【发布时间】：2015-03-02 12:20:31
【问题描述】：
我正在尝试实现一个自定义 AuthenticationProvider 来验证对我所有受保护 URL 的调用。我已经实现了所有方法并相信我的 xml 配置是正确的，但是对受保护 URL 的调用总是转到 entry-point-ref 类（我在其中抛出 401 错误）。这是跳过我的身份验证提供程序（我的身份验证方法中有日志语句并且知道它没有被调用）。从其他帖子中我了解到 support 方法可能是罪魁祸首，但我已将其设置为始终返回 true，所以这不应该是我的问题。
我的安全上下文代码：
<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:beans="http://www.springframework.org/schema/beans"
xmlns:context="http://www.springframework.org/schema/context"
xmlns:security="http://www.springframework.org/schema/security"
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.2.xsd">
<security:http
use-expressions="true"
auto-config="false"
create-session="stateless"
entry-point-ref="unauthorizedEntryPoint"
authentication-manager-ref="authenticationManager">
<security:intercept-url pattern="/User/sign_up/*" access="permitAll" />
<security:intercept-url pattern="/User/authenticate/**" access="permitAll" />
<security:intercept-url pattern="/**" access="hasRole('ROLE_USER')" />
</security:http>
<authentication-manager alias="authenticationManager">
<authentication-provider ref="customAuthenticationProvider" />
</authentication-manager>
<beans:bean id="customAuthenticationProvider" class="pathto:CustomAuthenticationProvider" />
<beans:bean id="unauthorizedEntryPoint" class="pathto:UnauthorizedEntryPoint" /
web.xml 的代码：
<?xml version="1.0" encoding="UTF-8"?>
<web-app version="2.5" xmlns="http://java.sun.com/xml/ns/javaee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd">
The definition of the Root Spring Container shared by all Servlets and Filters -->
<context-param>
<param-name>contextConfigLocation</param-name>
<param-value>
/WEB-INF/spring/security-context.xml
</param-value>
</context-param>
<!-- Creates the Spring Container shared by all Servlets and Filters -->
<listener>
<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>
<filter>
<filter-name>springSecurityFilterChain</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
<filter-name>springSecurityFilterChain</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
</web-app>
未授权入口点：
public class UnauthorizedEntryPoint implements AuthenticationEntryPoint {
@Override
public void commence(HttpServletRequest request, HttpServletResponse response,
AuthenticationException authenticationException) throws IOException, ServletException {
System.out.println("in unauth");
response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Authentication Failure: UnauthorizedEntryPoint Token invalid");
}
}
AuthenticationProvider：（目前这里不做任何认证）
@Component
public class CustomAuthenticationProvider implements AuthenticationProvider {
@Override
public Authentication authenticate(Authentication auth)
throws AuthenticationException {
System.out.println("in authenticate");
String username = auth.getName();
String password = auth.getCredentials().toString();
List<GrantedAuthority> AUTHORITIES = new ArrayList<GrantedAuthority>();
System.out.println("username: "+username+". password: "+ password);
if (true) { //checkPassword(password, user.getPasswords())) {
AUTHORITIES.add(new SimpleGrantedAuthority("ROLE_USER"));
return new UsernamePasswordAuthenticationToken(auth.getName(), auth.getCredentials(), AUTHORITIES);
}
return null;
}
@Override
public boolean supports(Class<?> authentication) {
return true;
}
更新： 我正在使用参数 j_username 和 j_password 使用 Advanced Rest Client 对此进行测试。这是正确的还是问题所在？
您对可能出现的问题有任何见解吗？
谢谢！
【问题讨论】：
-
我最终采用了不同的方式，并设置了一个自定义过滤器来调用它，类似于 here 所做的那样。
-
我面临着类似的问题。你能提供一些细节你是如何解决的吗？您提供的链接已失效。
标签： java authentication spring-security