spring-boot在单个Web应用程序路径上设置基本身份验证？

Question

我试图在我的spring-boot spring基于MVC的应用程序中设置单个路径(/ basic)以进行基本的auth保护.我只是使用我自己的自定义配置参数来配置它,因此用户名和密码只是"admin"和"admin".

这当前适用于/ basic路径(我被提示并且可以正确登录).问题是,注销不工作(和我不知道为什么)和(如/其他所示)被要求为基本身份验证凭据还有其他路径(之前总是被拒绝).

static class MyApplicationSecurity extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests().antMatchers("/open").permitAll();
        http.authorizeRequests().antMatchers("/other").denyAll(); // Block it for now
         http.authorizeRequests().antMatchers("/basic").authenticated().and().httpBasic().and().logout().logoutUrl("/basic/logout").invalidateHttpSession(true).logoutSuccessUrl("/");
    }
}

我期望/其他人总是被拒绝,但我不明白为什么基本的auth即将到来./ open按预期工作.我也不明白为什么/ basic/logout不会让我退出(它也不会产生错误信息).我有一个简单的代码作为注销端点的占位符,但如果我没有,那么我得到404."主页"视图是我的web应用程序根,所以我只想在注销后将用户发送到那里.

@RequestMapping("/logout")
public ModelAndView logout() {
    // should be handled by spring security
    return new ModelAndView("home");
}

更新:这是最终似乎工作的解决方案(注销部分除外,仍然无法正常工作):

@Configuration
@Order(1) // HIGHEST
public static class OAuthSecurityConfigurerAdapter extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.antMatcher("/oauth").authorizeRequests().anyRequest().denyAll();
    }
}

@Configuration
public static class BasicAuthConfigurationAdapter extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.antMatcher("/basic").authorizeRequests().anyRequest().authenticated().and().httpBasic();
        http.logout().permitAll().logoutUrl("/logout").logoutSuccessUrl("/").invalidateHttpSession(true);
        //.and().logout().logoutUrl("/basic/logout").invalidateHttpSession(true).logoutSuccessUrl("/");
    }
}

Answer 1

我不确定退出,但我们有一些类似的问题,我们的一些网站是基本的,有些不是.我们的解决方案是仅为需要http basic的路径使用第二个嵌套配置类.我们给这个配置一个@Order(1)..但我不确定是否有必要.

更新了代码

@Configuration
@EnableWebMvcSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class SecurityConfig {
    private static final Logger LOG = LoggerFactory.getLogger(SecurityConfig.class);

    @Autowired
    public void registerAuthentication(AuthenticationManagerBuilder auth, Config appConfig) throws Exception {
        auth.inMemoryAuthentication()
            .withUser(appConfig.getString(APIConfig.CONFIG_KEY_MANAGEMENT_USER_NAME))
            .password(appConfig.getString(APIConfig.CONFIG_KEY_MANAGEMENT_USER_PASS))
            .roles(HyperAPIRoles.DEFAULT, HyperAPIRoles.ADMIN);        
    }



    /**
     * Following Multiple HttpSecurity approach:
     * http://docs.spring.io/spring-security/site/docs/3.2.x/reference/htmlsingle/#multiple-httpsecurity 
     */
    @Configuration
    @Order(1)
    public static class ManagerEndpointsSecurityConfig extends WebSecurityConfigurerAdapter {

        @Override
        protected void configure(HttpSecurity http) throws Exception {
            http
            .antMatcher("/management/**").authorizeRequests().anyRequest().hasRole(HyperAPIRoles.ADMIN).and()
            .httpBasic();
        }
    }

    /**
     * Following Multiple HttpSecurity approach:
     * http://docs.spring.io/spring-security/site/docs/3.2.x/reference/htmlsingle/#multiple-httpsecurity 
     */
    @Configuration
    public static class ResourceEndpointsSecurityConfig extends WebSecurityConfigurerAdapter {        



       @Override
       protected void configure(HttpSecurity http) throws Exception {                  

            http
            //fyi: This adds it to the spring security proxy filter chain
            .addFilterBefore(createBBAuthenticationFilter(), BasicAuthenticationFilter.class)
            ;      
       }
    }
}

这似乎使用基本身份验证将执行器端点保护在/ management,而其他人使用自定义身份验证令牌头.我们不提示凭证(没有发出挑战),但是对于任何事情......我们必须注册其他一些东西来实现这一目标(如果我们想要的话).

希望这可以帮助