如何捕获从 AuthenticationProvider 抛出的正确异常？ [复制]

Question

我正在我的应用中实现自定义身份验证提供程序。在我的提供程序中，我会根据情况使用不同的消息抛出不同的异常。请看我的代码：

@Component
public class MyLdapAuthenticationProvider implements AuthenticationProvider {

    @Override
    public Authentication authenticate(Authentication authentication) throws AuthenticationException {

        // Connect to LDAP - throw ConnectionException if the LDAP server is unreachable

        // Authenticate

        // Worng username or password, throw BadCredentialsException("Incorrect username or password.")

        // Not enough right to use my app, throw BadCredentialsException("This user is not allowed to use the service.");
    }

    @Override
    public boolean supports(Class<?> authentication) {
        return UsernamePasswordAuthenticationToken.class.isAssignableFrom(authentication);
    }
}

为了捕捉这些异常，我实现了一个CustomAuthenticationEntryPoint，如下所示：

@Component
public class CustomAuthenticationEntryPoint implements AuthenticationEntryPoint {

    private final HandlerExceptionResolver resolver;

    @Autowired
    public CustomAuthenticationEntryPoint(@Qualifier("handlerExceptionResolver") HandlerExceptionResolver resolver) {
        this.resolver = resolver;
    }

    @Override
    public void commence(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, AuthenticationException e) {
        resolver.resolveException(httpServletRequest, httpServletResponse, null, e);
    }
}

如您所见，我解决了异常，以便可以在@RestControllerAdvice 中再次捕获它（我想集中处理异常）。

我的问题是CustomAuthenticationEntryPoint 的commence 方法将所有异常转换为AuthenticationException。无论我在身份验证提供程序中抛出什么异常，我得到的始终是带有固定消息的身份验证异常：

访问此资源需要完全身份验证

总之，我可以捕获从AuthenticationProvider 抛出的异常，但不是正确的。

我的问题：如何捕获AuthenticationProvider 抛出的正确异常？

Answer 1

我解决它的方法是在 CorsFilter 之前添加一个新的过滤器：

在我的SecurityConfigurer 课堂上：

@Override
protected void configure(HttpSecurity http) throws Exception {

    http
        .addFilterBefore(new ExceptionFilter(exceptionHandler), CorsFilter.class)
        .....
}

ExceptionFiler类：

public class ExceptionFilter extends OncePerRequestFilter {

private HandlerExceptionResolver resolver;

public ExceptionFilter(HandlerExceptionResolver resolver) {
    this.resolver = resolver;
}

@Override
protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
    try {
        filterChain.doFilter(request, response);
    } catch (Exception ex) {
        LOG.error("An exception has been thrown by one of the filters: ", ex);
                    ResponseEntity<Object> error;
        if (ex instanceof ConnectionException) {
            error = resolver.handleConnectionException(ex);
        } else if (ex instanceof BadCredentialsException) {
            error = resolver.handleBadCredentialsException(ex);
        } else {
            error = resolver.handleGenericException(ex);
        }

        response.setStatus(error.getStatusCode().value());
        response.getWriter().write(error.getBody().toString());
    }
}

}

你可以玩弄 if 语句、catch 子句等，但你已经明白了。