在Spring 4中配置不带XML的Spring Security [英] Configure Spring Security without XML in Spring 4

问题描述

我要使用一个custom authentication filter:

1. 捕获加密的标头令牌
2. 验证后，提取用户的详细信息并将其以无状态方式添加到当前请求的安全上下文中

我希望能够使用此安全上下文持有者来获取有关当前请求用户的详细信息，以正确处理他们的请求.

@RequestMapping(value = "/simple", method = RequestMethod.POST)
@ResponseBody
@Transactional
@Preauthorize(...)
public String simple(){
   //collect the user's current details from the getPrinciple() and complete the transaction...
    Object principal = SecurityContextHolder.getContext().getAuthentication().getPrincipal();
    return "Simple";
}

我以前是用XML做到的，就像这样:

I have done this before in XML like so:

<beans xmlns="http://www.springframework.org/schema/beans"
    xmlns:security="http://www.springframework.org/schema/security"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans-3.2.xsd
http://www.springframework.org/schema/security
http://www.springframework.org/schema/security/spring-security-3.2.xsd">

    <security:global-method-security
        secured-annotations="enabled" />

    <security:http pattern="/**"
        auto-config="true" disable-url-rewriting="true" use-expressions="true">
        <security:custom-filter ref="authenticationTokenProcessingFilter"
            position="FORM_LOGIN_FILTER" />
        <security:intercept-url pattern="/authenticate"
            access="permitAll" />
        <security:intercept-url pattern="/secure/**"
            access="isAuthenticated()" />
    </security:http>

    <bean id="CustomAuthenticationEntryPoint" class="org.foo.CustomAuthenticationEntryPoint" />

    <bean class="org.foo.AuthenticationTokenProcessingFilter" id="authenticationTokenProcessingFilter">
        <constructor-arg ref="authenticationManager" />
    </bean>

</beans>

但是，我希望它可以与非XML WebSecurityConfigurerAdapter中的更新的Spring Boot应用程序一起使用，就像其Spring Boot文件中的示例一样:

However, I want this to work with a newer Spring Boot application in a non-xml WebSecurityConfigurerAdapter like the example in their Spring Boot files:

    @Bean
    public ApplicationSecurity applicationSecurity() {
        return new ApplicationSecurity();
    }

    @Order(Ordered.LOWEST_PRECEDENCE - 8)
    protected static class ApplicationSecurity extends WebSecurityConfigurerAdapter {
        @Override
        protected void configure(HttpSecurity http) throws Exception {
            // this is obviously for a simple "login page" not a custom filter!
http.authorizeRequests().anyRequest().fullyAuthenticated().and().formLogin()
                        .loginPage("/login").failureUrl("/login?error").permitAll(); 
            }
        }

有什么建议或类似的例子吗?

Any advice or similar examples out there?

推荐答案

我现在正在做类似的事情.将来有人会发现这很有帮助. 将xml转换为java config会使它看起来像以下内容:

I am doing something similar now. Someone might find this helpful in the future. Doing an xml to java config translation would make it look like the following:

import javax.servlet.Filter;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Qualifier;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.web.AuthenticationEntryPoint;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;

@EnableGlobalMethodSecurity(securedEnabled=true) //<security:global-method-security secured-annotations="enabled" />
public class ApplicationSecurity extends WebSecurityConfigurerAdapter {

    @Autowired
    @Qualifier("authenticationTokenProcessingFilter")
    private Filter authenticationTokenProcessingFilter;

    @Autowired
    private AuthenticationEntryPoint entryPoint;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.exceptionHandling().authenticationEntryPoint(entryPoint);


        http //auto-config="true"
            .authorizeRequests()
                .anyRequest().authenticated()
                .and()
            .formLogin()
                .and()
            .httpBasic();


        http
            .authorizeRequests() // use-expressions="true"
            .antMatchers("/authenticate").permitAll() //<security:intercept-url pattern="/authenticate" access="permitAll" />
            .antMatchers("/secure/**").authenticated() //<security:intercept-url pattern="/secure/**"            access="isAuthenticated()" />
            .and()
            .addFilterBefore(authenticationTokenProcessingFilter, UsernamePasswordAuthenticationFilter.class) // <security:custom-filter ref="authenticationTokenProcessingFilter" position="FORM_LOGIN_FILTER" /> http://docs.spring.io/spring-security/site/docs/3.0.x/reference/ns-config.html
            ;
    }
}

这篇关于在Spring 4中配置不带XML的Spring Security的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！