1

我有以下配置：

<security:http auto-config="false" entry-point-ref="restAuthenticationEntryPoint" use-expressions="true">
        <security:remember-me services-alias="rememberMyCompamy" key="MY-KEY" user-service-ref="myUserDetailsService"/>
        <security:custom-filter ref="loginFilter" position="FORM_LOGIN_FILTER"/>
        <!-- Adds a logout filter to Spring Security filter chain -->
        <security:logout logout-url="/logout" delete-cookies="true" invalidate-session="true" success-handler-ref="restLogoutSuccessHandler"/>
    </security:http>
    <!-- Configures the authentication entry point that returns HTTP status code 401 -->
    <bean id="restAuthenticationEntryPoint" class="uk.co.axiomtechsolutions.ipf.security.authentication.RestAuthenticationEntryPoint"/>

    <!-- Configures a custom login filter bean -->
    <bean id="loginFilter" class="org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter">
        <property name="authenticationManager" ref="authenticationManager"/>
        <property name="authenticationFailureHandler" ref="restAuthenticationFailureHandler"/>
        <property name="authenticationSuccessHandler" ref="restAuthenticationSuccessHandler"/>
        <property name="rememberMeServices" ref="rememberMyCompany"/> <!--doesn't do anything?-->
        <property name="filterProcessesUrl" value="/login"/>
        <property name="usernameParameter" value="username"/>
        <property name="passwordParameter" value="password"/>
        <property name="allowSessionCreation" value="true"/>
        <property name="postOnly" value="true"/>
    </bean>

在我的 AuthenticationSuccesHandler 中使用此代码，它可以工作。我尝试了一些组合，这是创建 cookie 的唯一方法，取自这里的优秀教程。但是以编程方式调用 rememberMeservice 但感觉不对

@Resource(name = "rememberMyCompany")
private RememberMeServices rememberMyCompany;
@Override
public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response,
                                    Authentication authentication) throws ServletException, IOException {

    response.setStatus(HttpServletResponse.SC_NO_CONTENT);
    HttpServletRequestWrapper wrapper = new HttpServletRequestWrapper(request) {
        @Override public String getParameter(String name) {
            return "true";
        }
    };
    rememberMyCompnay.loginSuccess(wrapper, response, authentication);
    clearAuthenticationAttributes(request);
}

创建了一个基于令牌的 rememberMeService 以及一个服务别名，但除非我执行上述操作，否则我无法设置登录过滤器来使用它，这感觉不是很有弹性。

4

1 回答 1

1

将在您的身份验证成功处理程序执行之前为您UsernamePasswordAuthenticatonFilter调用。它是否做任何事情取决于请求是否包含“记住我”参数。RememberMeServices

所以我猜你在请求中没有那个参数。从您的问题中不清楚您究竟想要实现什么 - 您是否意识到这一点并希望为所有请求启用记住我。要始终为经过身份验证的请求设置 cookie，您可以alwaysRemember在RememberMeServices. 但是，这不是通过命名空间公开的，因此您必须获取对 bean 的引用并这样做（例如通过后处理器），或者手动声明 bean。

于 2013-11-01T11:11:13.653 回答