spring boot tomcat J2EE预认证认证

Question

我无法获得 tomcat配置对。

我想在 Tomcat 上部署一个简单的 Spring Boot 应用程序与 j2eePreAuth为 Tomcat进行认证。

我读了一些关于 web.xml 的信息来配置它。他们提到将安全配置放入 web.xml除了 Spring 类(class)。但这并没有改变任何东西。

我也尝试更改 web.xml的 Tomcat本身没有成功。

所以我的问题是:我必须在 Tomcat 上配置什么？做对了吗？

这是我的安全:

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    private static String ROLE_PREFIX = "ROLE_";

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
            // Alle weiteren Pfadsegmente sind für User authentifiziert erreichbar
                .anyRequest().authenticated()
                .and()
            .jee()
            // Registrierung eines eigenen Jee PreAuthenticatedProcessingFilter
                .j2eePreAuthenticatedProcessingFilter(j2eePreAuthenticatedProcessingFilter());
    }

    @Bean
    @Override
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }

    /**
     * Um auf die web.xml zu verzichten muss ein ganzer J2eePreAuthenticatedProcessingFilter definiert werden. 
     */
    @Bean
    public J2eePreAuthenticatedProcessingFilter j2eePreAuthenticatedProcessingFilter() throws Exception {
        J2eePreAuthenticatedProcessingFilter j2eePreAuthenticatedProcessingFilter = new J2eePreAuthenticatedProcessingFilter();
        j2eePreAuthenticatedProcessingFilter.setAuthenticationManager(authenticationManagerBean());

        J2eeBasedPreAuthenticatedWebAuthenticationDetailsSource j2eeBasedPreAuthenticatedWebAuthenticationDetailsSource = new J2eeBasedPreAuthenticatedWebAuthenticationDetailsSource();
        j2eeBasedPreAuthenticatedWebAuthenticationDetailsSource.setMappableRolesRetriever(simpleMappableAttributesRetriever());

        SimpleAttributes2GrantedAuthoritiesMapper simpleAttributes2GrantedAuthoritiesMapper = new SimpleAttributes2GrantedAuthoritiesMapper();
        simpleAttributes2GrantedAuthoritiesMapper.setConvertAttributeToUpperCase(true);
        j2eeBasedPreAuthenticatedWebAuthenticationDetailsSource.setUserRoles2GrantedAuthoritiesMapper(simpleAttributes2GrantedAuthoritiesMapper);

        j2eePreAuthenticatedProcessingFilter.setAuthenticationDetailsSource(j2eeBasedPreAuthenticatedWebAuthenticationDetailsSource);
        return j2eePreAuthenticatedProcessingFilter;
    }

    /**
     * Dieser MappableAttributesRetriever liefert eine eigene Liste von JEE Rollen statt der aus einer web.xml.
     */
    @Bean
    public MappableAttributesRetriever simpleMappableAttributesRetriever() {
        SimpleMappableAttributesRetriever simpleMappableAttributesRetriever = new SimpleMappableAttributesRetriever();
        Set<String> roles = new HashSet<String>();
        // Hier müssen die Rollen angegeben werden!
        roles.add(ROLE_PREFIX + "INTERNAL");
        roles.add(ROLE_PREFIX + "MANAGEMENT");
        roles.add(ROLE_PREFIX + "USER");
        simpleMappableAttributesRetriever.setMappableAttributes(roles);
        return simpleMappableAttributesRetriever;
    }

}

还有一个简单的 RESt Controller :

@RestController
@RequestMapping(value = "/a")
@PreAuthorize("hasAuthority('ROLE_USER')")
public class Controller {

    @RequestMapping("")
    public String index(Principal p) {
        return "logged in as: " + p.getName();
    }

}

Answer 1

我让它工作!

我在 Tomcat 中添加了以下内容s conf/web.xml

<security-constraint>
    <web-resource-collection>
        <web-resource-name>Basic Authentication</web-resource-name>
<!--Here wildcard entry defines authentication is needed for whole app -->
            <url-pattern>/*</url-pattern>
        <http-method>GET</http-method>
        <http-method>POST</http-method>
    </web-resource-collection>
    <auth-constraint>
        <role-name>ROLE_USER</role-name>
    </auth-constraint>
</security-constraint>

<login-config>
    <auth-method>BASIC</auth-method>
</login-config>

<security-role>
    <description>Any User</description>
    <role-name>ROLE_USER</role-name>
</security-role>