AuthenticationEntryPoint 仅有时被称为

Question

我有一个简单的方法AuthenticationEntryPoint，它应该为未经授权的请求设置 WWW-Authenticate 标头。

@Component
public class CustomAuthenticationEntryPoint implements AuthenticationEntryPoint {

    @Override
    public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException authException)
            throws IOException, ServletException {
        response.setHeader("WWW-Authenticate", "FormBased");
        response.sendError(401, authException.getMessage());
    }
}

我在以下配置方法之一中使用它 AuthorizationServerConfigurer

@Override
public void configure(AuthorizationServerSecurityConfigurer authorizationServerSecurityConfigurer) throws Exception {
    authorizationServerSecurityConfigurer.authenticationEntryPoint(authenticationEntryPoint);
}

但是，并不总是调用此开始方法。当请求中没有 Authorize 标头或 Authorize 标头值不以“Basic”开头时，它会被调用。但是，如果 Authorize 标头以“Basic”开头，则不会调用开始方法（并且响应的值为Basic realm="oauth2/client"）。如何确保调用此方法？

Answer 1

正如AliDehghani指出，这是因为BasicAuthenticationFilter采用的是BasicApplicationEntryPoint不管的ApplicationEntryPoint中声明AuthorizationServerSecurityConfigurer。为了BasicAuthenticationFilter使用我的CustomApplicationEntryPoint我需要创建一个新的CustomBasicAuthenticationFilter并将@Autowire注释添加到构造函数中：

@Component
public class CustomBasicAuthenticationFilter extends BasicAuthenticationFilter {

    @Autowired
    public CustomBasicAuthenticationFilter(AuthenticationManager authenticationManager,
                                     AuthenticationEntryPoint authenticationEntryPoint) {
        super(authenticationManager, authenticationEntryPoint);
    }
}

然后将其添加到以下配置方法之一 AuthorizationServerConfigurer

@Override
public void configure(AuthorizationServerSecurityConfigurer authorizationServerSecurityConfigurer) throws Exception {
    authorizationServerSecurityConfigurer
            .authenticationEntryPoint(authenticationEntryPoint)
            .addTokenEndpointAuthenticationFilter(customBasicAuthenticationFilter);
}

现在该应用程序使用 my CustomBasicAuthenticationFilter- 在功能上等同于BasicAuthenticationFilter. 但是，它现在包括AuthenticationEntryPoint在构造过程中声明的bean - 这是我的CustomAuthenticationEntryPoint.