preAuthentication使用Spring Security - ＆GT;基于URL参数 [英] PreAuthentication with Spring Security -> Based on URL parameters

问题描述

客户希望有以下情形：

有两个参数的web应用程序的用户客户手上出来的链接（webapp的地址）。根据这些变量，用户将在对Web应用中的具体作用。
我不想在任何授权。应该只有认证检查，看起来这些URL参数，并检查它们是否有效，将用户连接到相应的作用。

Customer hands out link (webapp address) with 2 parameters to the webapp user. Based on these variables the user will take on specific roles in the webapp. I don't want any authorization in it. There should only be the authentication check which looks at these url parameters and checks if they are valid and will connect the user to the appropriate role.

我怎么能认识到这一点？是否已有一个解决方案可用？

How can I realize this?! Is there already a solution available?

谢谢！

至于马提亚

推荐答案

我已经解决了这个问题。
对于那些有兴趣谁....

I already solved the problem. For those who are interested ....

的web.xml

<!-- ===== SPRING CONFIG ===== -->
<listener>
    <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>

<listener>
    <listener-class>org.springframework.web.context.request.RequestContextListener</listener-class>
</listener>

<filter>
    <filter-name>springSecurityFilterChain</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>

<filter-mapping>
    <filter-name>springSecurityFilterChain</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

<context-param>
    <param-name>contextConfigLocation</param-name>
    <param-value>
        /WEB-INF/applicationContext.xml
        /WEB-INF/applicationContext-security.xml
    </param-value>
</context-param>

的applicationContext.xml

applicationContext.xml

<context:component-scan base-package="at.beko.rainstar2" />

<tx:annotation-driven transaction-manager="transactionManager" />

的applicationContext-security.xml文件

applicationContext-security.xml

<!-- Configuring security not finished!! -->
<http create-session="never" use-expressions="true" auto-config="false"
    entry-point-ref="preAuthenticatedProcessingFilterEntryPoint">
    <intercept-url pattern="/authError.xhtml" access="permitAll" />
    <intercept-url pattern="/**" access="hasRole('ROLE_USER')" />
    <custom-filter position="PRE_AUTH_FILTER" ref="preAuthFilter" />
    <session-management session-fixation-protection="none" />
</http>

<beans:bean id="userDetailsServiceImpl"
    class="at.beko.rainstar2.service.impl.UserDetailsServiceImpl" />

<beans:bean id="preAuthenticatedProcessingFilterEntryPoint"
    class="at.beko.rainstar2.model.LinkForbiddenEntryPoint" />

<beans:bean id="preAuthenticationProvider"
    class="org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationProvider">
    <beans:property name="preAuthenticatedUserDetailsService"
        ref="userDetailsServiceImpl" />
</beans:bean>

<beans:bean id="preAuthFilter"
    class="at.beko.rainstar2.service.filter.UrlParametersAuthenticationFilter">
    <beans:property name="authenticationManager" ref="appControlAuthenticationManager" />
</beans:bean>

<authentication-manager alias="appControlAuthenticationManager">
    <authentication-provider ref="preAuthenticationProvider" />
</authentication-manager>

LinkForbiddenEntryPoint.java

LinkForbiddenEntryPoint.java

public class LinkForbiddenEntryPoint implements AuthenticationEntryPoint {

@Override
public void commence(HttpServletRequest request,
        HttpServletResponse response, AuthenticationException authException)
        throws IOException, ServletException {
    HttpServletResponse httpResponse = (HttpServletResponse) response;
    httpResponse.sendRedirect("/rainstar2-webapp/authError.xhtml");
}

}

UrlParametersAuthenticationFilter.java

UrlParametersAuthenticationFilter.java

public class UrlParametersAuthenticationFilter extends
    AbstractPreAuthenticatedProcessingFilter {

@Override
protected Object getPreAuthenticatedPrincipal(HttpServletRequest request) {
    if (request.getParameterMap().size() == 2) {
        return true;
    }
    return false;
}

@Override
protected Object getPreAuthenticatedCredentials(HttpServletRequest request) {
    String[] credentials = new String[2];
    credentials[0] = request.getParameter("param1");
    credentials[1] = request.getParameter("param2");
    return credentials;
}

}

UserDetailsS​​erviceImpl.java

UserDetailsServiceImpl.java

@SuppressWarnings("deprecation")
public class UserDetailsServiceImpl implements
    AuthenticationUserDetailsService<Authentication> {

@Override
public UserDetails loadUserDetails(Authentication token)
        throws UsernameNotFoundException {
    UserDetails userDetails = null;

            String[] credentials = (String[]) token.getPrincipal();
    boolean principal = Boolean.valueOf(token.getCredentials().toString());

    if (credentials != null && principal == true) {
        String name = credentials[0];
        if ("admin".equalsIgnoreCase(name)) {
            userDetails = getAdminUser(name);
        } else if ("händler".equalsIgnoreCase(name)) {
            userDetails = getRetailerUser(name);
        } else if ("user".equalsIgnoreCase(name)) {
            userDetails = getUserUser(name);
        }
    }

    if (userDetails == null) {
        throw new UsernameNotFoundException("Could not load user : "
                + token.getName());
    }

    return userDetails;
}

private UserDetails getAdminUser(String username) {
    Collection<GrantedAuthority> grantedAuthorities = new ArrayList<GrantedAuthority>();
    grantedAuthorities.add(new GrantedAuthorityImpl("ROLE_USER"));
    grantedAuthorities.add(new GrantedAuthorityImpl("ROLE_RETAILER"));
    grantedAuthorities.add(new GrantedAuthorityImpl("ROLE_ADMIN"));
    return new User(username, "notused", true, true, true, true,
            grantedAuthorities);
}

private UserDetails getRetailerUser(String username) {
    Collection<GrantedAuthority> grantedAuthorities = new ArrayList<GrantedAuthority>();
    grantedAuthorities.add(new GrantedAuthorityImpl("ROLE_USER"));
    grantedAuthorities.add(new GrantedAuthorityImpl("ROLE_RETAILER"));
    return new User(username, "notused", true, true, true, true,
            grantedAuthorities);
}

private UserDetails getUserUser(String username) {
    Collection<GrantedAuthority> grantedAuthorities = new ArrayList<GrantedAuthority>();
    grantedAuthorities.add(new GrantedAuthorityImpl("ROLE_USER"));
    return new User(username, "notused", true, true, true, true,
            grantedAuthorities);
}

}

这篇关于preAuthentication使用Spring Security - ＆GT;基于URL参数的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！