Spring启动安全与3字段认证和自定义登录表单

Question

我正在使用春季启动，我需要实现春季安全与3个字段的身份验证过程用户名，密码和企业标识符作为一个隐藏的输入形式。

我实现了一个自定义usernamepasswordauthenticationfilter，但它似乎不足以设置安全配置。

编辑:

用户似乎没有被认证!因为a可以访问web配置

中定义的已验证请求

编辑2:

在我的自定义过滤器中，当输入一个有效的用户时，它会在成功的身份验证上执行。我错过了什么，请给我任何帮助:(我在这里

@Repository
public class AuthenticationUserDetailsService implements UserDetailsService {
private static final Logger LOGGER = Logger.getLogger(AuthenticationUserDetailsService.class);
@Autowired
private UserRepository users;
private org.springframework.security.core.userdetails.User userdetails;
@Override
public UserDetails loadUserByUsername(String input) throws UsernameNotFoundException {
    // TODO Auto-generated method stub
    System.out.println(input);
    String[] split = input.split(":");
    if (split.length < 2) {
        LOGGER.debug("User did not enter both username and corporate domain.");
        throw new UsernameNotFoundException("no corporate identifier is specified");
    }
    String username = split[0];
    String corporateId = split[1];
    System.out.println("Username = " + username);
    System.out.println("Corporate identifier = " + corporateId);
    boolean enabled = true;
    boolean accountNonExpired = true;
    boolean credentialsNonExpired = true;
    boolean accountNonLocked = true;
    com.ubleam.corporate.server.model.User user;
    user = checkUserDetail(username, corporateId);
    if (user == null)
        throw new NotAuthorizedException("Your are not allowed to access to this resource");
    LOGGER.info("User email : " + user.getEmail() + "#User corporate : " + user.getCorporateId());
    userdetails = new User(user.getEmail(), user.getPassword(), enabled, accountNonExpired, credentialsNonExpired, accountNonLocked, getAuthorities("ROLE_USER"));
    return userdetails;
}
/**
 * 
 * @param roles
 *            roles granted for user
 * @return List of granted authorities
 * 
 */
public List<GrantedAuthority> getAuthorities(String roles) {
    List<GrantedAuthority> authList = new ArrayList<GrantedAuthority>();
    authList.add(new SimpleGrantedAuthority(roles));
    return authList;
}
/**
 * User authentication details from database
 * 
 * @param username
 *            to use for authentication
 * @param coporateId
 *            corporate identifier of user
 * @return found user in database
 */
private com.ubleam.corporate.server.model.User checkUserDetail(String username, String corporateId) {
    com.ubleam.corporate.server.model.User user = users.findByEmailAndCorporateId(username, corporateId);
    return user;
}

我的自定义过滤器:

public class PlatformAuthenticationFilter extends UsernamePasswordAuthenticationFilter {
private static final Logger LOGGER = Logger.getLogger(PlatformAuthenticationFilter.class);
private static final String LOGIN_SUCCESS_URL = "{0}/bleamcards/{1}/home";
private static final String LOGIN_ERROR_URL = "{0}/bleamcards/{1}/login?error";
private String parameter = "corporateId";
private String delimiter = ":";
private String corporateId;
@Override
protected String obtainUsername(HttpServletRequest request) {
    String username = request.getParameter(getUsernameParameter());
    String extraInput = request.getParameter(getParameter());
    String combinedUsername = username + getDelimiter() + extraInput;
    setCorporateId(extraInput);
    LOGGER.info("Combined username = " + combinedUsername);
    return combinedUsername;
}
@Override
protected void successfulAuthentication(HttpServletRequest request, HttpServletResponse response, Authentication authResult) throws IOException, ServletException {
    String contextPath = request.getContextPath();
    String url = MessageFormat.format(LOGIN_SUCCESS_URL, contextPath, corporateId);
    response.sendRedirect(url);
}
@Override
protected void unsuccessfulAuthentication(HttpServletRequest request, HttpServletResponse response, AuthenticationException failed) throws IOException, ServletException {
    String contextPath = request.getContextPath();
    String url = MessageFormat.format(LOGIN_ERROR_URL, contextPath, corporateId);
    response.sendRedirect(url);
}
public String getParameter() {
    return parameter;
}
public void setParameter(String corporateId) {
    this.parameter = corporateId;
}
public String getDelimiter() {
    return delimiter;
}
public void setDelimiter(String delimiter) {
    this.delimiter = delimiter;
}
public String getCorporateId() {
    return corporateId;
}
public void setCorporateId(String corporateId) {
    this.corporateId = corporateId;
}
}

最后是web安全配置:

@Configuration
@EnableWebMvcSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
@Inject
private AuthenticationManagerBuilder auth;
@Inject
private UserDetailsService userDS;
@Override
protected void configure(HttpSecurity http) throws Exception {
    http.authorizeRequests().antMatchers("/bleamcards/**/login", "/bleamcards/**/forgetpassword", "/bleamcards/**/register", "/css/**", "/js/**", "/images/**", "/webjars/**")
            .permitAll().anyRequest().authenticated().and().addFilterBefore(authenticationFilter(), UsernamePasswordAuthenticationFilter.class).formLogin().loginPage("/login")
            .defaultSuccessUrl("/").permitAll().and().logout().permitAll();
}
@Autowired
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
    auth.eraseCredentials(false);
    auth.userDetailsService(userDS).passwordEncoder(new BCryptPasswordEncoder());
}
@Bean
@Override
public AuthenticationManager authenticationManager() throws Exception {
    return auth.build();
}
@Bean
public PlatformAuthenticationFilter authenticationFilter() throws Exception {
    PlatformAuthenticationFilter authFilter = new PlatformAuthenticationFilter();
    authFilter.setRequiresAuthenticationRequestMatcher(new AntPathRequestMatcher("/login", "POST"));
    authFilter.setAuthenticationManager(authenticationManager());
    authFilter.setUsernameParameter("username");
    authFilter.setPasswordParameter("password");
    authFilter.setParameter("corporateId");
    return authFilter;
}
@Override
protected UserDetailsService userDetailsService() {
    return userDS;
}

我希望用户能够只连接到/login/register/forgetpassword url为他们各自的企业平台

Answer 1

实际上我设法找到了一个解决我的问题的方法。

我在successfulAuthentication上添加了succeshandler缺失!在不成功的身份验证方法上也有一个failureHandler。

这是我新的身份验证过滤器:

public class TwoFactorAuthenticationFilter extends UsernamePasswordAuthenticationFilter {
private static final String LOGIN_SUCCESS_URL = "{0}/bleamcards/{1}/home"; 
private static final String LOGIN_ERROR_URL = "{0}/bleamcards/{1}/login?error";
private String parameter = "corporateId";
private String delimiter = ":";
private String corporateId;

@Override
protected String obtainUsername(HttpServletRequest request) {
    String username = request.getParameter(getUsernameParameter());
    String extraInput = request.getParameter(getParameter());
    String combinedUsername = username + getDelimiter() + extraInput;
    setCorporateId(extraInput);
    System.out.println("Combined username = " + combinedUsername);
    return combinedUsername;
}
@Override
protected void successfulAuthentication(HttpServletRequest request, HttpServletResponse response, FilterChain chain , Authentication authResult) throws IOException, ServletException {
    String contextPath = request.getContextPath();
    String url = MessageFormat.format(LOGIN_SUCCESS_URL, contextPath, corporateId);
    setAuthenticationSuccessHandler(new SimpleUrlAuthenticationSuccessHandler(url));
    super.successfulAuthentication(request, response, chain, authResult);
}
@Override
protected void unsuccessfulAuthentication(HttpServletRequest request, HttpServletResponse response, AuthenticationException failed) throws IOException, ServletException {
    String contextPath = request.getContextPath();
    String url = MessageFormat.format(LOGIN_ERROR_URL, contextPath, corporateId);
    setAuthenticationFailureHandler(new SimpleUrlAuthenticationFailureHandler(url));
    super.unsuccessfulAuthentication(request, response, failed);
}
public String getParameter() {
    return parameter;
}
public void setParameter(String corporateId) {
    this.parameter = corporateId;
}
public String getDelimiter() {
    return delimiter;
}
public void setDelimiter(String delimiter) {
    this.delimiter = delimiter;
}
public String getCorporateId() {
    return corporateId;
}
public void setCorporateId(String corporateId) {
    this.corporateId = corporateId;
}
}

Answer 2

您是否检查了您的AuthenticationUserDetailsService代码是否实际被执行?如果框架没有调用它，这意味着您的配置没有正确地挂钩UserDetailsService。在你的WebSecurityConfig中，我认为你需要这样做:

@Bean
public AuthenticationManager getAuthenticationManager() throws Exception {
    return super.authenticationManagerBean(); //not return auth.build();
}

我建议你看看这个分支从Stormpath。在这里，他们正在配置Spring Boot以使用自定义AuthenticationProvider(类似于UserDetailsService)。该模块使用并依赖于另一个Spring Security模块。

然后，这个示例Spring安全性示例(注意它不是Spring Boot，而只是Spring)将为您提供Spring安全性Java配置方式的完整示例。请注意，这个Java配置扩展了这个配置，实际上隐藏了很多实际的内部配置。

免责声明，我是一个活跃的Stormpath贡献者。