spring - Grails “remember me”无法正常工作

Question

我正在使用Grails Spring Security Plugin 2.0 RC2。

当我通过在登录表单中添加复选框来启用(开箱即用的特权)功能时。

cookie的创建正确(提前2周)，但是“记住我”机制在两种情况下不起作用:

当我关闭浏览器时，“记住我” cookie消失了。为什么？

删除JSESSIONID cookie时，不会重新生成 session 。

另外:我不想使用持久性记住我，要求将 token 存储在db中。我想依靠基于cookie的“记住我”策略。

Answer 1

这整天困扰着我，但是我使用的是Spring Security Plugin 1.2.7.3。

对我来说，配置中缺少身份验证提供程序。例如:

grails.plugins.springsecurity.providerNames = [
      'rememberMeAuthenticationProvider',
      'daoAuthenticationProvider',
      'ldapAuthProvider',
      'anonymousAuthenticationProvider']

“rememberMeAuthenticationProvider”是缺少的链接。我在设置日志级别以跟踪与我所做的事情有关的所有事情时发现了这一点:

trace 'org.springframework.security.web.authentication.rememberme',
      'org.springframework.security.web.authentication',
      'org.springframework.security.web',
      'org.springframework.security'

我在输出中看到了这一点(请注意粗体):

2014-01-21 13:10:59,490 [http-bio-8080-exec-3] DEBUG rememberme.TokenBasedRememberMeServices - Remember-me cookie detected

2014-01-21 13:10:59,545 [http-bio-8080-exec-3] DEBUG rememberme.TokenBasedRememberMeServices - Remember-me cookie accepted

2014-01-21 13:10:59,582 [http-bio-8080-exec-3] DEBUG rememberme.RememberMeAuthenticationFilter - SecurityContextHolder not populated with remember-me token, as AuthenticationManager rejected Authentication returned by RememberMeServices: 'org.springframework.security.authentication.RememberMeAuthenticationToken@7651888e: Principal: org.codehaus.groovy.grails.plugins.springsecurity.GrailsUser@d008d6e3: invalidating remember-me token

Message: No AuthenticationProvider found for org.springframework.security.authentication.RememberMeAuthenticationToken

2014-01-21 13:10:59,638 [http-bio-8080-exec-3] DEBUG rememberme.TokenBasedRememberMeServices - Interactive login attempt was unsuccessful.

2014-01-21 13:10:59,638 [http-bio-8080-exec-3] DEBUG rememberme.TokenBasedRememberMeServices - Cancelling cookie

为了方便起见，删除JSESSIONID cookie与关闭浏览器基本相同: http://muras.eu/index.html%3Fp=673.html

希望有帮助!