Question

我需要在Spring安全认证过程中传递额外的参数以及用户名和密码。阅读了多个线程之后，我在Spring安全链中添加了自定义身份验证过滤器

下面是我的文件

过滤器类

public class AuthenticationFilter extends UsernamePasswordAuthenticationFilter {


    public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException {
        String role = request.getParameter("role");

        request.getSession().setAttribute("role", role);

        return super.attemptAuthentication(request, response); 


    }

SecurityConfig类

public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    RestAuthenticationSuccessHandler customizeAuthenticationSuccessHandler;

    @Autowired
    RestAuthenticationFailureHandler restAuthenticationFailureHandler;

    @Autowired
    UserDetailsService userDetailsService;

    @Autowired
    PasswordEncoder passwordEncoder;

    @Autowired
    private RestAuthenticationEntryPoint restAuthenticationEntryPoint;

    @Autowired
    private AccessDeniedHandler restAccessDeniedHandler;

    protected void configure(HttpSecurity http) throws Exception {

        http
        .addFilterBefore(authenticationFilter(), UsernamePasswordAuthenticationFilter.class)
        .authorizeRequests().antMatchers("/api/common/**").permitAll()
        .antMatchers("/api/student/**").access("hasRole('ROLE_STUDENT')")
        .antMatchers("/api/staff/**").access("hasRole('ROLE_STAFF')").antMatchers("/sysAdmin/**").access("hasRole('ROLE_ADMIN')").and().formLogin()
        .loginProcessingUrl("/api/common/login")
        .successHandler(customizeAuthenticationSuccessHandler)
        .failureHandler(restAuthenticationFailureHandler)
        .usernameParameter("userName")
        .passwordParameter("password")
        .and().exceptionHandling().authenticationEntryPoint(restAuthenticationEntryPoint).accessDeniedHandler(restAccessDeniedHandler)
        .and().csrf().disable();
    }

    @Bean
    public UsernamePasswordAuthenticationFilter authenticationFilter() throws Exception {
        AuthenticationFilter authFilter = new AuthenticationFilter();
        authFilter.setUsernameParameter("username");
        authFilter.setPasswordParameter("password");
        authFilter.setAuthenticationManager(authenticationManagerBean());
        return authFilter;
    }

    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        auth.authenticationProvider(authProvider());
    }

    public AuthenticationProvider authProvider() {
        DaoAuthenticationProvider provider = new DaoAuthenticationProvider();
        provider.setUserDetailsService(userDetailsService);
        provider.setPasswordEncoder(passwordEncoder);
        return provider;
    }

}

问题：

当我尝试对用户的尝试进行身份验证时，自定义过滤器类的身份验证方法没有被调用，而是直接转到UserDetails服务类

Answer 1

已将FilterProcessingUrl添加到authenticateFilter对象中，从而解决了该问题。更新了authenticationFilter（）方法：

 @Bean
    public AuthenticationFilter authenticationFilter() throws Exception {
        AuthenticationFilter authFilter = new AuthenticationFilter();

        authFilter.setUsernameParameter("userName");
        authFilter.setPasswordParameter("password");
        authFilter.setFilterProcessesUrl("/api/common/login");
        authFilter.setAuthenticationSuccessHandler(customizeAuthenticationSuccessHandler);
        authFilter.setAuthenticationFailureHandler(restAuthenticationFailureHandler);

        authFilter.setAuthenticationManager(authenticationManagerBean());
        return authFilter;
    }

在Spring Security中未调用authenticationFilter

1 个答案: