java - 使用 Authenticationprovider 在 spring security 的登录页面中添加额外参数

Question

我想在我的登录页面中传递额外的参数。我的应用程序上下文看起来像这样。例如，我想在登录表单中添加 location 参数。

<context:annotation-config />
<context:component-scan base-package="com.myetest.app" />

<sec:http entry-point-ref="apiAuthenticationEntryPoint" create-session="always">
    <sec:form-login login-processing-url="/login" 
        username-parameter="username" 
        password-parameter="password" 
        authentication-failure-handler-ref="apiAuthenticationFailureHandler"
        authentication-success-handler-ref="apiLoginSuccessHandler" />
    <sec:logout logout-url="/logout" success-handler-ref="apiLogoutSuccessHandler"/>

    <sec:intercept-url pattern="/receipt/**" access="ROLE_ANONYMOUS"/>
    <sec:intercept-url pattern="/internal/**" access="ROLE_ANONYMOUS"/>
    <sec:intercept-url pattern="/system/**" access="ROLE_ANONYMOUS"/>
    <sec:intercept-url pattern="/**" access="ROLE_SELLER"/>

    <sec:custom-filter ref="apiPreAuthFilter" before="PRE_AUTH_FILTER"/>
    <sec:custom-filter ref="apiFirstFilter" before="LAST"/>
</sec:http>

<sec:authentication-manager alias="authenticationManager">
    <sec:authentication-provider ref="apiAuthenticationProvider"/>
</sec:authentication-manager>

<bean id="apiAuthenticationProvider" class="com.myetest.app.security.ApiAuthenticationProvider" />
<bean id="apiAuthenticationEntryPoint" class="com.myetest.app.security.ApiAuthenticationEntryPoint"/>
<bean id="apiLoginSuccessHandler" class="com.myetest.app.security.ApiLoginSuccessHandler"/>
<bean id="apiLogoutSuccessHandler" class="com.myetest.app.security.ApiLogoutSuccessHandler"/>
<bean id="apiAuthenticationFailureHandler" class="com.myetest.app.security.ApiAuthenticationFailureHandler"/>
<bean id="apiPreAuthFilter" class="com.myetest.app.security.ApiPreAuthenticationFilter" />

<bean id="apiFirstFilter" class="com.myetest.app.security.ApiFirstFilter"/> 

我的AuthenticationProvider是这样的

public class ApiAuthenticationProvider implements AuthenticationProvider {

}

Answer 1

你看过possible solution (section 1)了吗？还有一些explanation .解决方案基于 UsernamePasswordAuthenticationFilter用法。简而言之，您可以覆盖 UsernamePasswordAuthenticationFilter，您可以从 UsernamePasswordAuthenticationFilter.attemptAuthentication 中的 HttpServletRequest 主体中提取 location 并执行一些您的操作定制的东西。或者您可以添加自定义 MVC Controller ，它将接受您的表单数据并使用您的自定义 AuthenticationProvider 手动调用那里的 AuthenticationManager。希望这会有所帮助。