知識庫 / Spring / Spring Security RSS 訂閱

public class SimpleUserDetailsService implements UserDetailsService {

    // ...

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        String[] usernameAndDomain = StringUtils.split(
          username, String.valueOf(Character.LINE_SEPARATOR));
        if (usernameAndDomain == null || usernameAndDomain.length != 2) {
            throw new UsernameNotFoundException("Username and domain must be provided");
        }
        User user = userRepository.findUser(usernameAndDomain[0], usernameAndDomain[1]);
        if (user == null) {
            throw new UsernameNotFoundException(
              String.format("Username not found for domain, username=%s, domain=%s", 
                usernameAndDomain[0], usernameAndDomain[1]));
        }
        return user;
    }
}

3.3. Spring Security 配置

我們的配置與標準的 Spring Security 配置不同，因為我們會在過濾器鏈中在默認配置之前，通過調用 addFilterBefore 方法，插入我們的 SimpleAuthenticationFilter。

@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    http.csrf(AbstractHttpConfigurer::disable)
        .authorizeRequests()
        .requestMatchers("/css/**", "/index")
        .permitAll()
        .requestMatchers("/user/**")
        .authenticated()
        .and()
        .formLogin(httpSecurityFormLoginConfigurer -> httpSecurityFormLoginConfigurer.loginPage("/login").permitAll())
        .logout(httpSecurityLogoutConfigurer -> httpSecurityLogoutConfigurer.logoutUrl("/logout").permitAll())
        .with(securityConfig(), Customizer.withDefaults());
    return http.getOrBuild();
}

public AuthenticationProvider authProvider() {
    DaoAuthenticationProvider provider = new DaoAuthenticationProvider();
    provider.setUserDetailsService(userDetailsService);
    provider.setPasswordEncoder(passwordEncoder());
    return provider;
}

由於我們使用了 SimpleAuthenticationFilter，因此我們配置了自定義的 AuthenticationFailureHandler，以確保失敗/成功的登錄嘗試得到適當的處理：

public SimpleAuthenticationFilter authenticationFilter() throws Exception {
    SimpleAuthenticationFilter filter = new SimpleAuthenticationFilter();
    filter.setAuthenticationManager(authenticationManagerBean());
    filter.setAuthenticationFailureHandler(failureHandler());
    filter.setAuthenticationSuccessHandler(new SavedRequestAwareAuthenticationSuccessHandler());
    filter.setSecurityContextRepository(new HttpSessionSecurityContextRepository());
    return filter;
}

請注意，我們還需要添加一個安全上下文存儲庫。

3.4. 登錄頁面

本登錄頁面收集我們的附加 域字段，該字段由我們的 SimpleAuthenticationFilter提取。

<form class="form-signin" th:action="@{/login}" method="post">
 <h2 class="form-signin-heading">Please sign in</h2>
 <p>Example: user / domain / password</p>
 <p th:if="${param.error}" class="error">Invalid user, password, or domain</p>
 <p>
   <label for="username" class="sr-only">Username</label>
   <input type="text" id="username" name="username" class="form-control" 
     placeholder="Username" required autofocus/>
 </p>
 <p>
   <label for="domain" class="sr-only">Domain</label>
   <input type="text" id="domain" name="domain" class="form-control" 
     placeholder="Domain" required autofocus/>
 </p>
 <p>
   <label for="password" class="sr-only">Password</label>
   <input type="password" id="password" name="password" class="form-control" 
     placeholder="Password" required autofocus/>
 </p>
 <button class="btn btn-lg btn-primary btn-block" type="submit">Sign in</button><br/>
 <p><a href="/index" th:href="@{/index}">Back to home page</a></p>
</form>

當我們運行應用程序並訪問上下文，在 http://localhost:8081，我們會看到一個鏈接，用於訪問受保護的頁面。點擊該鏈接將導致登錄頁面顯示。正如預期的那樣，我們看到額外的域名字段：

3.5. 總結

在第一個示例中，我們成功地重用了 DaoAuthenticationProvider 和 UsernamePasswordAuthenticationToken，通過“欺騙”用户名字段來實現。

因此，我們能夠通過最小的配置和額外代碼，添加對額外登錄字段的支持。

4. 自定義項目設置

我們的第二種方法與第一種方法非常相似，但更適合非簡單的用例。

我們的第二種方法的主要組件包括：

• CustomAuthenticationFilter – UsernamePasswordAuthenticationFilter 的擴展
• CustomUserDetailsService – 聲明一個 loadUserbyUsernameAndDomain 方法的自定義接口
• CustomUserDetailsServiceImpl – CustomUserDetailsService 的實現
• CustomUserDetailsAuthenticationProvider – AbstractUserDetailsAuthenticationProvider 的擴展
• CustomAuthenticationToken – UsernamePasswordAuthenticationToken 的擴展
• User – Spring Security 提供的 User 類，聲明我們的額外 domain 字段
• SecurityConfig – 我們的 Spring Security 配置，將 CustomAuthenticationFilter 插入到過濾器鏈中，聲明安全規則並連接依賴項
• login.html – 收集 username, password 和 domain 的登錄頁面

public class CustomAuthenticationFilter 
  extends UsernamePasswordAuthenticationFilter {

    public static final String SPRING_SECURITY_FORM_DOMAIN_KEY = "domain";

    @Override
    public Authentication attemptAuthentication(
        HttpServletRequest request,
        HttpServletResponse response) 
          throws AuthenticationException {

        // ...

        CustomAuthenticationToken authRequest = getAuthRequest(request);
        setDetails(request, authRequest);
        return this.getAuthenticationManager().authenticate(authRequest);
    }

    private CustomAuthenticationToken getAuthRequest(HttpServletRequest request) {
        String username = obtainUsername(request);
        String password = obtainPassword(request);
        String domain = obtainDomain(request);

        // ...

        return new CustomAuthenticationToken(username, password, domain);
    }

 public UserDetails loadUserByUsernameAndDomain(String username, String domain) 
     throws UsernameNotFoundException {
     if (StringUtils.isAnyBlank(username, domain)) {
         throw new UsernameNotFoundException("Username and domain must be provided");
     }
     User user = userRepository.findUser(username, domain);
     if (user == null) {
         throw new UsernameNotFoundException(
           String.format("Username not found for domain, username=%s, domain=%s", 
             username, domain));
     }
     return user;
 }

@Override
protected UserDetails retrieveUser(String username, 
  UsernamePasswordAuthenticationToken authentication) 
    throws AuthenticationException {
 
    CustomAuthenticationToken auth = (CustomAuthenticationToken) authentication;
    UserDetails loadedUser;

    try {
        loadedUser = this.userDetailsService
          .loadUserByUsernameAndDomain(auth.getPrincipal()
            .toString(), auth.getDomain());
    } catch (UsernameNotFoundException notFound) {
 
        if (authentication.getCredentials() != null) {
            String presentedPassword = authentication.getCredentials()
              .toString();
            passwordEncoder.matches(presentedPassword, userNotFoundEncodedPassword);
        }
        throw notFound;
    } catch (Exception repositoryProblem) {
 
        throw new InternalAuthenticationServiceException(
          repositoryProblem.getMessage(), repositoryProblem);
    }

    // ...

    return loadedUser;
}