多个登录表单，不同的身份验证管理器 - 最新的 Spring Security [英] Multiple login forms, different authentication managers - latest spring security

问题描述

我有一个使用 Spring Security 保护的 Web 应用程序，它需要两个单独的登录表单.这两个登录表单需要完全独立.我的意思是不同的登录表单，不同的 url 路径，也可以为每个表单设置不同的身份验证管理器.

I have a web application secured with Spring Security that needs two separate login forms. These two login forms need to be totally independent. I mean different login form, different url paths, be able to have a different authentication manager for each one too.

我已经在谷歌上搜索过，有一些方法可以做到这一点，但我已经阅读并看到过去几周的一些更改应该可以在代码的最新快照版本中轻松完成此操作.

I have looked all over google and there are some ways to do this, but I have read and see some changes the last couple of weeks should make it easy to do this in the latest snapshot versions of the code.

首先，由于此错误已完成SEC-1171，我们现在可以拥有多个命名空间元素以支持多个过滤器链配置.

First of all, as this bug is complete SEC-1171 we can now have multiple namespace elements to support multiple filter chain configurations.

其次，由于这个其他错误显示 SEC-1847 我们现在可以选择每个 http 标签的自定义身份验证管理器.

Secondly, as this other bug shows SEC-1847 we are now able to select a custom authentication manager for each http tag.

问题是我已经下载、编译了所有东西，但我的 xsd 不允许我为每个 http 标签创建自定义身份验证管理器，每当我尝试更改登录处理 url 或尝试时，我也会收到错误为每个登录表单使用记住我的密钥.

The problem is that I have downloaded, compiled and everything but my xsd doesn't allow me to create a custom auth manager for each http tag, I also get errors whenever I try to change the login processing url or whenever I try to use a remember me key for each login form.

我开始做这样的事情:

<!-- Configure realm for administration users -->
<http pattern="/admin/**" auto-config="true" disable-url-rewriting="true" >
    <intercept-url pattern="/admin/**" access="ROLE_ADMIN" />
    <form-login login-page="/adminLogin.htm" default-target-url="/" 
                login-processing-url="/loginProcessing" 
                authentication-failure-url="/adminLogin.htm?error" />
    <logout invalidate-session="true" logout-success-url="/" logout-url="/logout" />
<remember-me key="******" user-service-ref="userDetailsService" />
</http>

<!-- Configure realm for standard users -->
<http auto-config="true" disable-url-rewriting="true">
    <intercept-url pattern="/user/**" access="ROLE_USER" />
    <form-login login-page="/login.htm" default-target-url="/" 
                login-processing-url="/loginProcessing" 
                authentication-failure-url="/login.htm?error" />
    <logout invalidate-session="true" logout-success-url="/" logout-url="/logout" />
<remember-me key="******" user-service-ref="userDetailsService" />
</http>

<authentication-manager alias="authenticationManager">
<authentication-provider user-service-ref="userDetailsService"  >
    <password-encoder ref="passwordEncoder"/>
</authentication-provider>

<authentication-provider>
    <password-encoder ref="passwordEncoder"/>
    <user-service>
                <user name="ned" password="****" authorities="ROLE_USER" />
            <user name="tom" password="****" authorities="ROLE_ADMIN"/>
    </user-service>
</authentication-provider>
</authentication-manager>

我使用的是 Spring Security 3.1 的最新快照.

I am using the latest snapshot of Spring Security 3.1.

正如我所说，理想的情况是能够使用最近针对这些错误更改的新"方式来拥有完全独立的两个不同的登录表单.

As I said the ideal would be to be able to have two different login forms totally independent using the "new" way that was changed recently on these bugs.

有人用过这个或有任何想法吗?

Anybody has worked with this or has any idea?

提前致谢.

推荐答案

正如你在 提交日志 11 年 10 月 30 日 (2f67bb3) 对于 SEC-1847，authentication-manager-可以在 http 和 global-method-security 中添加 ref 属性.

As you can see in commit log of October 30th'11 (2f67bb3) for SEC-1847, the authentication-manager-ref attribute can be added in http and global-method-security.

这篇关于多个登录表单，不同的身份验证管理器 - 最新的 Spring Security的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！