java - 如何使用 Java 配置表示 Spring Security "custom-filter"？

Question

Spring Security 的等效 Java 配置是什么 <custom-filter>标记？

<http>
  <custom-filter position="FORM_LOGIN_FILTER" ref="myFilter"/>
</http>

我试过了

http.addFilter( new MyUsernamePasswordAuthenticationFilter() )

类扩展了默认过滤器，但它总是使用 formLogin默认。

我的过滤器:

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.springframework.security.authentication.AuthenticationServiceException;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.Authentication; 
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;

public class MyUsernamePasswordAuthenticationFilter extends UsernamePasswordAuthenticationFilter{

    // proof of concept of how the http.addFilter() works

    @Override
    public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response)
            throws AuthenticationException {
        if (!request.getMethod().equals("POST")) {
            throw new AuthenticationServiceException("Authentication method not supported: " + request.getMethod());
        }

        System.out.println("running my own version of UsernmePasswordFilter ... ");

        String username = obtainUsername(request);
        String password = obtainPassword(request);

        if (username == null) {
            username = "";
        }

        if (password == null) {
            password = "";
        }

        username = username.trim();

        UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(username, password);

        // Allow subclasses to set the "details" property
        setDetails(request, authRequest);

        return this.getAuthenticationManager().authenticate(authRequest);
    }
}

相关配置 block :

@Configuration
@EnableWebMvcSecurity  // annotate class configuring AuthenticationManagerBuilder
@ComponentScan("com.kayjed")
public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {

      http
        .authorizeRequests()
            .antMatchers("/resources/**","/signup").permitAll()
            .anyRequest().authenticated()
            .and()
        .formLogin()
            .loginPage("/login")
            .permitAll()
            .and()
        .logout()
            .permitAll();

      http.addFilter(new MyUsernamePasswordAuthenticationFilter());
    }

    ...
}

在调试器中运行 MVC 应用程序始终显示从默认 UsernamePasswordAuthenticationFilter 进行的登录尝试身份验证而不是我打算使用 MyUsernamePasswordAuthenticationFilter类。

无论如何，我并不是要找人调试代码；相反，我希望看到一个使用 Java 配置的好示例，该配置在 XML 方法中执行与自定义过滤器元素等效的操作。文档有点简洁。

Answer 1

您可能需要记住几个问题:

1. 您的过滤器需要在标准UsernamePasswordAuthenticationFilter

   之前添加

   
   http.addFilterBefore(customUsernamePasswordAuthenticationFilter(),
           UsernamePasswordAuthenticationFilter.class)
   

2. 如果你扩展 UsernamePasswordAuthenticationFilter 你的过滤器将立即返回而不做任何事情，除非你设置一个 RequestMatcher

   
   myAuthFilter.setRequiresAuthenticationRequestMatcher(
       new AntPathRequestMatcher("/login","POST"));
   

3. 您在 http.formLogin().x().y().z() 中所做的所有配置都适用于标准 UsernamePasswordAuthenticationFilter 而不是您构建的自定义过滤器。您需要自己手动配置它。我的身份验证过滤器初始化如下所示:

   
   @Bean
   public MyAuthenticationFilter authenticationFilter() {
       MyAuthenticationFilter authFilter = new MyAuthenticationFilter();
       authFilter.setRequiresAuthenticationRequestMatcher(new AntPathRequestMatcher("/login","POST"));
       authFilter.setAuthenticationManager(authenticationManager);
       authFilter.setAuthenticationSuccessHandler(new MySuccessHandler("/app"));
       authFilter.setAuthenticationFailureHandler(new MyFailureHandler("/login?error=1"));
       authFilter.setUsernameParameter("username");
       authFilter.setPasswordParameter("password");
       return authFilter;
   }