实现 URL 身份验证的 Spring Security 时 URL 访问被拒绝

Question

我正在尝试在通过业务逻辑给出响应之前实现 URL 身份验证。为此，我正在使用 Spring Security 的身份验证提供程序，并尝试做一个简单的演示来测试 authenticationProvider 是否正常工作。在此之后，我将通过添加我的业务逻辑进行修改。

我的安全配置文件 SecurityConfig.java 如下，

@EnableWebSecurity
@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {

@Autowired
private CustomAuthenticationProvider authenticationProvider;

@Override
protected void configure(HttpSecurity http) throws Exception {
    http.csrf().disable();
    http.authorizeRequests()
            .anyRequest()
            .authenticated()
            .and().httpBasic(); 
}
@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception 
  {
    auth.authenticationProvider(authenticationProvider);
  } 
 }

我的 CustomAuthenticationProvider.java 实现如下，

@Component
public class CustomAuthenticationProvider  implements AuthenticationProvider 
{
@SuppressWarnings("unused")
@Override
public Authentication authenticate(Authentication authToken) throws AuthenticationException {

    String userToken = (String) authToken.getName();
    String responseString = "test";
    String password = "test";

    if(responseString.equals(userToken)) {
        UsernamePasswordAuthenticationToken auth = new UsernamePasswordAuthenticationToken(userToken, password);
    return auth;
    }
    else {
        return null;
    }
}

@Override
public boolean supports(Class<?> authentication) {
    return authentication.equals(UsernamePasswordAuthenticationToken.class);
  }
} 

我的 TestSecurity.java 如下所示，

@RestController
public class TestSecurity {

 @GetMapping("/security/load")
 public String LoadSecureUsers() {

        return "hello spring security";
    }
}

当我从 POSTMAN 应用程序调用带有标头 authToken: "test" 的 URL localhost:8585/security/load 时，我得到以下信息，

{
"timestamp": "2019-10-30T07:24:25.165+0000",
"status": 401,
"error": "Unauthorized",
"message": "Unauthorized",
"path": "/security/load"
}

如果IF中的条件满足，那么URL怎么不能访问呢？我在身份验证提供程序实现中犯了任何错误吗？

Answer 1

使用过滤器代替 AuthenticationProvider 来处理请求。此代码可能会对您有所帮助：

public class ApplicationAuthFilter extends BasicAuthenticationFilter {

    public ApplicationAuthFilter(AuthenticationManager authenticationManager) {
        super(authenticationManager);
    }

    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws IOException, ServletException {
        UsernamePasswordAuthenticationToken authentication = getAuthentication(request);
        SecurityContextHolder.getContext().setAuthentication(authentication);
        filterChain.doFilter(request, response);
    }

    private UsernamePasswordAuthenticationToken getAuthentication(HttpServletRequest request) {
        String token = String bearerToken = req.getHeader("accessToken");
    String username = "test";
    String password = "test"
        if (username != null && !username.isEmpty()) {
            return new UsernamePasswordAuthenticationToken(username, null, authorities);
        }
        return null;
    }
}

你的安全配置文件是这样的：

@Configuration
@EnableWebSecurity
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
        .csrf().disable()
        .authorizeRequests()
        .anyRequest().authenticated()
        .and()
        .addFilter(new ApplicationAuthFilter(authenticationManager()))
    }

}

基本上，您需要读取随请求传递的标头信息，并根据该信息采取行动。

希望这会有所帮助。