使用自定义过滤器后持续记住我的身份验证答案

【问题标题】：persisted remember-me authentication after using custom filter使用自定义过滤器后持续记住我的身份验证
【发布时间】：2012-09-24 18:44:12
【问题描述】：

我在 Spring Roo 环境中使用 Spring-Security 3.1.RELEASE。我已经更改了登录机制，以便它可以与 JSON-Response 一起使用。为此，我创建了两个类（scala），即

class JsonSuccessHandler extends SimpleUrlAuthenticationSuccessHandler {
 override def onAuthenticationSuccess(request: HttpServletRequest, response: HttpServletResponse, authentication: Authentication) = {
  val responseWrapper = new HttpServletResponseWrapper(response);
  val out = responseWrapper.getWriter
  out.write("{success: true}")
  out.close
 }
}

@Repository class JsonEntryPoint extends AuthenticationEntryPoint {
 def commence(request: HttpServletRequest, response: HttpServletResponse, ae: AuthenticationException) = {
  response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Unauthorized")
 }
}

application-security.xml中的条目如下：

<http use-expressions="true" entry-point-ref="jsonAuthenticationEntryPoint">
  <custom-filter ref="myFilter" position="FORM_LOGIN_FILTER"/>
  <custom-filter ref="rememberMeFilter" position="REMEMBER_ME_FILTER"/>

  <logout logout-url="/resources/j_spring_security_logout"/>

  <intercept-url pattern="/backend/**" access="isAuthenticated()" />
  <intercept-url pattern="/resources/**" access="permitAll" />
  <intercept-url pattern="/admin/**" access="hasRole('ROLE_ADMIN')" />
  <intercept-url pattern="/**" access="permitAll" />
</http>


<beans:bean id="rememberMeFilter" class="org.springframework.security.web.authentication.rememberme.RememberMeAuthenticationFilter">
  <beans:property name="rememberMeServices" ref="rememberMeServices"/>
  <beans:property name="authenticationManager" ref="authenticationManager" />
</beans:bean>

<beans:bean id="rememberMeServices" class="org.springframework.security.web.authentication.rememberme.JdbcTokenBasedRememberMeServices">
  <beans:property name="userDetailsService" ref="userServiceDb"/>
  <beans:property name="tokenRepository" ref="tokenRepository"/>
  <beans:property name="key" value="reservation" />
</beans:bean>

<beans:bean id="tokenRepository" class="org.springframework.security.web.authentication.rememberme.JdbcTokenRepositoryImpl">
 <beans:property name="dataSource" ref="dataSource"/>
</beans:bean>


<beans:bean id="myFilter" class="org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter">
  <beans:property name="authenticationManager" ref="authenticationManager" />
  <beans:property name="authenticationSuccessHandler" ref="mySuccessHandler" />
  <beans:property name="rememberMeServices" ref="rememberMeServices" />
  <beans:property name="usernameParameter" value="email" />
  <beans:property name="passwordParameter" value="password" />
</beans:bean>
<beans:bean id="mySuccessHandler" class="JsonSuccessHandler"/>
<beans:bean id="jsonAuthenticationEntryPoint" class="JsonEntryPoint" />

身份验证工作正常，因此我可以成功登录，并且还记得我，数据已成功存储到数据库中（表 persistent_logins）。但是当我重新启动服务器时，会话按预期删除，记住我的功能应该可以完成它的工作。不幸的是，它因以下日志数据而失败：

[INFO] Started Jetty Server
17:19:15.867 [qtp1943091306-38] DEBUG o.s.security.web.FilterChainProxy - / at position 1 of 10 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter'
17:19:15.875 [qtp1943091306-38] DEBUG o.s.s.w.c.HttpSessionSecurityContextRepository - No HttpSession currently exists
17:19:15.875 [qtp1943091306-38] DEBUG o.s.s.w.c.HttpSessionSecurityContextRepository - No SecurityContext was available from the HttpSession: null. A new one will be created.
17:19:15.877 [qtp1943091306-38] DEBUG o.s.security.web.FilterChainProxy - / at position 2 of 10 in additional filter chain; firing Filter: 'LogoutFilter'
17:19:15.878 [qtp1943091306-38] DEBUG o.s.security.web.FilterChainProxy - / at position 3 of 10 in additional filter chain; firing Filter: 'UsernamePasswordAuthenticationFilter'
17:19:15.878 [qtp1943091306-38] DEBUG o.s.security.web.FilterChainProxy - / at position 4 of 10 in additional filter chain; firing Filter: 'RequestCacheAwareFilter'
17:19:15.878 [qtp1943091306-38] DEBUG o.s.security.web.FilterChainProxy - / at position 5 of 10 in additional filter chain; firing Filter: 'SecurityContextHolderAwareRequestFilter'
17:19:15.879 [qtp1943091306-38] DEBUG o.s.security.web.FilterChainProxy - / at position 6 of 10 in additional filter chain; firing Filter: 'RememberMeAuthenticationFilter'
17:19:15.879 [qtp1943091306-38] DEBUG o.s.s.w.a.r.PersistentTokenBasedRememberMeServices - Remember-me cookie detected
17:19:15.895 [qtp1943091306-38] DEBUG o.s.jdbc.core.JdbcTemplate - Executing prepared SQL query
17:19:15.895 [qtp1943091306-38] DEBUG o.s.jdbc.core.JdbcTemplate - Executing prepared SQL statement [select username,series,token,last_used from persistent_logins where series = ?]
17:19:15.896 [qtp1943091306-38] DEBUG o.s.jdbc.datasource.DataSourceUtils - Fetching JDBC Connection from DataSource
17:19:15.922 [qtp1943091306-38] DEBUG o.s.jdbc.datasource.DataSourceUtils - Returning JDBC Connection to DataSource
17:19:15.938 [qtp1943091306-38] DEBUG o.s.s.w.a.r.PersistentTokenBasedRememberMeServices - Refreshing persistent login token for user 'physio1@physio-termin.at', series 'oLmZMQbnFsfyTziANriMKw=='
17:19:15.939 [qtp1943091306-38] DEBUG o.s.jdbc.core.JdbcTemplate - Executing prepared SQL update
17:19:15.944 [qtp1943091306-38] DEBUG o.s.jdbc.core.JdbcTemplate - Executing prepared SQL statement [update persistent_logins set token = ?, last_used = ? where series = ?]
17:19:15.944 [qtp1943091306-38] DEBUG o.s.jdbc.datasource.DataSourceUtils - Fetching JDBC Connection from DataSource
17:19:15.984 [qtp1943091306-38] DEBUG o.s.jdbc.core.JdbcTemplate - SQL update affected 1 rows
17:19:15.992 [qtp1943091306-38] DEBUG o.s.jdbc.datasource.DataSourceUtils - Returning JDBC Connection to DataSource
17:19:15.996 [qtp1943091306-38] DEBUG o.s.jdbc.core.JdbcTemplate - Executing prepared SQL query
17:19:15.996 [qtp1943091306-38] DEBUG o.s.jdbc.core.JdbcTemplate - Executing prepared SQL statement [select email username, password, isactive enabled from principal where email = ?]
17:19:15.996 [qtp1943091306-38] DEBUG o.s.jdbc.datasource.DataSourceUtils - Fetching JDBC Connection from DataSource
17:19:16.001 [qtp1943091306-38] DEBUG o.s.jdbc.datasource.DataSourceUtils - Returning JDBC Connection to DataSource
17:19:16.013 [qtp1943091306-38] DEBUG o.s.jdbc.core.JdbcTemplate - Executing prepared SQL query
17:19:16.013 [qtp1943091306-38] DEBUG o.s.jdbc.core.JdbcTemplate - Executing prepared SQL statement [select p.email username, a.authority from principal p inner join principal_authority apa on p.id = apa.principal_id inner join authority a on a.id = apa.authorities_id where p.email = ?]
17:19:16.013 [qtp1943091306-38] DEBUG o.s.jdbc.datasource.DataSourceUtils - Fetching JDBC Connection from DataSource
17:19:16.015 [qtp1943091306-38] DEBUG o.s.jdbc.datasource.DataSourceUtils - Returning JDBC Connection to DataSource
17:19:16.021 [qtp1943091306-38] DEBUG o.s.s.w.a.r.PersistentTokenBasedRememberMeServices - Remember-me cookie accepted
17:19:16.036 [qtp1943091306-38] DEBUG o.s.b.f.s.DefaultListableBeanFactory - Returning cached instance of singleton bean 'org.springframework.context.annotation.internalScheduledAnnotationProcessor'
17:19:16.042 [qtp1943091306-38] DEBUG o.s.s.w.a.r.RememberMeAuthenticationFilter - SecurityContextHolder not populated with remember-me token, as AuthenticationManager rejected Authentication returned by RememberMeServices: 'org.springframework.security.authentication.RememberMeAuthenticationToken@2fb6ff6b: Principal: org.springframework.security.core.userdetails.User@d45302c2: Username: physio1@physio-termin.at; Password: [PROTECTED]; Enabled: true; AccountNonExpired: true; credentialsNonExpired: true; AccountNonLocked: true; Granted Authorities: ROLE_PHYSIOTHERAPEUT; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@957e: RemoteIpAddress: 127.0.0.1; SessionId: null; Granted Authorities: ROLE_PHYSIOTHERAPEUT'; invalidating remember-me token
org.springframework.security.authentication.ProviderNotFoundException: No AuthenticationProvider found for org.springframework.security.authentication.RememberMeAuthenticationToken
    at org.springframework.security.authentication.ProviderManager.authenticate(ProviderManager.java:196) ~[spring-security-core-3.1.0.RELEASE.jar:3.1.0.RELEASE]
    at org.springframework.security.web.authentication.rememberme.RememberMeAuthenticationFilter.doFilter(RememberMeAuthenticationFilter.java:102) ~[spring-security-web-3.1.0.RELEASE.jar:3.1.0.RELEASE]
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:323) [spring-security-web-3.1.0.RELEASE.jar:3.1.0.RELEASE]

我错过了什么？我不明白为什么会抛出 ProviderNotFoundException。

【问题讨论】：

请打开调试（将log4j.logger.org.springframework.security=DEBUG 添加到log4j.properties 行）并在您的问题中发布（不工作）remember-me 请求的输出。
调试信息说没有使用remember-me，因为找到了UsernamePasswordAuthenticationToken，所以remember-me似乎没有问题。您能否发布完整调试输出，从正常登录、会话到期和记住我登录尝试开始？另外请更准确地定义您所说的“身份验证工作正常，但根本没有记住我的功能”是什么意思。
我已经更新了我原来的帖子，因为我在使用 Jdbc 的 Persistent-Aproach 方面取得了一些进展

标签： spring-security remember-me

【解决方案1】：

您快完成了，身份验证工作正常，您忘记添加RememberMeAuthenticationProvider。如果您使用安全命名空间来创建 AuthenticationManager，只需添加单独的<authentication-provider>，如下所示：

<authentication-manager>
  <authentication-provider ref="yourRegularAuthenticationProvider" />
  <authentication-provider ref="rememberMeAuthenticationProvider" />
</authentication-manager>

<beans:bean id="rememberMeAuthenticationProvider" class="org.springframework.security.authentication.RememberMeAuthenticationProvider">
  <beans:property name="key" value="reservation" />
</beans:bean>

【讨论】：

谢谢，那是缺少的链接。只是最后一个问题。这是在某个地方记录的还是必须通过查看源代码才能找到？
记录在案的here in Remeber-Me chapter 和here in chapter about AuthenticationProviders 说每个提供者都可以尝试验证，或者通过简单地返回null 来跳过验证。如果所有实现都返回 null，ProviderManager 将抛出 ProviderNotFoundException