从spring-security检索当前用户的密码

Question

我正在使用带有HTTP Basic Auth的spring-security来保护java webapp.在我的webapp中,我需要获取当前用户的用户名和密码,以进一步针对其他服务进行身份验证.我可以获取用户名,但不能获取密码.

我已尝试使用SecurityContextHolder.getContext().getAuthentication()此处建议访问此信息如何从spring-security获取明文密码？但密码返回为null.

我怎样才能获得密码？

谢谢.

这是我的applicationContext-security.xml

<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:sec="http://www.springframework.org/schema/security" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans
       http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
       http://www.springframework.org/schema/security
       http://www.springframework.org/schema/security/spring-security-3.1.xsd">

<sec:http authentication-manager-ref='authenticationManager'>
    <sec:intercept-url pattern="/spring/**" access="ROLE_USER" />
    <sec:http-basic />
</sec:http>

<bean id="basicAuthenticationFilter"
    class="org.springframework.security.web.authentication.www.BasicAuthenticationFilter">
    <property name="authenticationManager" ref="authenticationManager" />
    <property name="authenticationEntryPoint" ref="authenticationEntryPoint" />
</bean>

<bean id="authenticationEntryPoint"
    class="org.springframework.security.web.authentication.www.BasicAuthenticationEntryPoint">
    <property name="realmName" value="Announcements Rest Realm" />
</bean>

<bean id="authenticationManager"
    class="org.springframework.security.authentication.ProviderManager">
    <property name="providers">
        <list>
            <ref local="authProvider" />
        </list>
    </property>
</bean>

<bean id="authProvider"
    class="org.springframework.security.authentication.dao.DaoAuthenticationProvider">
    <property name="userDetailsService" ref="userDetailsService" />
</bean>

<bean id="filterChainProxy" class="org.springframework.security.web.FilterChainProxy">
    <constructor-arg>
        <list>
            <sec:filter-chain pattern="/spring/**" filters="basicAuthenticationFilter" />
        </list>
    </constructor-arg>
</bean>

<sec:user-service id="userDetailsService">
    <sec:user name="admin" password="**" authorities="ROLE_USER, ROLE_ADMIN" />
    <sec:user name="user" password="**" authorities="ROLE_USER" />
</sec:user-service>

Answer 1

我已经明白了.

我已将身份验证管理器配置更改为使用authentication-manager元素并在其中添加了属性:

<sec:authentication-manager alias="authenticationManager" erase-credentials="false">
    <sec:authentication-provider ref="authProvider" />      
</sec:authentication-manager>

然后我可以SecurityContextHolder.getContext().getAuthentication().getCredentials()在我的控制器类中使用来获取密码.

感谢Piotrek De的帮助

Answer 2

你使用记住我/运行身份/切换用户吗？在这种情况下，密码为空（如您提到的线程中所述）。另外，可能您必须使用基本表单身份验证（向 j_spring_security_check 发布请求）