1

首先！感谢您阅读我的问题。

我在检索所有主要对象时遇到问题。我使用 Spring 版本 3.2.1.RELEASE 和 spring security 3.1.3.RELEASE。

我在网上进行了研究，发现了如何检索主体，但是在插入我自己的身份验证代码后，它就不再起作用了。检索所有主体对象的方法：

        @RequestMapping("/loggedinusers")
        public String viewAllLoggedInUsers(Model model) {

            List<Object> principals = sessionRegistry.getAllPrincipals();

            model.addAttribute("size", principals.size());

            List<Integer> listOfUserIds = new ArrayList<Integer>();

            for (Object principal : principals) {
                if (principal instanceof Principal) {
                    listOfUserIds.add(((Principal) principal).getId());
                }
            }

            return "/logged_in_users";
        }

在我更改一些安全配置之前，上面的代码正在运行。这是我的所有配置：

 <!-- bean namespave -->

        <security:global-method-security jsr250-annotations="enabled"  pre-post-annotations="enabled" secured-annotations="enabled" />

        <security:http use-expressions="true" entry-point-ref="loginEntryPoint">
            <security:intercept-url pattern="/login" access="permitAll()" />

            <!-- ******* Filters ******* -->
            <security:custom-filter ref="ipFormLoginFilter" position="FORM_LOGIN_FILTER"/>

            <security:logout 
                delete-cookies="JSESSIONID" 
                logout-url="/logout"
                logout-success-url="/login"
            />

            <security:session-management session-fixation-protection="newSession">                    
                <security:concurrency-control session-registry-alias="sessionRegistry" max-sessions="5"  error-if-maximum-exceeded="false" />
            </security:session-management>

        </security:http>

        <bean id="loginEntryPoint" class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint">
            <constructor-arg value="/login"/>
        </bean>

        <security:authentication-manager alias="authenticationManager">
            <security:authentication-provider ref="customUserAuthenticationProvider" />
        </security:authentication-manager>

        <bean  id="ipFormLoginFilter" class="nl.irp.vadp.security.CustomIpUsernamePasswordAuthenticationFilter">
            <property name="filterProcessesUrl" value="/authlogin"/>
            <property name="authenticationManager" ref="authenticationManager"/>
            <property name="usernameParameter" value="username"/>
            <property name="passwordParameter" value="password"/>
            <property name="authenticationSuccessHandler">
                <bean class="org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler">
                    <property name="defaultTargetUrl" value="/"/>
                </bean>
            </property>
            <property name="authenticationFailureHandler">
                <bean class="org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler">
                    <property name="defaultFailureUrl" value="/login?login_error=true"/>
                </bean>
            </property>
        </bean>

        <bean id="passwordEncoder" class="org.springframework.security.authentication.encoding.ShaPasswordEncoder">
            <constructor-arg value="512" />
        </bean>

    </beans>

代码:: 过滤器类

    public final class CustomIpUsernamePasswordAuthenticationFilter extends UsernamePasswordAuthenticationFilter {

        @Override
        public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException {
            if (request.getMethod().equals("POST")) {
                String username = obtainUsername(request);
                String password = obtainPassword(request);
                UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(username, password);
                setDetails(request, authRequest);
                return this.getAuthenticationManager().authenticate(authRequest);
            }
            throw new AuthenticationServiceException("Authentication method not supported: "    + request.getMethod());
        }
    }

代码:: 自定义认证类

    @Component
    public class CustomUserAuthenticationProvider implements AuthenticationProvider {

        @Autowired
        UserService userService;
        @Autowired
        ShaPasswordEncoder shaPasswordEncoder;

        public CustomUserAuthenticationProvider() {
        }

        @Override
        public Authentication authenticate(Authentication authentication) throws AuthenticationException {
            final String BAD_CREDENTIALS = "test";
            final String BAD_IP_ADDRESS = "test";
            List<GrantedAuthority> authorities = new ArrayList<GrantedAuthority>();
            UsernamePasswordAuthenticationToken token = (UsernamePasswordAuthenticationToken) authentication;

            String email = token.getName();

            User user = null;
            if (email != null) {
                user = userService.findUserByEmail(email);
            }
            if (user == null) {
                throw new UsernameNotFoundException(BAD_CREDENTIALS + "no user found");
            }

            String password = user.getPassword();
            String salt = user.getName();

            if (!shaPasswordEncoder.isPasswordValid(password, (String) token.getCredentials(), salt)) {
                throw new BadCredentialsException(BAD_CREDENTIALS + "bad password");
            }

            if (!user.hasIpaddress(request.getRemoteAddr())) {
                throw new BadCredentialsException(BAD_IP_ADDRESS + "bad ip adress");
            }

            authorities.add(new SimpleGrantedAuthority("ROLE_" + user.getRole().getName().toUpperCase()));
            Principal principal = new Principal(user.getEmail(), user.getPassword(), authorities, user.getId());

            return new UsernamePasswordAuthenticationToken(principal, user.getPassword());
        }

        @Override
        public boolean supports(Class<?> authentication) {
            return CustomIpUsernamePasswordAuthenticationToken.class.equals(authentication);
        }
    }

添加了以下侦听器：

<!--  Listeners -->
<listener><!-- Starts up the webapp project -->
    <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>
<listener><!-- spring security listener -->
    <listener-class>org.springframework.security.web.session.HttpSessionEventPublisher</listener-class>
</listener>
    <!-- extra toegevoegd voor die ip ... -->
<listener>
    <listener-class>
    org.springframework.web.context.request.RequestContextListener
    </listener-class>
</listener>

正如上面的代码所描述的，我用一个验证方法创建了我自己的 AuthenticationProvider 来验证插入的数据。这完美地工作（组件扫描也完成）。jsp 中的权限（例如）似乎也可以工作。我似乎不明白为什么我无法获得注册校长。

编辑：在插入附加信息之前，我删除了标签中的“auto-config=true”。

希望有人可以帮助我。

编辑2：我发现问题出在哪里。在我自己的自定义过滤器中，有一个属性叫做：sessionAuthenticationStrategy。该字段需要设置。

我在过滤器中插入了以下内容，它可以工作：

<property name="sessionAuthenticationStrategy" ref="sessionFixationProtectionStrategy" />

<bean id="sessionFixationProtectionStrategy" class="org.springframework.security.web.authentication.session.SessionFixationProtectionStrategy">

格特兹，

4

0 回答 0