自定义受信任空间的spring安全性

Question

服务工作在可信空间中的网关之后（网关验证OAuth令牌，并只给服务唯一的用户ID，在其他情况下，它重定向认证服务）。

我想在服务中使用spring安全，以能够验证用户ID的权限。

因此，我添加了CustomUserDetailsService

@Service("userDetailsService")
public class CustomUserDetailsService implements UserDetailsService {
    @Autowired(required = false)
    private ContextSsoActiveProfileIdProvider contextSsoActiveProfileIdProvider;
    @Autowired
    private GrantedAuthorityService grantedAuthorityService;

    @Override
    public User loadUserByUsername(final String username) throws UsernameNotFoundException {
        // verify it with authentication service, but there is not token, userId only, so trust to gateway service.
        return new User(
                String.valueOf(contextSsoActiveProfileIdProvider.getSsoActiveProfileId()),
                "authenticatedWithGateWay",
                grantedAuthorityService.getGrantedAuthoritiesForCurrentUser()
        );
    }
}

其中ContextsSOActiveProfileIdProvider.GetsSOActiveProfileId（）返回uniqueUserId,GetGrantedAuthorityService.GetGrantedAuthoritiesForCurrentUser（）返回权限。

服务在受信任区域中启动,因此我以以下方式配置了安全性：

@EnableWebSecurity
@Configuration
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
    @Autowired
    private UserDetailsService userDetailsService;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
                .authorizeRequests()
                .antMatchers("/**").permitAll();
    }

    @Override
    protected UserDetailsService userDetailsService() {
        return userDetailsService;
    }
}

我需要为所有URI(HTTP.AuthorizeRequests().AntMatchers（“/**”）.PermitAll（）；)的所有用户提供自由访问（不触发登录服务），但似乎抑制了对下一个批注@preauthorize、@prefilter、@postauthorize和@postfilter的触发处理程序。

我想我在这里错误地使用了http.authorizeRequests().antmatchers（“/**”）.PermitAll（）；或其他配置部分。

更多问题症状：

• CustomUserDetailsService.LoadUserByUserName(..)从不调用；
• REST API部分@AuthenticationPrincipal User ActiveUser为空
• 在REST API部分principal上也为null

Answer 1

可信空间问题有类似于匿名用户标识的解决方案（我在研究这个问题时已经得出了这个结论）

受信任的空间不需要授权，但不会调用UserDetailsService，因为默认情况下只使用AnonymousAuthenticationProvider和AnonymousAuthenticationFilter。基于AnonymousAuthenticationFilter实现自定义筛选器已经足够好了，它覆盖CreateAuthentication并用自定义筛选器(CustomAnonymousAuthenticationFilter)替换默认值(AnonymousAuthenticationFilter):

    @Configuration
    public static class NoAuthConfigurationAdapter extends WebSecurityConfigurerAdapter {
        @Autowired
        private UserDetailsService userDetailsService;
        @Autowired
        private IdentifiableAnonymousAuthenticationFilter identifiableAnonymousAuthenticationFilter;

        @Override
        protected void configure(HttpSecurity http) throws Exception {
            http.anonymous().authenticationFilter(identifiableAnonymousAuthenticationFilter);
            http.antMatcher("/**").authorizeRequests()
                    .anyRequest().permitAll();
        }
    }

我发现如果user没有得到授权，就永远不会调用CustomUserDetailsService。继续研究的重点是AnonymousAuthenticationFilter，它负责创建匿名用户信息。因此，其根本目的是用my IdentifiableAnonymousAuthenticationFilter替换AnonymousAuthenticationFilter，其中一些方法应该被覆盖：

@Component
public class IdentifiableAnonymousAuthenticationFilter extends AnonymousAuthenticationFilter {
    public static final String KEY_IDENTIFIABLE_ANONYMOUS_AUTHENTICATION_FILTER
            = "Key.IdentifiableAnonymousAuthenticationFilter";
    @Autowired
    private CustomUserDetailsService userDetailsService;
    @Autowired
    private GrantedAuthorityService grantedAuthorityService;
    private AuthenticationDetailsSource authenticationDetailsSource
            = new WebAuthenticationDetailsSource();

    public IdentifiableAnonymousAuthenticationFilter() {
        this(KEY_IDENTIFIABLE_ANONYMOUS_AUTHENTICATION_FILTER);
    }

    public IdentifiableAnonymousAuthenticationFilter(String key) {
        super(key);
    }

    @Override
    protected Authentication createAuthentication(HttpServletRequest request) {
        AnonymousAuthenticationToken auth = new AnonymousAuthenticationToken(
                KEY_IDENTIFIABLE_ANONYMOUS_AUTHENTICATION_FILTER,
                userDetailsService.loadCurrentUser(request),
                grantedAuthorityService.getGrantedAuthoritiesForCurrentUser());
        auth.setDetails(authenticationDetailsSource.buildDetails(request));
        return auth;
    }
}

将其注入配置

@Configuration
public class IdentifyAnonymousConfigurationAdapter extends WebSecurityConfigurerAdapter {
    @Autowired
    private IdentifiableAnonymousAuthenticationFilter identifiableAnonymousAuthenticationFilter;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.anonymous().authenticationFilter(identifiableAnonymousAuthenticationFilter);
    // ... some other configurations
    }
}

现在看来要好得多，因为identifiableAnonymousAuthenticationFilter被注入到AnonymousConfigurer中。请注意基于WebSecurityConfigurerAdapter的配置。如果您只有几个，并且其中一个不会设置customAnonymousAuthenticationFilter，但配置得早于Custom..您将获得AnonymousAuthenticationFilter的默认实例（默认情况下在WebSecurityConfigurerAdapter中配置）：

  protected final HttpSecurity getHttp() throws Exception {
      //...
      http
        .csrf().and()
        .addFilter(new WebAsyncManagerIntegrationFilter())
        .exceptionHandling().and()
        .headers().and()
        .sessionManagement().and()
        .securityContext().and()
        .requestCache().and()
        .anonymous().and()
      // ...

如果应用程序被修复，我不会关心它，但是AnonymousAuthenticationFilter调用的时间早于IdentifiableAnonymousAuthenticationFilter。和doFilter将不正确身份验证放入SecurityContextHolder。

public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {
    if(SecurityContextHolder.getContext().getAuthentication() == null) {
        SecurityContextHolder.getContext().setAuthentication(this.createAuthentication((HttpServletRequest)req));
        if(this.logger.isDebugEnabled()) {
            this.logger.debug("Populated SecurityContextHolder with anonymous token: '" + SecurityContextHolder.getContext().getAuthentication() + "'");
        }
    } else if(this.logger.isDebugEnabled()) {
        this.logger.debug("SecurityContextHolder not populated with anonymous token, as it already contained: '" + SecurityContextHolder.getContext().getAuthentication() + "'");
    }

    chain.doFilter(req, res);
}

因此，当下次为IdentifiableAnonymousAuthenticationFilter调用doFilter时，由于条件if(SecurityContextHolder.getContext().getAuthentication()==null)（请参阅前面的方法），它不会替换Authentication。

因此，使用magic annotation@Order来管理配置加载顺序，为WebSecurityConfigurerAdapter配置提供修复配置将是非常好的。

或者有人会想--在IdentifiableAnonymousAuthenticationFilter中无条件添加doFilter重写（这是黑客）：

    @Override
    public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
            throws IOException, ServletException {
        SecurityContextHolder.getContext().setAuthentication(createAuthentication((HttpServletRequest) req));
        if (logger.isDebugEnabled()) {
            logger.debug("Populated SecurityContextHolder with anonymous token: '"
                    + SecurityContextHolder.getContext().getAuthentication() + "'");
        }
        chain.doFilter(req, res);
    }

如果您需要处理授权/身份验证用户的spring安全，这是不可接受的，但在某些情况下，这就足够了。

解决办法的某些部分可以改进，但我希望这个想法总体上是清楚的。