spring - TAM Webseal + spring 预认证

Question

有人用 TAM Web-seal 做过春季预认证吗？可以分享一下配置细节吗？

Answer 1

如果 webseal 在iv-userheader 中使用用户名转发请求，那么配置 spring-security 相对简单：

<security:http auto-config="false" use-expressions="true" entry-point-ref="authenticationEntryPoint" access-decision-manager-ref="httpAccessDecisionManager">

    <security:custom-filter ref="webSealPreAuthFilter" position="PRE_AUTH_FILTER"/>
     ...
</security:http>


<bean id="webSealPreAuthFilter" class="org.springframework.security.web.authentication.preauth.RequestHeaderAuthenticationFilter">
    <property name="authenticationManager" ref="authenticationManager"/>
    <property name="principalRequestHeader" value="iv-user"/>

    <!-- exceptionIfHeaderMissing AND checkForPrincipalChanges needs to be enable to check that each request needs a "iv-user" header -->
    <property name="checkForPrincipalChanges" value="true"/>
    <property name="exceptionIfHeaderMissing" value="true"/>
</bean>


<alias name="authenticationManager" alias="org.springframework.security.authenticationManager"/>
<bean id="authenticationManager" class="org.springframework.security.authentication.ProviderManager">
    <property name="authenticationEventPublisher">
        <bean class="org.springframework.security.authentication.DefaultAuthenticationEventPublisher"/>
    </property>
    <constructor-arg name="providers">
        <list>
            <ref local="preAuthenticatedAuthenticationProvider"/>
        </list>
    </constructor-arg>
</bean>

<bean id="preAuthenticatedAuthenticationProvider"
        class="org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationProvider">
    <property name="preAuthenticatedUserDetailsService">
        <bean class="org.springframework.security.core.userdetails.UserDetailsByNameServiceWrapper">
            <constructor-arg name="userDetailsService" ref="userDetailsService"/>
        </bean>
    </property>
</bean>

<bean id="authenticationEntryPoint" class="org.springframework.security.web.authentication.Http403ForbiddenEntryPoint"/>

您需要一个userDetailsService，但这高度依赖于您的应用程序的工作方式。