不同api端点的Spring多种身份验证方法 [英] Spring multiple authentication methods for different api endpoints
问题描述
我想检查不同端点的不同身份验证方法.我想使用的方法是 x509 和 jwt.我需要 only x509 用于某些端点,并使用 JWT 处理所有其他请求.
I want to check for different authentication methods for different endpoints. Methods i want to use are x509 and jwt. I need to use only x509 for certain endpoint and use JWT for all other requests.
这是我的网络安全配置:
Here's my web security configuration:
@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class SecurityConfig extends WebSecurityConfigurerAdapter {
@Configuration
@Order(1)
public static class ApiWebSecurityConfig extends WebSecurityConfigurerAdapter{
@Override
protected void configure(HttpSecurity http) throws Exception {
http
.authorizeRequests()
.antMatchers("/api/transaction/testf").authenticated().and()
.x509()
.subjectPrincipalRegex("CN=(.*?)(?:,|$)")
.userDetailsService(new X509UserDetailsService())
;
}
}
@Configuration
@Order(2)
public static class ApiTokenSecurityConfig extends WebSecurityConfigurerAdapter{
@Override
protected void configure(HttpSecurity http) throws Exception {
http.authorizeRequests()
.antMatchers("/oauth/token", "/api/dealer/login").permitAll()
.and()
.authorizeRequests()
.anyRequest()
.authenticated()
;
}
}
}
此配置仅检查 /api/transaction/testf 端点的 x509 证书,并允许所有其他端点响应.我需要其他端点在没有 jwt 令牌的情况下返回 503.
This configuration only checks /api/transaction/testf endpoint for x509 certificate and allows all other endpoints to respond. I need other endpoints to return 503 without a jwt token.
推荐答案
你有两个过滤器链.它们都没有正确配置 http.antMatcher
的入口点模式.这意味着他们被配置为使用 /**
作为他们的入口点模式.
You have two filter chains. Neither of them have an entry point pattern properly configured http.antMatcher
. That means they are configured to use /**
as their entry point pattern.
例如
@Override
protected void configure(HttpSecurity http) throws Exception {
http
.authorizeRequests()
.anyRequest().fullyAuthenticated()
和说的一样:
@Override
protected void configure(HttpSecurity http) throws Exception {
http
.antMatcher("/**")
.authorizeRequests()
.anyRequest().fullyAuthenticated()
我们在这里说的是
http
- 安全过滤链http.antMatcher
- 安全过滤器链的入口点http.authorizeRequests
- 我的端点访问限制的开始http.authorizeRequests.antMatchers
- 具有特定访问权限的 URL 列表
http
- the security filter chainhttp.antMatcher
- the entry point to the security filter chainhttp.authorizeRequests
- start of my endpoint access restrictionshttp.authorizeRequests.antMatchers
- list of URLs with specific access
所以你需要做的是改变你的 @Order(1)
过滤器链来缩小模式.例如:http.antMatcher("/api/transaction/**")
So what you need to do is change your @Order(1)
filter chain to narrow down the pattern. For example: http.antMatcher("/api/transaction/**")
您的配置现在看起来像
@Configuration
@Order(1)
public static class ApiWebSecurityConfig extends WebSecurityConfigurerAdapter{
@Override
protected void configure(HttpSecurity http) throws Exception {
http
.antMatcher("/api/transaction/**") //customized entry point
.authorizeRequests()
.antMatchers("/api/transaction/testf").authenticated().and()
.x509()
.subjectPrincipalRegex("CN=(.*?)(?:,|$)")
.userDetailsService(new X509UserDetailsService())
;
}
}
@Configuration
@Order(2)
public static class ApiTokenSecurityConfig extends WebSecurityConfigurerAdapter{
@Override
protected void configure(HttpSecurity http) throws Exception {
http
.antMatcher("/**") //this is default
.authorizeRequests()
.antMatchers("/oauth/token", "/api/dealer/login").permitAll()
.and()
.authorizeRequests()
.anyRequest()
.authenticated()
;
}
使用您现有的配置,名为 ApiWebSecurityConfig
的过滤器链将捕获所有调用.另一个过滤器链 ApiTokenSecurityConfig
从未使用过.
With your existing configuration the filter chain named ApiWebSecurityConfig
will trap all calls. The other filter chain, ApiTokenSecurityConfig
, is never used.
您可以在此 回答
SpringSecurity:制作RESTful API 基本身份验证仅通过单个端点即可实现
这篇关于不同api端点的Spring多种身份验证方法的文章就介绍到这了,希望我们推荐的答案对大家有所帮助,也希望大家多多支持IT屋!