在授权服务器重定向页面之前拦截 SSO cookie

Question

一个多星期以来，我一直在努力拦截 SSO cookie，然后授权服务器将我的应用页面重定向。 我正在为 openid 配置实现mitreid-connect。我已按照链接中的文档进行操作，并使用 Java Config 对其进行了配置。一切正常，重定向等，但我正在尝试实现AbstractPreAuthenticatedProcessingFilter 以在授权服务器使用它并生成 IdToken 之前拦截 SSO cookie。

如果这不正确，请告诉我。我对 spring-security 很陌生，它把我的鳞片刮掉了，它让我抓狂如何抓住 sso cookie

我找到了这个link

请帮帮我

@Configuration
public class filter extends AbstractPreAuthenticatedProcessingFilter {

    @Bean(name = "singleSignOnFilter")
    public String filter() {
        return "PRE_AUTH_FILTER";
    }
    @Override
    protected Object getPreAuthenticatedCredentials(HttpServletRequest request) {
        return null;
    }

    @Override
    protected Object getPreAuthenticatedPrincipal(HttpServletRequest request) {
        Cookie[] cookie = request.getCookies();
        for(int i = 0; i < cookie.length; i++) {
            System.out.println(cookie[i].getName() + " - " +  cookie[i].getValue());
        }
        return null;
    }

}

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    @Inject
    private ClientDetailsEntity client;

    @Inject
    private String issuer;

    @Bean
    public ProviderManager providerManager() {
        List<AuthenticationProvider> authenticationProvider = new LinkedList<AuthenticationProvider>();
        authenticationProvider.add(oidcAuthProvider());

        return new ProviderManager(authenticationProvider);
    }

    @Bean(name = "authenticationProvider")
    public AuthenticationProvider oidcAuthProvider() {
        return new OIDCAuthenticationProvider();
    }

    @Bean(name = "authoritiesMapper")
    public OIDCAuthoritiesMapper authorityMapper() {
        NamedAdminAuthoritiesMapper namedAdminAuthMapper = new NamedAdminAuthoritiesMapper();
        namedAdminAuthMapper.setAdmins(admins());
        return namedAdminAuthMapper;
    }

    @Bean(name = "admins")
    public Set<SubjectIssuerGrantedAuthority> admins() {
        Set<SubjectIssuerGrantedAuthority> admin = new HashSet<SubjectIssuerGrantedAuthority>();

        return admin;
    }

    @Bean(name = "openIdConnectAuthenticationFilter")
    public Filter openIdConnectAuthenticationFilter() {
        OIDCAuthenticationFilter oidcAuthFilter = new OIDCAuthenticationFilter();
        oidcAuthFilter.setAuthenticationManager(providerManager());
        oidcAuthFilter.setIssuerService(issuerService());
        oidcAuthFilter.setClientConfigurationService(clientConfigurationService());
        oidcAuthFilter.setAuthRequestUrlBuilder(authRequestUrlBuilder());

        return oidcAuthFilter;
    }

    @Bean(name = "issuerService")
    public IssuerService issuerService() {
        StaticSingleIssuerService issuerService = new StaticSingleIssuerService();
        issuerService.setIssuer(issuer);

        return issuerService;
    }

    @Bean(name = "clientConfigurationService")
    public ClientConfigurationService clientConfigurationService() {
        StaticClientConfigurationService clientConfigService = new StaticClientConfigurationService();
        clientConfigService.setClients(registeredClient());

        return clientConfigService;
    }

    @Bean(name = "clients")
    public Map<String, RegisteredClient> registeredClient() {
        Map<String, RegisteredClient> oidcRegClients = new HashMap<String, RegisteredClient>();
        oidcRegClients.put(issuer, new RegisteredClient(client));
        return oidcRegClients;
    }

    @Bean(name = "authRequestUrlBuilder")
    public AuthRequestUrlBuilder authRequestUrlBuilder() {
        return new PlainAuthRequestUrlBuilder();
    }

    @Override
    public void configure(HttpSecurity http) throws Exception {
        http.addFilterBefore(openIdConnectAuthenticationFilter(), AbstractPreAuthenticatedProcessingFilter.class)
                .formLogin()
                    .loginPage("/openid_connect_login")
                .and()
                    .logout()
                .and()
                    .authorizeRequests()
                        .antMatchers("/items")
                            .authenticated()
                        .anyRequest()
                            .permitAll();

    }
}

Answer 1

你走在正确的道路上。我认为，您的问题是如何从 cookie 中提取信息（例如用户名），然后使用这些信息来授权用户。以下是清除空气的步骤。

1. 配置AbstractPreAuthenticatedProcessingFilter的子类（例如下面）

   public class CustomPreAuthenticatedFilter extends AbstractPreAuthenticatedProcessingFilter {
   protected Object getPreAuthenticatedPrincipal(HttpServletRequest request) {
       // below sample extracts the username from header.You can pull from cookie
       String expectedHeaderNameContainingUsername = "abcd";
       String username = request.getHeader(expectedHeaderNameContainingUsername);
       return username;
   }
   
   
   protected Object getPreAuthenticatedCredentials(HttpServletRequest request) {
       String expectedHeaderNameContainingCredentials = "";
       if (StringUtils.isNotBlank(expectedHeaderNameContainingCredentials)) {
           return request.getHeader(expectedHeaderNameContainingCredentials);
       }
       return "N/A";
   }
   

   }

2. 只需使用 HTTP 安全性注册上述过滤器 http.addFilter(过滤器过滤器);

您的过滤器似乎没有在 spring security 中注册。

1. AbstractPreAuthenticatedProcessingFilter 将 getPreAuthenticatedPrincipal(..) 的结果转发给 authmanager 以构建主体对象。

希望这会有所帮助。