1

我正在使用自定义AuthenticationProvider：

public class CustomAuthenticationProviderImpl extends AbstractUserDetailsAuthenticationProvider {

    @Resource(name="userDetailsService")
    private UserDetailsService userDetailsService;

    //.......

}

我也尝试使用记住我的功能：

<security:http auto-config="true" use-expressions="true" access-denied-page="/auth/accessDenied.xhtml" >

    <!-- ........... -->

    <security:remember-me user-service-ref="userDetailsService" key="some-string"/>

</security:http>

一切正常，除了记住我。当我不使用 custom 时，它曾经工作过AuthenticationProvider。

为了使记住我起作用，我需要做什么？

更新

我也在使用AuthenticationSuccessHandler：

public class AuthenticationSuccessHandlerImpl extends SimpleUrlAuthenticationSuccessHandler {

    @Override
    public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws ServletException, IOException {

        int timeout = 60*60;

        request.getSession().setMaxInactiveInterval(timeout); //60 minutes

        System.out.println("Session timeout of user: " + authentication.getName() + " has been set to: " + request.getSession().getMaxInactiveInterval() + " seconds.");

        setDefaultTargetUrl("/views/home.jsf");

        super.onAuthenticationSuccess(request, response, authentication);
    }
}

更新 2：

重新启动 Tomcat 时，我得到以下调试输出。但是当我加载登录表单并提交它时 - 我没有看到remember调试输出中包含的任何文本，并且没有创建记住我的 cookie。

DEBUG [pool-2-thread-1] 2012-04-16 09:18:11,166 (DefaultSingletonBeanRegistry.java:217) - org.springframework.beans.factory.support.DefaultSingletonBeanRegistry getSingleton :
 Creating shared instance of singleton bean 'rememberMeFilter'
DEBUG [pool-2-thread-1] 2012-04-16 09:18:11,166 (AbstractAutowireCapableBeanFactory.java:430) - org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory createBean :
 Creating instance of bean 'rememberMeFilter'
DEBUG [pool-2-thread-1] 2012-04-16 09:18:11,182 (AbstractEnvironment.java:114) - org.springframework.core.env.AbstractEnvironment <init> :
 Initializing new StandardServletEnvironment
DEBUG [pool-2-thread-1] 2012-04-16 09:18:11,182 (MutablePropertySources.java:103) - org.springframework.core.env.MutablePropertySources addLast :
 Adding [servletConfigInitParams] PropertySource with lowest search precedence
DEBUG [pool-2-thread-1] 2012-04-16 09:18:11,182 (MutablePropertySources.java:103) - org.springframework.core.env.MutablePropertySources addLast :
 Adding [servletContextInitParams] PropertySource with lowest search precedence
DEBUG [pool-2-thread-1] 2012-04-16 09:18:11,182 (MutablePropertySources.java:103) - org.springframework.core.env.MutablePropertySources addLast :
 Adding [jndiProperties] PropertySource with lowest search precedence
DEBUG [pool-2-thread-1] 2012-04-16 09:18:11,182 (MutablePropertySources.java:103) - org.springframework.core.env.MutablePropertySources addLast :
 Adding [systemProperties] PropertySource with lowest search precedence
DEBUG [pool-2-thread-1] 2012-04-16 09:18:11,182 (MutablePropertySources.java:103) - org.springframework.core.env.MutablePropertySources addLast :
 Adding [systemEnvironment] PropertySource with lowest search precedence
DEBUG [pool-2-thread-1] 2012-04-16 09:18:11,182 (AbstractEnvironment.java:120) - org.springframework.core.env.AbstractEnvironment <init> :
 Initialized StandardServletEnvironment with PropertySources [servletConfigInitParams,servletContextInitParams,jndiProperties,systemProperties,systemEnvironment]
DEBUG [pool-2-thread-1] 2012-04-16 09:18:11,182 (AbstractAutowireCapableBeanFactory.java:504) - org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory doCreateBean :
 Eagerly caching bean 'rememberMeFilter' to allow for resolving potential circular references
DEBUG [pool-2-thread-1] 2012-04-16 09:18:11,182 (DefaultSingletonBeanRegistry.java:217) - org.springframework.beans.factory.support.DefaultSingletonBeanRegistry getSingleton :
 Creating shared instance of singleton bean 'rememberMeServices'
DEBUG [pool-2-thread-1] 2012-04-16 09:18:11,182 (AbstractAutowireCapableBeanFactory.java:430) - org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory createBean :
 Creating instance of bean 'rememberMeServices'
DEBUG [pool-2-thread-1] 2012-04-16 09:18:11,198 (AbstractAutowireCapableBeanFactory.java:504) - org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory doCreateBean :
 Eagerly caching bean 'rememberMeServices' to allow for resolving potential circular references
DEBUG [pool-2-thread-1] 2012-04-16 09:18:11,198 (AbstractBeanFactory.java:245) - org.springframework.beans.factory.support.AbstractBeanFactory doGetBean :
 Returning cached instance of singleton bean 'userDetailsService'
DEBUG [pool-2-thread-1] 2012-04-16 09:18:11,213 (AbstractAutowireCapableBeanFactory.java:1498) - org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory invokeInitMethods :
 Invoking afterPropertiesSet() on bean with name 'rememberMeServices'
DEBUG [pool-2-thread-1] 2012-04-16 09:18:11,213 (AbstractBeanFactory.java:245) - org.springframework.beans.factory.support.AbstractBeanFactory doGetBean :
 Returning cached instance of singleton bean 'org.springframework.security.methodSecurityMetadataSourceAdvisor'
DEBUG [pool-2-thread-1] 2012-04-16 09:18:11,213 (AbstractBeanFactory.java:245) - org.springframework.beans.factory.support.AbstractBeanFactory doGetBean :
 Returning cached instance of singleton bean 'org.springframework.transaction.config.internalTransactionAdvisor'
DEBUG [pool-2-thread-1] 2012-04-16 09:18:11,213 (AbstractAutowireCapableBeanFactory.java:458) - org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory createBean :
 Finished creating instance of bean 'rememberMeServices'
DEBUG [pool-2-thread-1] 2012-04-16 09:18:11,213 (AbstractBeanFactory.java:245) - org.springframework.beans.factory.support.AbstractBeanFactory doGetBean :
 Returning cached instance of singleton bean 'org.springframework.security.authenticationManager'
DEBUG [pool-2-thread-1] 2012-04-16 09:18:11,213 (AbstractAutowireCapableBeanFactory.java:1498) - org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory invokeInitMethods :
 Invoking afterPropertiesSet() on bean with name 'rememberMeFilter'
DEBUG [pool-2-thread-1] 2012-04-16 09:18:11,213 (AbstractBeanFactory.java:245) - org.springframework.beans.factory.support.AbstractBeanFactory doGetBean :
 Returning cached instance of singleton bean 'org.springframework.security.methodSecurityMetadataSourceAdvisor'
DEBUG [pool-2-thread-1] 2012-04-16 09:18:11,213 (AbstractBeanFactory.java:245) - org.springframework.beans.factory.support.AbstractBeanFactory doGetBean :
 Returning cached instance of singleton bean 'org.springframework.transaction.config.internalTransactionAdvisor'
DEBUG [pool-2-thread-1] 2012-04-16 09:18:11,213 (AbstractAutowireCapableBeanFactory.java:458) - org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory createBean :
 Finished creating instance of bean 'rememberMeFilter'
DEBUG [pool-2-thread-1] 2012-04-16 09:18:11,213 (AbstractBeanFactory.java:245) - org.springframework.beans.factory.support.AbstractBeanFactory doGetBean :
 Returning cached instance of singleton bean 'rememberMeServices'
DEBUG [pool-2-thread-1] 2012-04-16 09:18:11,213 (DefaultSingletonBeanRegistry.java:217) - org.springframework.beans.factory.support.DefaultSingletonBeanRegistry getSingleton :
 Creating shared instance of singleton bean 'rememberMeAuthenticationProvider'
DEBUG [pool-2-thread-1] 2012-04-16 09:18:11,213 (AbstractAutowireCapableBeanFactory.java:430) - org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory createBean :
 Creating instance of bean 'rememberMeAuthenticationProvider'
DEBUG [pool-2-thread-1] 2012-04-16 09:18:11,213 (AbstractAutowireCapableBeanFactory.java:504) - org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory doCreateBean :
 Eagerly caching bean 'rememberMeAuthenticationProvider' to allow for resolving potential circular references
DEBUG [pool-2-thread-1] 2012-04-16 09:18:11,213 (AbstractAutowireCapableBeanFactory.java:1498) - org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory invokeInitMethods :
 Invoking afterPropertiesSet() on bean with name 'rememberMeAuthenticationProvider'
DEBUG [pool-2-thread-1] 2012-04-16 09:18:11,213 (AbstractBeanFactory.java:245) - org.springframework.beans.factory.support.AbstractBeanFactory doGetBean :
 Returning cached instance of singleton bean 'org.springframework.security.methodSecurityMetadataSourceAdvisor'
DEBUG [pool-2-thread-1] 2012-04-16 09:18:11,213 (AbstractBeanFactory.java:245) - org.springframework.beans.factory.support.AbstractBeanFactory doGetBean :
 Returning cached instance of singleton bean 'org.springframework.transaction.config.internalTransactionAdvisor'
DEBUG [pool-2-thread-1] 2012-04-16 09:18:11,213 (AbstractAutowireCapableBeanFactory.java:458) - org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory createBean :
 Finished creating instance of bean 'rememberMeAuthenticationProvider'

我有以下内容AuthenticationSuccessHandlerImpl：

System.out.println("_spring_security_remember_me after authentication = " + request.getParameter("_spring_security_remember_me"));

输出是：

_spring_security_remember_me after authentication = on

但是没有创建记住我的cookie！

4

2 回答 2

1

您可以尝试禁用 auto-config:auto-config="false"并直接声明 RememberMeAuthenticationProvider ：

<bean id="rememberMeFilter" class=
 "org.springframework.security.web.authentication.rememberme.RememberMeAuthenticationFilter">
  <property name="rememberMeServices" ref="rememberMeServices"/>
  <property name="authenticationManager" ref="authenticationManager" />
</bean>

<bean id="rememberMeServices" class=
 "org.springframework.security.web.authentication.rememberme.TokenBasedRememberMeServices">
  <property name="userDetailsService" ref="userService"/>
  <property name="key" value="some-string"/>
</bean>

<bean id="rememberMeAuthenticationProvider" class=
 "org.springframework.security.authentication.RememberMeAuthenticationProvider">
  <property name="key" value="some-string"/>
</bean>
于 2012-04-05T08:33:21.403 回答
0

对于最新版本的 Spring 安全性，您可以添加如下配置：

它将帮助您创建一个过滤器，如果在安全上下文中找不到凭据，它将处理自动登录。它还可以帮助您创建 rememberMeServices 和 rememberMeAuthenticationProvider。

您说，在重写 CustomAuthenticationProviderImpl 之前，它可以工作。所以我想你已经设置好了。

现在的问题是，你重写了 CustomAuthenticationProviderImpl ，然后你打破了关于记住我的原始行。首先，您需要在自定义提供程序中设置 rememberMeService：

<beans:bean id="customFilter" class="..CustomAuthenticationProviderImpl ">
    <beans:property ... />
    <beans:property name="rememberMeServices" ref="rememberMeServices" />
</beans:bean>

你可以试试这个，如果它说“rememberMeServices”找不到，那么你也应该设置remember me service作为上面的回复。

于 2012-09-10T12:26:53.237 回答