当前位置:  开发笔记 > 编程语言 > 正文

使用Java Config的Spring安全性不能使用eraseCredentials方法

如何解决《使用JavaConfig的Spring安全性不能使用eraseCredentials方法》经验,为你挑选了0个好方法。

使用Spring Security 3.2.2和Spring Framework 3.2.8的以下Java Config配置,即使我使用' .eraseCredentials(false) '并且使用authentication.getCredentials()也无法使用用户密码.

@Configuration
@EnableWebSecurity
@Order( 1 )
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Bean( name = "authenticationEntryPoint" )
    public LoginUrlAuthenticationEntryPoint authenticationEntryPoint() {

        return new XhrAwareAuthenticationEntryPoint( "/home?noAuthenticated=expired" );
    }

    @Bean( name = "acessDeniedHandler" )
    public AccessDeniedHandler acessDeniedHandler() {

        XhrAwareAccessDeniedHandlerImpl xhrAwareAccessDeniedHandler = new XhrAwareAccessDeniedHandlerImpl();
        xhrAwareAccessDeniedHandler.setErrorPage( "/denied" );
        return xhrAwareAccessDeniedHandler;
    }

    @Bean( name = "atlasAuthenticationSuccessHandler" )
    public AtlasAuthenticationSuccessHandler atlasAuthenticationSuccessHandler() {

        return new AtlasAuthenticationSuccessHandler( "/views/hub" );
    }

    @Bean( name = "atlasAuthenticationFailureHandler" )
    public AtlasAuthenticationFailureHandler atlasAuthenticationFailureHandler() {
        return new AtlasAuthenticationFailureHandler( "/home?loginError=error" );
    }

    @Bean( name = "atlasLogoutSuccessHandler" )
    public AtlasLogoutSuccessHandler atlasLogoutSuccessHandler() {
        AtlasLogoutSuccessHandler atlasLogoutSuccessHandler = new AtlasLogoutSuccessHandler();
        atlasLogoutSuccessHandler.setDefaultTargetUrl( "/home?logoff=disconnect" );
        return atlasLogoutSuccessHandler;
    }

    @Override
    public void configure( WebSecurity web ) throws Exception {

        web.ignoring().antMatchers( "/resources/**" );
    }

    @Override
    protected void configure( HttpSecurity http ) throws Exception {

        http.csrf().disable()
                .httpBasic()
                .authenticationEntryPoint( this.authenticationEntryPoint() )
                .and()
                .exceptionHandling()
                .accessDeniedHandler( this.acessDeniedHandler() )
                .and()
                .formLogin()
                .usernameParameter( "j_username" )
                .passwordParameter( "j_password" )
                .loginPage( "/home" )
                .loginProcessingUrl( "/login" )
                .failureHandler( this.atlasAuthenticationFailureHandler() )
                .successHandler( this.atlasAuthenticationSuccessHandler() )
                .permitAll()
                .and()
                .logout()
                .logoutUrl( "/logout" )
                .logoutSuccessHandler( this.atlasLogoutSuccessHandler() )
                .invalidateHttpSession( true )
                .permitAll()
                .and()
                .authorizeRequests()
                .antMatchers(
                        ViewsConstants.VIEWS_URI + "/**",
                        RssController.RSS_URI + "/**",
                        ProxySolrController.SEARCH_URI + "/**" )
                .authenticated()
                .antMatchers( ConfigurationProperties.ADMIN_URI + "/**" ).hasAnyRole( Role.ADMIN )
                .antMatchers( "/**" ).permitAll();
    }

    @Configuration
    @Profile( "DES" )
    public static class AuthenticacioInMemoryConfig {

        @Autowired
        public void configureGlobal( AuthenticationManagerBuilder auth ) throws Exception {

            auth.eraseCredentials( false ).inMemoryAuthentication()
                    .withUser( "user" ).password( "atlas" ).authorities( "ROLE_USER" ).and()
                    .withUser( "admin" ).password( "atlas" ).authorities( "ROLE_ADMIN" );
        }
    }

    @Configuration
    @Profile( "PRO" )
    @PropertySource( "file:${config.env}/config_env.properties" )
    public static class AuthenticacionLdapConfig {

        @Value( "${ldap.host}" )
        private String host;
        @Value( "${ldap.port}" )
        private String port;
        @Value( "${ldap.basedn}" )
        private String baseDn;
        @Value( "${ldap.userdn}" )
        private String userDn;
        @Value( "${ldap.passw}" )
        private String password;

        @Bean
        public static PropertySourcesPlaceholderConfigurer propertySourcesPlaceholderConfigurer() {

            return new PropertySourcesPlaceholderConfigurer();
        }

        @Bean( name = "contextSource" )
        public DefaultSpringSecurityContextSource contextSource() {

            DefaultSpringSecurityContextSource contextSource =
                    new DefaultSpringSecurityContextSource( "ldap://" + this.host + ":" + this.port );
            contextSource.setUserDn( this.userDn );
            contextSource.setPassword( this.password );
            return contextSource;
        }

        @Bean( name = "userSearch" )
        public FilterBasedLdapUserSearch userSearch() {

            return new FilterBasedLdapUserSearch( this.baseDn, "(bsalias={0})", this.contextSource() );
        }

        @Bean( name = "ldapAuthenticator" )
        public LdapAuthenticator ldapAuthenticator() {

            BindAuthenticator authenticator = new BindAuthenticator( this.contextSource() );
            authenticator.setUserSearch( this.userSearch() );
            return authenticator;
        }

        @Bean( name = "atlasAuthoritiesPopulator" )
        public AtlasAuthoritiesPopulator atlasAuthoritiesPopulator() {

            return new AtlasAuthoritiesPopulator();
        }

        @Bean( name = "ldapAuthenticationProvider" )
        public LdapAuthenticationProvider ldapAuthenticationProvider() {

            return new LdapAuthenticationProvider( this.ldapAuthenticator(), this.atlasAuthoritiesPopulator() );
        }

        @Autowired
        public void configureGlobal( AuthenticationManagerBuilder auth ) throws Exception {

            auth.eraseCredentials( false ).authenticationProvider( this.ldapAuthenticationProvider() );
        }
    }
}

但是,对于相同的spring security和spring框架使用xml配置运行正常并且密码可用.






    



        



    



    



    





    

    
    
    
    
    

    
                

    
            




    
        
        
        
    

    
        
            
                
                
                    
                        
                        
                        
                    
                
            
        
        
            
        
    

    
        
    




    
        
            
                
                
            
        
    

你有什么线索吗?我该如何解决这个问题?

提前致谢.

推荐阅读
可爱的天使keven_464
这个屌丝很懒,什么也没留下!
DevBox开发工具箱 | 专业的在线开发工具网站    京公网安备 11010802040832号  |  京ICP备19059560号-6
Copyright © 1998 - 2020 DevBox.CN. All Rights Reserved devBox.cn 开发工具箱 版权所有