允许 Spring 安全性 + CAS 身份验证 + 静态用户列表

Question

我的应用程序带有 Spring 安全配置，可以连接到 cas 服务器(工作(：

@EnableWebSecurity
@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {
@Value("${cas.service-url}")
private String serviceUrl;
@Value("${cas.cas-url}")
private String casUrl;
@Autowired
private AuthenticationProvider authenticationProvider;
@Autowired
private AuthenticationEntryPoint authenticationEntryPoint;
@Autowired
private SingleSignOutFilter singleSignOutFilter;
@Autowired
private LogoutFilter logoutFilter;
@Override
protected void configure(HttpSecurity http) throws Exception {
http.csrf()
.disable()
.authorizeRequests()
.regexMatchers("/secured.*")
.authenticated()
.and()
.authorizeRequests()
.regexMatchers("/")
.permitAll()
.and()
.httpBasic()
.authenticationEntryPoint(authenticationEntryPoint)
.and()
.addFilterBefore(singleSignOutFilter, CasAuthenticationFilter.class)
.addFilterBefore(logoutFilter, LogoutFilter.class);
}
@Override
protected AuthenticationManager authenticationManager() throws Exception {
return new ProviderManager(Arrays.asList(authenticationProvider));
}
@Bean
public CasAuthenticationFilter casAuthenticationFilter(ServiceProperties sP) throws Exception {
CasAuthenticationFilter filter = new CasAuthenticationFilter();
filter.setServiceProperties(sP);
filter.setAuthenticationManager(authenticationManager());
return filter;
}
@Bean
public ServiceProperties serviceProperties() {
ServiceProperties serviceProperties = new ServiceProperties();
serviceProperties.setService(serviceUrl);
serviceProperties.setSendRenew(false);
return serviceProperties;
}
@Bean
@Primary
public AuthenticationEntryPoint authenticationEntryPoint(ServiceProperties sP) {
CasAuthenticationEntryPoint entryPoint = new CasAuthenticationEntryPoint();
entryPoint.setLoginUrl(casUrl + "/login");
entryPoint.setServiceProperties(sP);
return entryPoint;
}
@Bean
public TicketValidator ticketValidator() {
return new Cas30ServiceTicketValidator(casUrl);
}
@Bean
public CasAuthenticationProvider casAuthenticationProvider() {
CasAuthenticationProvider provider = new CasAuthenticationProvider();
provider.setServiceProperties(serviceProperties());
provider.setTicketValidator(ticketValidator());
provider.setUserDetailsService((s) -> {
return new User(s, "fakepassword", true, true, true, true, AuthorityUtils.createAuthorityList("ROLE_ADMIN"));
});
provider.setKey("CAS_PROVIDER_IMPORT_PARCOURSUP_KEY");
return provider;
}
@Bean
public SecurityContextLogoutHandler securityContextLogoutHandler() {
return new SecurityContextLogoutHandler();
}
@Bean
public LogoutFilter logoutFilter() {
LogoutFilter logoutFilter = new LogoutFilter(casUrl + "/logout", securityContextLogoutHandler());
logoutFilter.setFilterProcessesUrl("/logout/cas");
return logoutFilter;
}
@Bean
public SingleSignOutFilter singleSignOutFilter() {
SingleSignOutFilter singleSignOutFilter = new SingleSignOutFilter();
singleSignOutFilter.setCasServerUrlPrefix(casUrl);
singleSignOutFilter.setIgnoreInitConfiguration(true);
return singleSignOutFilter;
}
@EventListener
public SingleSignOutHttpSessionListener singleSignOutHttpSessionListener(HttpSessionEvent event) {
return new SingleSignOutHttpSessionListener();
}
}

现在我想添加一个自动登录列表，他们是唯一可以访问该应用程序的人(即：要访问它们必须在静态列表中的 cas AND 中(。

String allowedLogin = List.of ("robert.bob", "john.jon");

我找到此链接： 弹簧安全 - 特定用户 但我不知道如何实现"静态用户提供程序"以及在我的配置中在哪里配置它。

Answer 1

我认为最简单的方法是在UserDetailsService中抛出一个UsernameNotFoundException，如果用户不在列表中。诸如此类：

provider.setUserDetailsService((s) -> {
if(!allowedLogin.contains(s.getAssertion().getPrincipal().getName())) {
throw new UsernameNotFoundException("user not authorized to use app");
}
return new User(s, "fakepassword", true, true, true, true, AuthorityUtils.createAuthorityList("ROLE_ADMIN"));
});

Answer 2

您可以使用 Spring 安全角色来实现此目的。

为应用创建自定义角色：

public final class AuthoritiesConstants {
public static final String APP = "ROLE_APP";
}

然后添加要授予此角色访问权限的所有用户。

最后，使用蚂蚁匹配器限制对您的应用程序的访问：

.antMatchers("/**").hasAuthority(AuthoritiesConstants.APP)