Question

我正在开发一个spring boot 2应用程序。我正在尝试为此实现spring安全性。为此我使用了一个自定义的AutenticationProvider。但是它没有被调用。但是Spring身份验证正在工作。请帮助我解决此问题。我尝试了很多方法，但是没有用。我正在使用jwt创建令牌。

WebSecurityConfigurerAdapter实现类

@Configuration
    @EnableGlobalMethodSecurity(prePostEnabled = true)
@ComponentScan
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
@Autowired
private JwtAuthenticationEntryPoint unauthorizedHandler;
@Autowired
private SecurmailSecurityProvider provider;
@Override
protected void configure(AuthenticationManagerBuilder authentication) throws Exception {
    authentication.authenticationProvider( getKBServicesAuthenticationProvider());
}
@Bean
protected AuthenticationProvider getKBServicesAuthenticationProvider() {
    return new SecurmailSecurityProvider();
}
@Bean
public JwtAuthenticationFilter authenticationTokenFilterBean() throws Exception {
    return new JwtAuthenticationFilter();
}
@Override
protected void configure(HttpSecurity http) throws Exception {
    http.cors().and().csrf().disable().
    authenticationProvider(provider).
    authorizeRequests()
    .antMatchers(MessageController.URL_AUTHENTICATE).permitAll()
    .anyRequest().authenticated()
    .and()
    .exceptionHandling().authenticationEntryPoint(unauthorizedHandler).and()
    .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
    http
    .addFilterBefore(authenticationTokenFilterBean(), SecurityContextHolderAwareRequestFilter.class);
    http.headers().frameOptions().disable();
}

自定义身份验证提供程序类

    @Component
@Primary
public class SecurmailSecurityProvider implements AuthenticationProvider {

@Autowired
MessageClientRepository clientRepo;

@Override
public Authentication authenticate(Authentication authentication) throws AuthenticationException {

    if (authentication.isAuthenticated()) return authentication;

    SmAuthenticationToken token = (SmAuthenticationToken) authentication;

    if (token.getGuid() != null && !token.getGuid().trim().isEmpty()) {
        MessageClient client = clientRepo.findByGuid(token.getGuid());
        if (client != null) {               
            return new SmAuthenticationToken(client);
    }


}
    return null;
}
@Override
public boolean supports(Class<?> authentication) {
    return (SmAuthenticationToken.class.isAssignableFrom(authentication));

}

Answer 1

您已经使用

自动连接了CustomAuthentication提供程序

@Autowired
private SecurmailSecurityProvider provider;

再次创建bean并传递该CustomAuthentication提供程序

@Bean
protected AuthenticationProvider getKBServicesAuthenticationProvider() {
    return new SecurmailSecurityProvider();
}

代替下面的代码

@Autowired
private SecurmailSecurityProvider provider;
@Override
protected void configure(AuthenticationManagerBuilder authentication) throws Exception {
    authentication.authenticationProvider( getKBServicesAuthenticationProvider());
}
@Bean
protected AuthenticationProvider getKBServicesAuthenticationProvider() {
    return new SecurmailSecurityProvider();
}

使用此代码

@Autowired
private SecurmailSecurityProvider provider;

@Override
protected void configure(AuthenticationManagerBuilder authentication) throws Exception {
    authentication.authenticationProvider(provider);
}

自定义身份验证提供程序的实现也应如下所示：

@Component
public class SecurmailSecurityProvider implements AuthenticationProvider {

    @Override
    public Authentication authenticate(Authentication authentication) 
      throws AuthenticationException {

        String name = authentication.getName();
        String password = authentication.getCredentials().toString();

        if (shouldAuthenticateAgainstThirdPartySystem()) {

            // use the credentials
            // and authenticate against the third-party system
            return new UsernamePasswordAuthenticationToken(
              name, password, new ArrayList<>());
        } else {
            return null;
        }
    }

    @Override
    public boolean supports(Class<?> authentication) {
        return authentication.equals(UsernamePasswordAuthenticationToken.class);
    }
}

自定义AuthenticationProvider没有被调用

1 个答案: