java - 将属性传递给 Spring Security 应用程序中的 View

Question

在我的 Spring 应用程序中，登录过程由 Spring Security 使用 UserDetailsS​​ervice 和 BCryptPassword 类来处理。当登录成功后，该类将使用重定向到主页面:

public class CustomAuthenticationSuccessHandler implements AuthenticationSuccessHandler {

    @Override
    public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication auth) throws IOException, ServletException {
        HttpSession session = request.getSession();
        SavedRequest savedReq = (SavedRequest) session.getAttribute(WebAttributes.ACCESS_DENIED_403);

        if (savedReq == null) {
            response.sendRedirect(request.getContextPath() + "/acesso/home");
        }
        else {
            response.sendRedirect(request.getContextPath() + "/acesso/login?erro=no_permit");
        }
    }

}

在jsp页面中，我可以使用以下表达式获取用户名:

${pageContext.request.remoteUser}

但是，在我的数据库中，我还存储了名字和姓氏。我需要在上面的类中(或在任何可能的地方)将此数据传递到我的 View 。我试试这个:

request.getSession().setAttribute("username", "Usuario Teste");

在 View 中使用它:${username}，但是当我运行该应用程序时，没有显示任何内容。

任何人都可以给我指出一种方法吗？

我的 Spring 安全配置

protected void configure(HttpSecurity http) throws Exception {
    http
        .csrf()
            .disable()
        .authorizeRequests()
            .antMatchers("/resources/**", "/publico/**").permitAll()
            .anyRequest().authenticated()
            .and()
        .formLogin()
            .loginPage("/acesso/login").permitAll()
            .loginProcessingUrl("/login").permitAll()
            .usernameParameter("login")
            .passwordParameter("senha")
            .successHandler(new CustomAuthenticationSuccessHandler())
            .failureHandler(new CustomAuthenticationFailureHandler())
            .and()
        .exceptionHandling()
            .accessDeniedHandler(new CustomAccessDeniedHandler())
            .and()
        .logout()
            .logoutUrl("/logout")
            .logoutSuccessUrl("/acesso/login").permitAll();
}

更新

身份验证提供程序

public class CustomAuthenticationProvider implements AuthenticationProvider {

    @Autowired
    private UserDetailsService usuario;

    @Autowired
    private BCryptPasswordEncoder encoder;

    @Override
    public Authentication authenticate(Authentication authentication) throws AuthenticationException {
        String name = authentication.getName();
        String password = authentication.getCredentials().toString();

        UserDetails user = usuario.loadUserByUsername(name);

        if(encoder.matches(user.getPassword(), password)) {
            Authentication auth = new UsernamePasswordAuthenticationToken(user.getUsername(), user.getPassword(), user.getAuthorities());
            return auth;
        }
        else {
            return null;
        }
    }

    @Override
    public boolean supports(Class<?> authentication) {
        return authentication.equals(UsernamePasswordAuthenticationToken.class);
    }

}

用户详细信息服务

@Service
public class AcessoService implements UserDetailsService {

    @Autowired
    private UsuarioHome accountDao;

    @Override
    @Transactional(readOnly = true, propagation = Propagation.SUPPORTS)
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        Usuario account = accountDao.findByField("login", username);

        if(account==null) {
            System.out.println("No such user: " + username);
            throw new UsernameNotFoundException("No such user: " + username);
        } else if (account.getAutorizacao().isEmpty()) {
            System.out.println("User " + username + " has no authorities");
            throw new UsernameNotFoundException("User " + username + " has no authorities");
        }

        List<Permissao> lista = new ArrayList<Permissao>();
        int max = account.getAutorizacao().size();
        for(int i=0; i<max; i++) {
            int max2 = account.getAutorizacao().get(i).getPermissao().size();
            for(int j=0; j<max2; j++) {
                lista.add(account.getAutorizacao().get(i).getPermissao().get(j));
            }
        }

        boolean accountIsEnabled = true;
        boolean accountNonExpired = true;
        boolean credentialsNonExpired = true;
        boolean accountNonLocked = true;

        return new User(account.getLogin(), account.getSenha(), accountIsEnabled, accountNonExpired, credentialsNonExpired, accountNonLocked, getAuthorities(lista));
    }

    public List<String> getRolesAsList(List<Permissao> list) {
        List <String> rolesAsList = new ArrayList<String>();
        for(Permissao role : list){
            rolesAsList.add(role.getNome());
        }
        return rolesAsList;
    }

    public static List<GrantedAuthority> getGrantedAuthorities(List<String> roles) {
        List<GrantedAuthority> authorities = new ArrayList<GrantedAuthority>();
        for (String role : roles) {
            authorities.add(new SimpleGrantedAuthority(role));
        }
        return authorities;
    }

    public Collection<? extends GrantedAuthority> getAuthorities(List<Permissao> list) {
        List<GrantedAuthority> authList = getGrantedAuthorities(getRolesAsList(list));
        return authList;
    }

}

Answer 1

您正在 session 中存储您的“用户名”数据。

您可以尝试通过这两种方式之一来获取它。

request.setAttribute("username", "Usuario Teste");然后就可以直接使用${username} EL了。或者您可以使用 request.getSession().setAttribute("username", "Usuario Teste");与 ${sessionScope.username} EL。

您必须了解 session 范围和请求范围之间的区别。

PD:阅读 this .

另一方面，要获取 Spring Sec 中的用户名，您可以尝试使用 <sec:authentication property="principal.username" />

而且，如果您想使用比一个字符串更复杂的对象作为主体，您可以扩展 UsernamePasswordAuthenticationToken。