Spring Security 和 CAS。认证成功后的匿名用户

Question

我尝试配置 Spring Security 以使用 CAS。当我获得成功认证时，我正在一步，CAS 为我的申请提供票证。 但是在 CAS 中成功验证后，我需要获取用户名并将请求发送到另一个系统，但我不知道如何，因为这里

SecurityContext ctx=SecurityContextHolder.getContext();
Authentication authentication = ctx.getAuthentication();

我看到我有匿名用户。 我没有太多时间，所以我需要你的帮助，我重复我的问题。

身份验证后在哪个位置可以找到用户名并将请求发送到另一个系统？
我按照this tuturial做CAS客户端。

编辑： 我正在添加我的配置代码，应该更容易：

@EnableWebSecurity
@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {

private AuthenticationProvider authenticationProvider;
private AuthenticationEntryPoint authenticationEntryPoint;
private SingleSignOutFilter singleSignOutFilter;
private LogoutFilter logoutFilter;

@Autowired
public SecurityConfig(CasAuthenticationProvider casAuthenticationProvider,
                      AuthenticationEntryPoint eP,
                      LogoutFilter lF
        , SingleSignOutFilter ssF
) {
    this.authenticationProvider = casAuthenticationProvider;
    this.authenticationEntryPoint = eP;

    this.logoutFilter = lF;
    this.singleSignOutFilter = ssF;

}

@Bean
public UserDetailsService userDetailsService(){
    return new CCDUserDetailsService();
}

@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
    auth.authenticationProvider(authenticationProvider);
}

@Override
protected AuthenticationManager authenticationManager() throws Exception {
    return new ProviderManager(Arrays.asList(authenticationProvider));
}

@Bean
public CasAuthenticationFilter casAuthenticationFilter(ServiceProperties sP) throws Exception {
    CasAuthenticationFilter filter = new CasAuthenticationFilter();
    filter.setServiceProperties(sP);
    filter.setAuthenticationManager(authenticationManager());
    return filter;
}

@Override
protected void configure(HttpSecurity http) throws Exception {
    http
            .csrf().disable()
            .authorizeRequests()
            .regexMatchers("/secured", "/login")
            .authenticated()
            .and()
            .httpBasic()
            .authenticationEntryPoint(authenticationEntryPoint)
            .and()
            .logout().logoutSuccessUrl("/logout")
            .and()
            .addFilterBefore(singleSignOutFilter, CasAuthenticationFilter.class)
            .addFilterBefore(logoutFilter, LogoutFilter.class);
}

}

这里我有 CAS Provider 的配置。

@Configuration
public class AuthenticationApp {

@Value("${serviceProperties.protocol}")
String serviceProperiesProtocol;

@Value("${serviceProperties.host}")
String serviceProperiesHost;

@Value("${serviceProperties.port}")
String serviceProperiesPort;

@Value("${entryPoint.protocol}")
String entryPointProtocol;

@Value("${entryPoint.host}")
String entryPointHost;

@Value("${entryPoint.port}")
String entryPointPort;

@Autowired
CCDUserDetailsService userDetailsService;

@Bean
public ServiceProperties serviceProperties() {
    ServiceProperties serviceProperties = new ServiceProperties();
    serviceProperties.setService("https://localhost:8080");
    serviceProperties.setSendRenew(false);
    return serviceProperties;
}

@Bean
@Primary
public AuthenticationEntryPoint authenticationEntryPoint(
        ServiceProperties sP) {

    CasAuthenticationEntryPoint entryPoint
            = new CasAuthenticationEntryPoint();
    entryPoint.setLoginUrl(entryPointProtocol + "://" +
            entryPointHost + ":" + entryPointPort + "/cas/login");
    entryPoint.setServiceProperties(sP);
    return entryPoint;
}

@Bean
public TicketValidator ticketValidator() {
    return new Cas30ServiceTicketValidator(
            entryPointProtocol + "://" +
                    entryPointHost + ":" + entryPointPort + "/cas");
}

@Bean
public CasAuthenticationProvider casAuthenticationProvider() {

    CasAuthenticationProvider provider = new CasAuthenticationProvider();
    provider.setServiceProperties(serviceProperties());
    provider.setTicketValidator(ticketValidator());
    provider.setUserDetailsService(userDetailsService);
    provider.setKey("CAS_PROVIDER_LOCALHOST_9000");
    return provider;
}

@Bean
public SecurityContextLogoutHandler securityContextLogoutHandler() {
    return new SecurityContextLogoutHandler();
}

@Bean
public LogoutFilter logoutFilter() {
    LogoutFilter logoutFilter = new LogoutFilter(
            entryPointProtocol + "://" +
                    entryPointHost + ":" + entryPointPort + "/cas/logout",
            securityContextLogoutHandler());
    logoutFilter.setFilterProcessesUrl("/logout/cas");
    return logoutFilter;
}

@Bean
public SingleSignOutFilter singleSignOutFilter() {
    SingleSignOutFilter singleSignOutFilter = new SingleSignOutFilter();
    singleSignOutFilter.setCasServerUrlPrefix(entryPointProtocol + "://" +
            entryPointHost + ":" + entryPointPort + "/cas");
    singleSignOutFilter.setIgnoreInitConfiguration(true);
    return singleSignOutFilter;
}

@EventListener
public SingleSignOutHttpSessionListener singleSignOutHttpSessionListener(
        HttpSessionEvent event) {
    return new SingleSignOutHttpSessionListener();
}

}

我还想确认，如果我有上图中的情况，我已经成功地从 CAS 端进行了完整的身份验证。

但是我在哪里可以找到有关用户登录或从 url 中勾选的信息？

Answer 1

如果您按照本教程进行操作，您的配置中是否有此教程？

protected void configure(HttpSecurity http) throws Exception {
  http.authorizeRequests()
    .antMatchers("/**")
    .permitAll();
}

特别是permitAll 语句，它将禁用代码中的所有身份验证机制。你可能想改用fullyAuthenticated

protected void configure(HttpSecurity http) throws Exception {
  http.authorizeRequests()
    .antMatchers("/**")
    .fullyAuthenticated();
}

弹出的两件事是：

考虑不将CasAuthenticationFilter 制作成一个bean，并手动将其插入到您想要的位置。

然后确保在您的过滤器被调用后，过滤器或身份验证管理器被调用

SecurityContextHolder.getContext().setAuthentication(yourAuthenticationObjectHere);