spring - Camel REST 和 Spring Security Java 配置

Question

我正在尝试设置 Camel REST 以使用来自我的 application.properties 的简单用户名/密码的基本身份验证，但似乎我一生都无法配置 Camel Spring Security 来做到这一点。我正在尝试关注 the Spring Security component documentation这似乎缺少配置所需 bean 的示例。我找到了缺失的例子 here在“控制对 Camel 路线的访问”下，但这仅显示了 xml 配置。

我如何设置所需的SpringSecurityAuthorizationPolicy bean 角，扁 bean ？它需要一个 AuthenticationManager和一个 AccessDecisionManager它似乎还要求我设置它的 SpringSecurityAccessPolicy我不知道该怎么做。

我还没有测试这些，因为我无法设置我的 bean ，但我的休息路线看起来像:

rest("/ingest")
            .post("/json").consumes("application/json")
            .route()
            .process(authProcessor)
            .policy(authPolicy) // this is the bean I don't know how to configure
            .to("direct:ingest")
            .endRest();

我的 AuthProcessor(取自 Camel 组件文档)如下所示:

@Component
public class AuthProcessor implements Processor {

    public void process(Exchange exchange) {
        String userpass = new String(Base64.decodeBase64(exchange.getIn().getHeader("Authorization", String.class)));
        String[] tokens = userpass.split(":");

        // create an Authentication object
        UsernamePasswordAuthenticationToken authToken = new UsernamePasswordAuthenticationToken(tokens[0], tokens[1]);

        // wrap it in a Subject
        Subject subject = new Subject();
        subject.getPrincipals().add(authToken);

        // place the Subject in the In message
        exchange.getIn().setHeader(Exchange.AUTHENTICATION, subject);
    }
}

这是我损坏的 bean 配置的值(value):

@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {

@Bean
public SpringSecurityAuthorizationPolicy springSecurityAuthorizationPolicy(
        AuthenticationManager authenticationManager, AccessDecisionManager accessDecisionManager) {
    SpringSecurityAuthorizationPolicy policy = new SpringSecurityAuthorizationPolicy();

    SpringSecurityAccessPolicy springSecurityAccessPolicy = new SpringSecurityAccessPolicy();

    policy.setAuthenticationManager(authenticationManager);
    policy.setAccessDecisionManager(accessDecisionManager);
    policy.setSpringSecurityAccessPolicy(????);

    return policy;
}

@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
    auth.inMemoryAuthentication().withUser("user").password("pass").roles("USER");
}

@Bean(name = BeanIds.AUTHENTICATION_MANAGER)
@Override
public AuthenticationManager authenticationManagerBean() throws Exception {
    return super.authenticationManagerBean();
}

@Bean
public AccessDecisionManager accessDecisionManager() {
    AffirmativeBased affirmativeBased = new AffirmativeBased(ImmutableList.of(
            new RoleVoter()
    ));

    affirmativeBased.setAllowIfAllAbstainDecisions(true);

    return affirmativeBased;
}
}

我一直在用头撞墙试图理解这一点，所以如何做到这一点的例子会很棒。看起来我想要做的事情的 xml 配置(在第二个链接中)很简单，但我似乎无法在 Java 配置中复制它。

Answer 1

我知道这是一个古老的话题，但我遇到了类似的问题。我设法让它工作。不是通过覆盖 accessDecisionManager() WebSecurityConfigurerAdapter内的方法类，但通过在构建我的 SpringSecurityAuthorizationPolicy 时构建一个新实例:

@Bean
public Policy adminPolicy(AuthenticationManager authenticationManager) {
    RoleVoter roleVoter = new RoleVoter();
    SpringSecurityAuthorizationPolicy policy = new SpringSecurityAuthorizationPolicy();
    policy.setAuthenticationManager(authenticationManager);
    policy.setAccessDecisionManager(new UnanimousBased(List.of(roleVoter)));
    policy.setSpringSecurityAccessPolicy(new SpringSecurityAccessPolicy(roleVoter.getRolePrefix() + "<ROLE_NAME>");
    return policy;
}