删除向导中的身份验证流

Question

我已经通过许多论坛来了解流程，但仍然与正确的流程混淆。

我正在使用Dropwizard，首先我想从REST API获取令牌(用户名和密码将在基本身份验证中提供(，然后下次此令牌将在每个请求中传递。

主类

environment.jersey()
.register(
new AuthDynamicFeature(
new JwtAuthFilter.Builder<User>()
.setAuthenticator(new MarginCalcAuthenticator())
.setAuthorizer(
new CalcAuthorizer())
.setRealm("BASIC-AUTH-REALM")
.buildAuthFilter()));
environment.jersey().register(RolesAllowedDynamicFeature.class);
environment.jersey().register(new AuthValueFactoryProvider.Binder<User>(User.class));

身份验证筛选器

@Priority(Priorities.AUTHENTICATION)
public class JwtAuthFilter<P extends Principal> extends AuthFilter<JWTCredentials, P> {
private static final Logger LOGGER = LoggerFactory.getLogger(JwtAuthFilter.class);
public static final String AUTHENTICATION_HEADER = "Authorization";
@Override
public void filter(final ContainerRequestContext requestContext) throws IOException {
String authCredentials = requestContext.getHeaderString(AUTHENTICATION_HEADER);

身份验证器

public class CalcAuthenticator implements Authenticator<JWTCredentials, User> {
public Optional<User> authenticate(JWTCredentials credentials)
throws AuthenticationException {
AdminAuthenticationService authService = new AdminAuthenticationService();
User userObj = authService.authenticate(credentials.getJwtToken());
if (userObj == null) {
throw new WebApplicationException(Status.UNAUTHORIZED);
}
return Optional.of(userObj);
}
}

REST API 资源类

@GET
@Path("token")
@Produces(MediaType.TEXT_PLAIN)
public Response genToken(@Context SecurityContext sc){
return Response
.ok()
.header("Authorization", "Bearer "+AdminAuthenticationService.issueToken((br.dc.auth.User) sc
.getUserPrincipal())).build();
}

我正在从Postman进行调试，它正在击中我的API genToken，但它从未进入JwtAuthFilter或CalcAuthenticator。谁能帮我理解流程？我想了解流程。

Answer 1

正如保罗所提到的，用@RolesAllowed(或任何其他身份验证anno(注释的类或方法是身份验证所必需的。身份验证仅在您告诉它的方法(或类(上完成。

流程向环境注册您的过滤器、身份验证器等 ->启动您的服务器 ->从 UI 或邮递员请求令牌 -> 它会击中您的 AuthFilter -> 您可以调用身份验证器进行令牌验证 -> 验证您的请求并相应地发送响应。