Spring 无法重定向到安全页面

Question

我正在编写一个 Spring 应用程序，该应用程序要求用户登录才能访问已使用 Spring 安全性保护的页面。当用户尝试访问安全页面时，他们会被要求登录。如果登录成功，用户应该被直接重定向到安全页面，否则登录页面应该重新显示错误消息。目前不成功的场景有效，但如果用户正确登录，登录页面仍然会重新显示，尽管没有错误消息。

这里是相关的Java代码和Spring配置：

用户凭据控制器：

//Methods omitted above.


@RequestMapping(value="/login", method = RequestMethod.GET)
public String login(Model model){
    System.out.println("In login() method");
    model.addAttribute("credentials", new User());
    return "login";
}
@RequestMapping(value="/checkcredentials", method = RequestMethod.POST)
public String checkCredentials(@ModelAttribute ("credentials") User user, Model model, HttpServletResponse response){
    if(userService.getUser(user)){
       //I am trying to redirect the user here in the event of a successful log in. Does not work at present. 
        return "redirect:/addincident"; 

        }
        else{
         model.addAttribute("message", "Username and/or password is/are not valid");
            //This works at the moment.
            return "login";
        }
}

spring-security.xml：

<beans:beans xmlns="http://www.springframework.org/schema/security"
       xmlns:beans="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xsi:schemaLocation="http://www.springframework.org/schema/beans
           http://www.springframework.org/schema/beans/spring-beans-3.2.xsd
           http://www.springframework.org/schema/security
           http://www.springframework.org/schema/security/spring-security-3.2.xsd">


 <http auto-config="true">
     <intercept-url pattern="/addincident" access="ROLE_USER, ROLE_ADMIN"/>
     <intercept-url pattern="/**" access="IS_AUTHENTICATED_ANONYMOUSLY"/>
     <form-login login-page="/login"/>
 </http>

<authentication-manager>
  <authentication-provider>
      <user-service>
            <user name="daj" password="123" authorities="ROLE_USER, ROLE_ADMIN" />
            <user name="eoj" password="123" authorities="ROLE_USER" />
      </user-service>
  </authentication-provider>
</authentication-manager>

我目前的想法是这是一个安全问题。这是因为以前我使用 Spring 的默认登录页面，当我使用基于 XML 的用户时它工作得很好。但是现在我将用户保存在数据库中，并且我有自己的登录页面，并且导航不再按我期望的方式工作。

编辑：这是 addIncident 方法。当我使用默认的 Spring 登录表单时，它会正确加载。

GeneralIncidentController：

//Methods omitted above.
@RequestMapping(value = "/addincident", method = RequestMethod.GET)
public String addIncident(@RequestParam(value="name", required=false, defaultValue="World") String name, Model model){
    model.addAttribute("message", "Spring 3 MVC Hello World");
    model.addAttribute("name", name);
    model.addAttribute("details", new GeneralIncident());      //Need this to populate bean with submitted data for validation.
    return "myform";
}

Answer 1

您需要为<form-login login-page="/login"/> 添加一个 default-target-url 属性，该值将指向用户成功登录后应该遇到的页面，如果省略（如您的情况）它通向应用程序的根目录。所以尝试类似

<security:form-login login-page="/admin/login" default-target-url="/loginsuccess"

更新，要从服务进行身份验证，您可以这样尝试

1. 向 Spring Security 注册您的自定义提供程序

   <sec:authentication-manager alias="authenticationManager" erase-credentials="false">
     <sec:authentication-provider ref="customAuthenticationProvider"/>
   </sec:authentication-manager>
   <bean id="customAuthenticationProvider" class="your.package.CustomAuthenticationProvider"/>
   

2. 实现您的 CustomProvider

   public class CustomAuthenticationProvider implements AuthenticationProvider {
   
   @Autowired
   private YourUserService userService;
   
   
   @Override
   public boolean supports(Class<? extends Object> authentication) {
       return (authentication.equals(UsernamePasswordAuthenticationToken.class) || authentication.equals(UrlAuthenticationToken.class));
   }
   
   @Override
   public Authentication authenticate(Authentication authentication) throws AuthenticationServiceException {
       YourUser user = userService.loginByEmailAndPassword((String) authentication.getPrincipal(), (String) authentication.getCredentials());
       Collection<GrantedAuthority> grantedAuthorities = new ArrayList<>();
       grantedAuthorities.add(new SimpleGrantedAuthority("ROLE_ADMIN"));
       Authentication endUserAuth = new UsernamePasswordAuthenticationToken(user, user.getPassword(), grantedAuthorities);
       return endUserAuth;
   }
   

   }