Question

我在配置Spring Security时遇到了困难。问题是，每当我通过自定义UsernamePasswordAuthenticationFilter进行身份验证时，我的身份验证过滤器始终会跳过成功和失败处理程序。我似乎不知道为什么会这样。

首先，我将身份验证参数作为JSON传递，并过滤出用户名和密码，然后将这两个参数传递至新的UsernamePasswordAuthenticationToken(username, password)中，然后获得身份验证管理器并对返回的令牌进行身份验证。在成功完全身份验证时，我希望成功处理程序可以接管，但不，它根本不会被调用。

这是我的安全配置。

@Override
protected void configure(HttpSecurity http) throws Exception {
    http
            .csrf()
            .disable()
            .authorizeRequests()
            .and()
            .exceptionHandling()
            .authenticationEntryPoint(restAuthenticationEntryPoint)
            .and()
            .authorizeRequests()
            .antMatchers("/signup")
            .permitAll()
            .antMatchers("/", "/security/login", "/request", "/request.html")
            .authenticated()
            .and()
            .formLogin()
            .loginProcessingUrl("/security/login")
            .successHandler(authenticationSuccessHandler())
            .failureHandler(authenticationFailureHandler())
            .and()
            .logout()
            .logoutUrl("/logout")
            .permitAll()
            .and()
            .addFilterAfter
                    (authenticationFilter(), UsernamePasswordAuthenticationFilter.class)
            //.and()
            .userDetailsService(userDetailsServiceBean());
}

相关的豆是

@Autowired
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {

    auth.userDetailsService(userDetailsServiceBean());
}

@Bean
@Override
public UserDetailsService userDetailsServiceBean() throws Exception {

    return new JdbcUserDetails();
}

@Bean
public RestAuthenticationSuccessHandler authenticationSuccessHandler(){
    return new RestAuthenticationSuccessHandler();
}

@Bean
public RestAuthenticationFailureHandler authenticationFailureHandler(){
    return new RestAuthenticationFailureHandler();
}

@Bean
JsonAuthenticationFilter authenticationFilter() throws Exception {
    logger.debug("Authenication filter processing loggin request    ");
    JsonAuthenticationFilter filter = new JsonAuthenticationFilter();
    filter.setAuthenticationManager(authenticationManagerBean());
    return filter;
}

过滤器是

public class JsonAuthenticationFilter extends UsernamePasswordAuthenticationFilter{

@Override
public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException {

    UsernamePasswordAuthenticationToken authRequest = this.getUserNamePasswordAuthenticationToken(request);

    setDetails(request, authRequest);

    return this.getAuthenticationManager().authenticate(authRequest);
}

最后是我的成功经理

class RestAuthenticationSuccessHandler extends SimpleUrlAuthenticationSuccessHandler {

@Override
public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response,
        Authentication authentication)
        throws ServletException, IOException {

    logger.debug("Successful login");
    System.out.println("\n\n\n\n\n\n\n\nresponse here\n\n\n\n\n\n\n");

    response.getWriter().write("{This is a login success response}");
    response.getWriter().flush();
    response.getWriter().close();

}

我战斗了太久了

Answer 1

当您提供该bean时，Spring Security将在给定的bean配置上退出。

因此，由于您提供了过滤器（JsonAuthenticationFilter），因此Spring Security希望您将最了解如何构成它。

那么，您应该这样做：

@Bean
JsonAuthenticationFilter authenticationFilter() {
    JsonAuthenticationFilter filter = new JsonAuthenticationFilter();
    // .. other configs
    filter.setAuthenticationSuccessHandler(new RestAuthenticationSuccessHandler());
    filter.setAuthenticationFailureHandler(new RestAuthenticationFailureHandler());
}

似乎正在发生很多事情，因此，如果这不能解决您的问题，请随时在GitHub上放一个示例，我很乐意仔细查看。

UsernamePasswordAuthenticationFilter跳过成功处理程序

1 个答案: