Question

是否可以创建多个授权适配器？我想有两个选择：

如果有x509可用，请使用
如果没有可用的x509，请使用表单auth

我已经准备了这样的代码：

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class X509AuthenticationServer extends WebSecurityConfigurerAdapter {
    @Bean
    public RequestContextListener requestContextListener() {
        return new RequestContextListener();
    }
    @Configuration
    @Order(1000)
    public static class x509Authenticator extends X509AuthenticationServer {
        @Override
        protected void configure(HttpSecurity http) throws Exception {
            http.csrf().ignoringAntMatchers("/api/**")
                    .and()
                    .authorizeRequests()
                    .anyRequest()
                    .authenticated()
                    .and()
                    .x509()
                    .subjectPrincipalRegex("CN=(.*?)(?:,|$)")
                    .userDetailsService(userDetailsService())
                    .and()
                    .exceptionHandling()
                    .accessDeniedPage("/forbidden");


        }



        @Bean
        public UserDetailsService userDetailsService() {
            return new UserDetailsService() {
                @Override
                public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
                    try {
                        if (username.equals("test")) {                             
                            return new User(username, "", AuthorityUtils.commaSeparatedStringToAuthorityList("ROLE_API"));
                        }
                        else {
                            throw new UsernameNotFoundException("Tried to access vulnerabilities API with " + username);
                        }
                    }
                    catch (NumberFormatException ex) {
                        log.warn("Number Format exception in authenticatiom module");
                        throw new UsernameNotFoundException("User not found");
                    } catch (ArrayIndexOutOfBoundsException ex) {
                        log.warn("ArrayIndexOutOfBoundsException in authenticatiom module");
                        throw new UsernameNotFoundException("User not found");
                    }


                }
            };
        }
    }
    @Configuration
    @EnableWebSecurity
    @Order(101)
    public static class BasicAuth extends X509AuthenticationServer {

        @Override
        public void configure(HttpSecurity http) throws Exception {
            http.csrf().ignoringAntMatchers("/api/**")
                    .and()
                    .authorizeRequests()
                    .anyRequest()
                    .authenticated()
                    .and()
                    .formLogin()
                    .usernameParameter("nickname").passwordParameter("password")
                    .and().csrf().disable();

        }
        @Autowired
        public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
            auth
                    .inMemoryAuthentication()
                    .withUser("user").password("{noop}password").roles("USER");
        }


    }
}

此刻，当我不使用证书时，我可以使用用户名/密码凭据登录，但是，当我使用证书时，仍会提示我输入用户名/密码形式。

是否可以只使用证书，并且只使用密码优先级的密码？

Spring Boot安全性多授权适配器

0 个答案: