【发布时间】：2014-12-31 02:08:42
【问题描述】：
我需要创建自定义 xhtml 登录表单。配置spring没有xml only注解，但是authenticationManager总是为null
登录表单
<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml"
xmlns:th="http://www.thymeleaf.org" xmlns:p="http://primefaces.org/ui"
xmlns:h="http://java.sun.com/jsf/html"
xmlns:f="http://java.sun.com/jsf/core"
xmlns:sec="http://www.thymeleaf.org/thymeleaf-extras-springsecurity3">
<head>
<title>Spring Security Example</title>
</head>
<body>
<h:form prependId="false" >
<h:outputLabel value="User Id: " for="j_username" />
<h:inputText id="j_username" label="User Id" required="true"
value="#{loginBean.userName}" />
<h:outputLabel value="Password: " for="j_password" />
<h:inputSecret id="j_password" value="#{loginBean.password}" />
<h:commandButton value="Submit" action="#{loginBean.login}" />
</h:form>
</body>
</html>
配置
@Configuration
@EnableWebSecurity
@EnableGlobalAuthentication
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity http) throws Exception {
http.csrf().disable().authorizeRequests()
.antMatchers("/home", "/css/**", "/**/*.css*", "/").permitAll()
.anyRequest().authenticated().and().formLogin()
.loginPage("/login").permitAll().and().logout()
.logoutUrl("/logout").invalidateHttpSession(true)
.logoutSuccessUrl("/");
}
@Override
protected void configure(AuthenticationManagerBuilder auth)
throws Exception {
auth.inMemoryAuthentication().withUser("user").password("password")
.roles("USER");
}
@Bean
public AuthenticationManager authenticationManager() throws Exception {
return super.authenticationManagerBean();
}
}
在 LoginBean 类中需要 @Autowired
import java.io.IOException;
import java.io.Serializable;
import javax.faces.bean.ManagedProperty;
import javax.inject.Named;
import javax.servlet.ServletException;
import org.springframework.context.annotation.Scope;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.stereotype.Component;
@Scope("request")
@Component
@Named(value="loginBean")
public class LoginBean implements Serializable {
@Autowired
private AuthenticationManager authenticationManager;
private static final long serialVersionUID = 1L;
private String userName;
private String password;
public String login() {
try {
Authentication request = new UsernamePasswordAuthenticationToken(
this.getUserName(), this.getPassword());
Authentication result = authenticationManager.authenticate(request);
SecurityContextHolder.getContext().setAuthentication(result);
} catch (AuthenticationException e) {
e.printStackTrace();
}
return "secured";
}
public String getUserName() {
return userName;
}
public void setUserName(String userName) {
this.userName = userName;
}
public String getPassword() {
return password;
}
public void setPassword(String password) {
this.password = password;
}
public AuthenticationManager getAuthenticationManager() {
return authenticationManager;
}
public void setAuthenticationManager(
AuthenticationManager authenticationManager) {
this.authenticationManager = authenticationManager;
}
}
我正在尝试注入 authenticationManager
@ManagedProperty(value = "#{authenticationManager}")
private AuthenticationManager authenticationManager;
或创建构造函数
@Autowired
public LoginBean(AuthenticationManager authenticationManager) {
this.authenticationManager = authenticationManager;
}
或者在setter中添加@Autowired，authenticationManager总是为null。如何注入 authenticationManager ？
我尝试的那些 @ovverride authenticationManagerBean 没有
我找到了 spring security giude 但我不想使用百里香
感谢您的帮助
【问题讨论】：
-
您将 CDI 和 Spring 混合使用，这是行不通的。您最终会得到由不同容器管理的不同实例。要使用
@ManagedProperty，您必须使用 JSF 托管 bean 而不是@Named使用@ManagedBean。 -
是的，当我使用
@ManagedProperty时，我使用@ManagedBean和@RequestScoped -
确保您已正确设置 Spring JSF 集成，否则它将无法工作。此外，如果 bean 是
null，我希望在@ManagedBean的情况下会出现异常，类似于找不到 bean。 -
认证成功后如何将用户重定向到想要的页面？