Spring 4.0 + Security 3.2 + j_spring_security_check的JavaConfiguration

Question

Spring 4.0 + Security 3.2 + j_spring_security_check的JavaConfiguration

zeh*_*zeh 10 spring spring-mvc spring-security spring-java-config

创建登录页面

<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" %>
<!DOCTYPE html>
<html>
    <head>
        <meta charset="ISO-8859-1">
        <title>Test</title>
        <script src="static/js/jquery-1.10.2.min.js"></script>
        <script src="static/js/app-controller.js"></script>
    </head>
    <body>
        <div>Login</div>
        <form name="f" action="<c:url value="/j_spring_security_check"/>" method="POST">
            <label for="password">Username</label>&nbsp;<input type="text" id="j_username" name="j_username"><br/>
            <label for="password">Password</label>&nbsp;<input type="password" id="j_password" name="j_password"><br/>
            <input type="submit" value="Validate">&nbsp;<input name="reset" type="reset">
            <input type="hidden" id="${_csrf.parameterName}" name="${_csrf.parameterName}" value="${_csrf.token}"/>
        </form>
        <hr/>
        <c:if test="${param.error != null}">
            <div>
                Failed to login.
                <c:if test="${SPRING_SECURITY_LAST_EXCEPTION != null}">
                  Reason: <c:out value="${SPRING_SECURITY_LAST_EXCEPTION.message}" />
                </c:if>
            </div>
        </c:if>
        <hr/>
        <input type="button" value="Echo" id="echo" name="echo" onclick="AppController.echo();">
        <div id="echoContainer"></div>

    </body>
</html>

Run Code Online (Sandbox Code Playgroud)

在这里声明一个WebSecurityConfigurer 我错过了j_username和j_password

@Configuration
@EnableWebSecurity
@ComponentScan(basePackages = {"com.sample.init.security"})
public class WebSecurityConfigurer extends WebSecurityConfigurerAdapter {

    @Inject
    private AuthenticationProvider authenticationProvider;

    @Inject
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        auth.authenticationProvider(authenticationProvider);
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .authorizeRequests()
                .antMatchers(
                        "/resources/**", 
                        "/static/**", 
                        "/j_spring_security_check", 
                        "/AppController/echo.html").permitAll()
                .anyRequest().authenticated()
                .and()
            .formLogin()
                .usernameParameter("j_username") /* BY DEFAULT IS username!!! */
                .passwordParameter("j_password") /* BY DEFAULT IS password!!! */
                .loginProcessingUrl("/j_spring_security_check")
                .loginPage("/")
                .defaultSuccessUrl("/page")
                .permitAll()
                .and()
            .logout()
                .permitAll();
    }

    @Override
    public void configure(WebSecurity web) throws Exception {
        web
            .ignoring()
                .antMatchers("/static/**");
    }

}

Run Code Online (Sandbox Code Playgroud)

声明WebMvcConfigurer

@EnableWebMvc
@Configuration
@ComponentScan(basePackages = {
        "com.app.controller",        
        "com.app.service",
        "com.app.dao"
})
public class WebMvcConfigurer extends WebMvcConfigurerAdapter {

    @Bean
    public ViewResolver viewResolver() {
        InternalResourceViewResolver viewResolver = new InternalResourceViewResolver();
        viewResolver.setPrefix("/WEB-INF/view/");
        viewResolver.setSuffix(".jsp");
        return viewResolver;
    }

    @Override
    public void addViewControllers(ViewControllerRegistry registry) {
      registry.addViewController("/page").setViewName("page");
    }

    @Override
    public void addResourceHandlers(ResourceHandlerRegistry registry) {
        registry.addResourceHandler("static/**").addResourceLocations("static/");
    }

}

Run Code Online (Sandbox Code Playgroud)

声明安全性初始化程序

public class SecurityWebAppInitializer 
    extends AbstractSecurityWebApplicationInitializer { }

Run Code Online (Sandbox Code Playgroud)

声明App Initialzer

public class Initializer extends AbstractAnnotationConfigDispatcherServletInitializer  {

    @Override
    protected Class<?>[] getRootConfigClasses() {       
        return new Class<?>[]{WebSecurityConfigurer.class};
    }

    @Override
    protected Class<?>[] getServletConfigClasses() {
        return new Class<?>[]{WebMvcConfigurer.class, DataSourceConfigurer.class};
    }

    @Override
    protected String[] getServletMappings() {
        return new String[]{"/"};
    }

}

Run Code Online (Sandbox Code Playgroud)

实现自定义身份验证提供程

@Component
@ComponentScan(basePackages = {"com.app.service"})
public class CustomAuthenticationProvider implements AuthenticationProvider {

    private static final Logger LOG = LoggerFactory.getLogger(CustomAuthenticationProvider.class);

    @Inject
    private AppService service;

    @Override
    public Authentication authenticate(Authentication authentication) throws AuthenticationException {

        //Thread.dumpStack();
        String username = authentication.getName();
        String password = authentication.getCredentials().toString();

        String message = String.format("Username: '%s' Password: '%s'", username, password);
        UserBean userBean = service.validate(username, password);       
        LOG.debug(message);
        if (userBean != null) {
            List<GrantedAuthority> grantedAuths = new ArrayList<>();
            grantedAuths.add(new SimpleGrantedAuthority("USER"));
            return new UsernamePasswordAuthenticationToken(userBean, authentication, grantedAuths); 
        } else {
            String error = String.format("Invalid credentials [%s]", message);
            throw new BadCredentialsException(error);
        }
    }

    @Override
    public boolean supports(Class<?> authentication) {
        return authentication.equals(UsernamePasswordAuthenticationToken.class);
    }

}

Run Code Online (Sandbox Code Playgroud)

我正在跳过EchoController,AppService,AppDao和UserBean.

谢谢.

Answer 1

pas*_*mes 20

在3.2版本中,post参数已从j_username更改为username,j_password更改为password.登录URL也已从/ j_spring_security_check更改为/ login.

请参阅此链接以获取有关实施此更改的原因的说明:http://docs.spring.io/spring-security/site/docs/3.2.0.RELEASE/reference/htmlsingle/#jc-httpsecurity.这些是变化:

GET/login呈现登录页面而不是/ spring_security_login
POST/login对用户进行身份验证,而不是/ j_spring_security_check
username参数默认为username而不是j_username
password参数默认为password而不是j_password

这是一个登录表单的示例:http: //docs.spring.io/spring-security/site/docs/3.2.0.RELEASE/reference/htmlsingle/#jc-form

归档时间：	12 年，2 月前
查看次数：	13822 次
最近记录：	9 年，7 月前