使用JavaConfig示例的Spring Security Digest Auth

Question

如何使用javaconfig(无XML)专门为摘要式身份验证配置Spring 4.0和Spring Security(3.2.0)？我正在使用下面的配置类,但所有请求都被HTTP 401拒绝,"Nonce应该产生两个令牌,但是(...消息就在那里停止)".

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class SecurityConfigurationDigest extends WebSecurityConfigurerAdapter
{
@Autowired
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception
{
    auth.inMemoryAuthentication().withUser("user").password("password").roles("USER");
}

@Override
protected void configure(HttpSecurity http) throws Exception
{
    http.authorizeRequests().antMatchers("/**").authenticated().and().addFilter(digestAuthenticationFilter(digestEntryPoint()));
}

@Override
@Bean
public UserDetailsService userDetailsServiceBean() throws Exception
{
    return super.userDetailsServiceBean();
}

public DigestAuthenticationFilter digestAuthenticationFilter(DigestAuthenticationEntryPoint digestAuthenticationEntryPoint) throws Exception
{
    DigestAuthenticationFilter digestAuthenticationFilter = new DigestAuthenticationFilter();
    digestAuthenticationFilter.setAuthenticationEntryPoint(digestEntryPoint());
    digestAuthenticationFilter.setUserDetailsService(userDetailsServiceBean());
    return digestAuthenticationFilter;
}

@Bean
public DigestAuthenticationEntryPoint digestEntryPoint()
{
    DigestAuthenticationEntryPoint digestAuthenticationEntryPoint = new DigestAuthenticationEntryPoint();
    digestAuthenticationEntryPoint.setKey("mykey");
    digestAuthenticationEntryPoint.setRealmName("myrealm");
    return digestAuthenticationEntryPoint;
}
}

我试图通过包含标题在客户端授权:

授权:Digest username ="user",realm ="myrealm",nonce ="",uri ="/ service？param = 98",response ="fcd46faf42a583499d4e7f0371171ef2",opaque =""

如果我将此类恢复为基于HttpBasic的配置,我可以访问预期的服务.我的配置或我的请求有问题吗？上面的大部分代码都是从另一篇文章中借来的,但是我无法在这种情况下使用.所有这些都在Spring Boot 0.5.0M7中运行.

谢谢.

Answer 1

该请求似乎不完整。noonce 参数应包含根据摘要处理过滤器参考的 Base64 编码值。

\n\n

\n

摘要式身份验证的核心是“随机数”。这是服务器生成的值。Spring Security\xe2\x80\x99s nonce 采用以下格式：

\n

\n\n

base64(expirationTime + ":" + md5Hex(expirationTime + ":" + key))\nexpirationTime:   The date and time when the nonce expires, expressed in milliseconds\nkey:              A private key to prevent modification of the nonce token\n

\n