使用Spring Security时,获取bean中当前用户名(即SecurityContext)信息的正确方法是什么？

我有一个使用Spring Security的Spring MVC Web应用程序.我想知道当前登录用户的用户名.我正在使用下面给出的代码段.这是接受的方式吗？

我不喜欢在这个控制器中调用静态方法 - 这违背了Spring的全部目的,恕我直言.有没有办法配置应用程序以注入当前的SecurityContext或当前的身份验证？

  @RequestMapping(method = RequestMethod.GET)
  public ModelAndView showResults(final HttpServletRequest request...) {
    final String currentUser = SecurityContextHolder.getContext().getAuthentication().getName();
    ...
  }

tsunade21.. 251

如果您使用的是Spring 3,最简单的方法是:

 @RequestMapping(method = RequestMethod.GET)   
 public ModelAndView showResults(final HttpServletRequest request, Principal principal) {

     final String currentUser = principal.getName();

 }

Scott Bale.. 64

自从回答这个问题后,Spring世界发生了很多变化.Spring简化了当前用户在控制器中的使用.对于其他bean,Spring采用了作者的建议并简化了"SecurityContextHolder"的注入.更多细节在评论中.

这是我最终选择的解决方案.而不是SecurityContextHolder在我的控制器中使用,我想注入一些SecurityContextHolder在引擎盖下使用的东西,但是从我的代码中抽象出类似单例的类.我发现除了滚动我自己的界面之外没办法做到这一点,如下所示:

public interface SecurityContextFacade {

  SecurityContext getContext();

  void setContext(SecurityContext securityContext);

}

现在,我的控制器(或任何POJO)看起来像这样:

public class FooController {

  private final SecurityContextFacade securityContextFacade;

  public FooController(SecurityContextFacade securityContextFacade) {
    this.securityContextFacade = securityContextFacade;
  }

  public void doSomething(){
    SecurityContext context = securityContextFacade.getContext();
    // do something w/ context
  }

}

并且,由于接口是解耦点,因此单元测试非常简单.在这个例子中,我使用Mockito:

public class FooControllerTest {

  private FooController controller;
  private SecurityContextFacade mockSecurityContextFacade;
  private SecurityContext mockSecurityContext;

  @Before
  public void setUp() throws Exception {
    mockSecurityContextFacade = mock(SecurityContextFacade.class);
    mockSecurityContext = mock(SecurityContext.class);
    stub(mockSecurityContextFacade.getContext()).toReturn(mockSecurityContext);
    controller = new FooController(mockSecurityContextFacade);
  }

  @Test
  public void testDoSomething() {
    controller.doSomething();
    verify(mockSecurityContextFacade).getContext();
  }

}

接口的默认实现如下所示:

public class SecurityContextHolderFacade implements SecurityContextFacade {

  public SecurityContext getContext() {
    return SecurityContextHolder.getContext();
  }

  public void setContext(SecurityContext securityContext) {
    SecurityContextHolder.setContext(securityContext);
  }

}

最后,生产Spring配置如下所示:

     ...
  
    
  

Spring,一个所有东西的依赖注入容器,似乎没有提供注入类似东西的方法,这似乎有点愚蠢.我理解SecurityContextHolder是从acegi继承而来,但仍然.问题是,它们非常接近 - 如果只有SecurityContextHolder一个getter来获取底层SecurityContextHolderStrategy实例(这是一个接口),你可以注入它.事实上,我甚至打开了一个Jira问题.

最后一件事 - 我刚刚改变了我之前的答案.如果你很好奇,请查看历史记录但是,正如同事指出的那样,我之前的回答在多线程环境中不起作用.默认情况下,SecurityContextHolderStrategy使用的底层SecurityContextHolder是一个实例ThreadLocalSecurityContextHolderStrategy,它将SecurityContexts 存储在a中ThreadLocal.因此,SecurityContext在初始化时直接注入bean 并不一定是个好主意- 可能需要ThreadLocal在多线程环境中每次检索它,以便检索正确的bean .

如果您使用的是Spring 3,最简单的方法是:

 @RequestMapping(method = RequestMethod.GET)   
 public ModelAndView showResults(final HttpServletRequest request, Principal principal) {

     final String currentUser = principal.getName();

 }

自从回答这个问题后,Spring世界发生了很多变化.Spring简化了当前用户在控制器中的使用.对于其他bean,Spring采用了作者的建议并简化了"SecurityContextHolder"的注入.更多细节在评论中.

这是我最终选择的解决方案.而不是SecurityContextHolder在我的控制器中使用,我想注入一些SecurityContextHolder在引擎盖下使用的东西,但是从我的代码中抽象出类似单例的类.我发现除了滚动我自己的界面之外没办法做到这一点,如下所示:

public interface SecurityContextFacade {

  SecurityContext getContext();

  void setContext(SecurityContext securityContext);

}

现在,我的控制器(或任何POJO)看起来像这样:

public class FooController {

  private final SecurityContextFacade securityContextFacade;

  public FooController(SecurityContextFacade securityContextFacade) {
    this.securityContextFacade = securityContextFacade;
  }

  public void doSomething(){
    SecurityContext context = securityContextFacade.getContext();
    // do something w/ context
  }

}

并且,由于接口是解耦点,因此单元测试非常简单.在这个例子中,我使用Mockito:

public class FooControllerTest {

  private FooController controller;
  private SecurityContextFacade mockSecurityContextFacade;
  private SecurityContext mockSecurityContext;

  @Before
  public void setUp() throws Exception {
    mockSecurityContextFacade = mock(SecurityContextFacade.class);
    mockSecurityContext = mock(SecurityContext.class);
    stub(mockSecurityContextFacade.getContext()).toReturn(mockSecurityContext);
    controller = new FooController(mockSecurityContextFacade);
  }

  @Test
  public void testDoSomething() {
    controller.doSomething();
    verify(mockSecurityContextFacade).getContext();
  }

}

接口的默认实现如下所示:

public class SecurityContextHolderFacade implements SecurityContextFacade {

  public SecurityContext getContext() {
    return SecurityContextHolder.getContext();
  }

  public void setContext(SecurityContext securityContext) {
    SecurityContextHolder.setContext(securityContext);
  }

}

最后,生产Spring配置如下所示:

     ...
  
    
  

Spring,一个所有东西的依赖注入容器,似乎没有提供注入类似东西的方法,这似乎有点愚蠢.我理解SecurityContextHolder是从acegi继承而来,但仍然.问题是,它们非常接近 - 如果只有SecurityContextHolder一个getter来获取底层SecurityContextHolderStrategy实例(这是一个接口),你可以注入它.事实上,我甚至打开了一个Jira问题.

最后一件事 - 我刚刚改变了我之前的答案.如果你很好奇,请查看历史记录但是,正如同事指出的那样,我之前的回答在多线程环境中不起作用.默认情况下,SecurityContextHolderStrategy使用的底层SecurityContextHolder是一个实例ThreadLocalSecurityContextHolderStrategy,它将SecurityContexts 存储在a中ThreadLocal.因此,SecurityContext在初始化时直接注入bean 并不一定是个好主意- 可能需要ThreadLocal在多线程环境中每次检索它,以便检索正确的bean .

我同意不得不为当前用户查询SecurityContext,这似乎是一种处理这个问题的非Spring方式.

我写了一个静态的"帮助器"类来处理这个问题; 它很脏,因为它是一个全局和静态的方法,但我想这样,如果我们改变任何与安全相关的东西,至少我只需要在一个地方改变细节:

/**
* Returns the domain User object for the currently logged in user, or null
* if no User is logged in.
* 
* @return User object for the currently logged in user, or null if no User
*         is logged in.
*/
public static User getCurrentUser() {

    Object principal = SecurityContextHolder.getContext().getAuthentication().getPrincipal()

    if (principal instanceof MyUserDetails) return ((MyUserDetails) principal).getUser();

    // principal object is either null or represents anonymous user -
    // neither of which our domain User object can represent - so return null
    return null;
}


/**
 * Utility method to determine if the current user is logged in /
 * authenticated.
 * 

 * Equivalent of calling:
 * 

 * getCurrentUser() != null
 * 
 * @return if user is logged in
 */
public static boolean isLoggedIn() {
    return getCurrentUser() != null;
}

要使它只显示在JSP页面中,您可以使用Spring Security Tag Lib:

http://static.springsource.org/spring-security/site/docs/3.0.x/reference/taglibs.html

要使用任何标记,必须在JSP中声明安全性标记库:

<%@ taglib prefix="security" uri="http://www.springframework.org/security/tags" %>

    logged in as  



    not logged in

@RequestMapping(method = RequestMethod.GET)
public ModelAndView showResults(@AuthenticationPrincipal CustomUser currentUser, HttpServletRequest request) {
    String currentUsername = currentUser.getUsername();
    // ...
}

import javax.servlet.http.HttpServletRequest;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.web.authentication.preauth.RequestHeaderAuthenticationFilter;
import org.springframework.stereotype.Controller;
import org.springframework.ui.Model;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.servlet.support.RequestContext;

import foo.Form;

@Controller
@RequestMapping(value="/welcome")
public class IndexController {

    @RequestMapping(method=RequestMethod.GET)
    public String getCreateForm(Model model, HttpServletRequest request) {

        if(request.getUserPrincipal() != null) {
            String loginName = request.getUserPrincipal().getName();
            System.out.println("loginName : " + loginName );
        }

        model.addAttribute("form", new Form());
        return "welcome";
    }
}

@RequestMapping(method = RequestMethod.GET)    
public String currentUserNameByPrincipal(Principal principal) {
    return principal.getName();
}

@RequestMapping(method = RequestMethod.GET)
public String currentUserNameByAuthentication(Authentication authentication) {
    return authentication.getName();
}

@RequestMapping(method = RequestMethod.GET)    
public String currentUserByHTTPRequest(HttpServletRequest request) {
    return request.getUserPrincipal().getName();

}

public ModelAndView someRequestHandler(@ActiveUser User activeUser) {
  ...
}

request.getRemoteUser();