在公共(permitAll())页面上自动确定CAS用户

Question

我在Spring Boot中使用Spring Security，并通过JASIG CAS对我的用户进行身份验证。有些页面需要显式的身份验证(.authenticated())，有些页面是针对所有用户的。

现在菜单中有一个特定的区域，指示当前用户和可能的操作，如登录/注销。

我的主要问题是现在主页是公共的(permitAll())，如果用户已经通过其他应用程序拥有CAS会话，那么他将显示为"anonymousUser"，直到手动单击登录或打开受保护的页面。

有没有人对如何使它工作有任何想法?

我的安全配置:

import org.jasig.cas.client.validation.Cas20ServiceTicketValidator;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.env.Environment;
import org.springframework.security.cas.ServiceProperties;
import org.springframework.security.cas.authentication.CasAuthenticationProvider;
 import org.springframework.security.cas.web.CasAuthenticationEntryPoint;
import org.springframework.security.cas.web.CasAuthenticationFilter;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.method.configuration.GlobalMethodSecurityConfiguration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.builders.WebSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.userdetails.AuthenticationUserDetailsService;
import org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler;
@Configuration
@EnableWebSecurity
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
@Autowired
private Environment env;
@Autowired
private CasAuthenticationProvider authProvider;
@Bean
public ServiceProperties serviceProperties() {
    ServiceProperties sp = new ServiceProperties();
    sp.setSendRenew(false);
    sp.setService(env.getProperty("app.url") + "/j_spring_cas_security_check");
    return sp;
}
@SuppressWarnings("rawtypes")
@Autowired
private AuthenticationUserDetailsService customUserDetailsService() {
    return new CASUserDetailsService();
}

@Bean
public CasAuthenticationProvider casAuthenticationProvider() {
    CasAuthenticationProvider casAuthenticationProvider = new CasAuthenticationProvider();
    casAuthenticationProvider.setAuthenticationUserDetailsService(customUserDetailsService());
    casAuthenticationProvider.setServiceProperties(serviceProperties());
    casAuthenticationProvider.setTicketValidator(cas20ServiceTicketValidator());
    casAuthenticationProvider.setKey("an_id_for_this_auth_provider_only");
    return casAuthenticationProvider;
}
@Bean
public Cas20ServiceTicketValidator cas20ServiceTicketValidator() {
    return new Cas20ServiceTicketValidator(env.getProperty("cas.service.url"));
}
@Bean
public CasAuthenticationFilter casAuthenticationFilter() throws Exception {
    CasAuthenticationFilter casAuthenticationFilter = new CasAuthenticationFilter();
    casAuthenticationFilter.setAuthenticationManager(authenticationManager());
    casAuthenticationFilter.setAuthenticationSuccessHandler(savedRequestAwareAuthenticationSuccessHandler());
    return casAuthenticationFilter;
}
@Bean
public CasAuthenticationEntryPoint casAuthenticationEntryPoint() {
    CasAuthenticationEntryPoint ep = new CasAuthenticationEntryPoint();
    ep.setLoginUrl(env.getProperty("cas.service.url") + "/login");
    ep.setServiceProperties(serviceProperties());
    return ep;
}
@Autowired
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
    auth.authenticationProvider(authProvider);
}
@Override
public void configure(WebSecurity web) throws Exception {
    web.ignoring().antMatchers("/js/**").antMatchers("/fonts/**").antMatchers("/images/**").antMatchers("/css/**");
}
@Override
protected void configure(HttpSecurity http) throws Exception {
    http.exceptionHandling().
            authenticationEntryPoint(casAuthenticationEntryPoint()).and().addFilter(casAuthenticationFilter()).
            logout().logoutUrl("/caslogout").addLogoutHandler(logoutHandler()).logoutSuccessUrl("/").deleteCookies("JSESSIONID").permitAll().and().
            csrf().disable().headers().frameOptions().disable().authorizeRequests().antMatchers("/rest/**").permitAll().
            antMatchers("/login/**").authenticated().antMatchers("/settings/**").authenticated().
            antMatchers("/projects/*/settings").authenticated().antMatchers("/projects/*/role").authenticated().
            antMatchers("/projects/*/*/admin").authenticated().antMatchers("/**").permitAll();
}

@Bean
public SavedRequestAwareAuthenticationSuccessHandler savedRequestAwareAuthenticationSuccessHandler() {
    CASAuthSuccessHandler auth = new CASAuthSuccessHandler();
    return auth;
}
@Bean
public CASLogoutHandler logoutHandler() {
    CASLogoutHandler logout = new CASLogoutHandler();
    return logout;
}

@EnableGlobalMethodSecurity(prePostEnabled = true, jsr250Enabled = true)
private static class GlobalSecurityConfiguration extends GlobalMethodSecurityConfiguration {
}

}

Answer 1

您正在寻找的是CAS的网关功能。目前Spring Security不支持这个功能。有一个JIRA日志来支持它，一个Pull Request正在等待根据我对提交者的反馈进行额外的修改。

我会看一下拉请求，因为它演示了如何实现这一点的几个选项。请务必通读整篇文章，因为您需要对Pull Request进行一些更改，以确保您的应用程序执行。