web.context.SecurityContextPersistenceFilter 105 <unknown>
doFilter org.springframework.security.web.FilterChainProxy$VirtualFilterChain 334 <unknown>
doFilterInternal org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter 56 <unknown>
doFilter org.springframework.web.filter.OncePerRequestFilter 107 <unknown>
doFilter org.springframework.security.web.FilterChainProxy$VirtualFilterChain 334 <unknown>
doFilterInternal org.springframework.security.web.FilterChainProxy 215 <unknown>
doFilter org.springframework.security.web.FilterChainProxy 178 <unknown>
invokeDelegate org.springframework.web.filter.DelegatingFilterProxy 357 <unknown>
doFilter org.springframework.web.filter.DelegatingFilterProxy 270 <unknown>
internalDoFilter org.apache.catalina.core.ApplicationFilterChain 193 <unknown>
doFilter org.apache.catalina.core.ApplicationFilterChain 166 <unknown>
doFilter org.springframework.boot.web.servlet.support.ErrorPageFilter 130 <unknown>
access$000 org.springframework.boot.web.servlet.support.ErrorPageFilter 66 <unknown>
doFilterInternal org.springframework.boot.web.servlet.support.ErrorPageFilter$1 105 <unknown>
doFilter org.springframework.web.filter.OncePerRequestFilter 107 <unknown>
doFilter org.springframework.boot.web.servlet.support.ErrorPageFilter 123 <unknown>
internalDoFilter org.apache.catalina.core.ApplicationFilterChain 193 <unknown>
doFilter org.apache.catalina.core.ApplicationFilterChain 166 <unknown>
filterAndRecordMetrics org.springframework.boot.actuate.metrics.web.servlet.WebMvcMetricsFilter 155 <unknown>
filterAndRecordMetrics org.springframework.boot.actuate.metrics.web.servlet.WebMvcMetricsFilter 123 <unknown>
doFilterInternal org.springframework.boot.actuate.metrics.web.servlet.WebMvcMetricsFilter 108 <unknown>
doFilter org.springframework.web.filter.OncePerRequestFilter 107 <unknown>
internalDoFilter org.apache.catalina.core.ApplicationFilterChain 193 <unknown>
doFilter org.apache.catalina.core.ApplicationFilterChain 166 <unknown>
doFilterInternal org.springframework.web.filter.CharacterEncodingFilter 200 <unknown>
doFilter org.springframework.web.filter.OncePerRequestFilter 107 <unknown>
internalDoFilter org.apache.catalina.core.ApplicationFilterChain 193 <unknown>
答案 0 :(得分:1)
我认为之所以要花费500毫秒是因为密码编码。 BCrypt是一种编码机制,旨在使身份验证花费更长的时间,以缓解暴力攻击。
通常,通过将长期凭证(例如密码)与短暂令牌(例如令牌)交换来解决此性能问题。 OAuth是一个试图标准化这种做法的框架。 Spring Security 5.1 introduces support for protecting APIs with OAuth 2.0。这可能不会立即解决您的性能问题,因为它可能需要引入更多的基础结构,但从长远来看,它可能是更好的安全设计选择。
作为替代,您可以使用较弱的编码器,也可以使用较少的BCrypt轮,但是请注意,这两者都是性能安全的折衷方案。您可以将BCryptPasswordEncoder
换成其他内容,例如:
@Bean
public PasswordEncoder encoder() {
// ...
}
编辑:很高兴您发现了问题!切向地,建议您清理描述身份验证管理器的方式。可以将其替换为UserDetailsService
:
@Bean
@Override
public UserDetailsService userDetailsService() {
Resource confFile = resourceLoader.getResource("classpath:users.list");
Collection<UserDetails> users = ApiUtils.getUsersFromFile(confFile)
.stream().map(this::toUserDetails)
.collect(Collectors.toList());
return new InMemoryUserDetailsManager(users);
}
private UserDetails toUserDetails(ApiUser apiUser) {
UserBuilder builder = User.builder()
.username(apiUser.username)
.password(apiUser.password);
return apiUser.admin ?
builder.roles("USER", "ADMIN").build() :
builder.roles("USER").build();
}
这很好,因为它的配置占用空间较小(身份验证管理器比用户详细信息服务“更大”)。如果您只想提供用户,则通常使用override the UserDetailsService
而不是AuthenticationManager
。
答案 1 :(得分:1)
好的,经过大量调试,我发现了问题!
问题出在我用来填充内存身份验证器的代码中:
for(ApiUser u : users){
// Add the username/password to the in-memory authentication manager
if (u.admin)
auth.inMemoryAuthentication().withUser(u.username).password(u.password).roles("USER", "ADMIN");
else
auth.inMemoryAuthentication().withUser(u.username).password(u.password).roles("USER");
}
多次调用auth.inMemoryAuthentication()
的事实每次都会创建一个新的InMemoryUserDetailsManagerConfigurer<AuthenticationManagerBuilder>
(Spring code),因此我们拥有与用户一样多的AuthenticationManager
(一个用户每个),以便对每个请求多次执行身份验证过程。
这是我修复错误的方法:
@Autowired
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
// Load users file
Resource confFile = resourceLoader.getResource("classpath:users.list");
// Returns users from the configuration file <username, password (BCrypted), admin (boolean)>
List<ApiUser> users = ApiUtils.getUsersFromFile(confFile);
@SuppressWarnings("rawtypes")
UserDetailsBuilder udb = null;
for(ApiUser u : users){
// Add the username/password to the in-memory authentication manager
if (udb == null)
udb = auth.inMemoryAuthentication().withUser(u.username).password(u.password);
else
udb = udb.and().withUser(u.username).password(u.password);
if (u.admin)
udb.roles("USER", "ADMIN");
else
udb.roles("USER");
}
}
现在我的平均响应时间是80毫秒
答案 2 :(得分:0)
您正在对资源和其他文件执行安全检查。您应该完全排除它们以进行身份验证。