手动验证使用Spring安全性

Question

我正在使用Spring Security性，它工作正常，但现在我想手动启动安全过程，对客户端进行更改，我需要在我的控制器中获取用户名和密码（表单不会直接调用“j_spring_security_check”）

我想到了两个选项，我有一些问题：

>

在我得到参数并做了一些事情之后，我将向j_spring_security_checkurl发送一个post请求。我的代码：

公共无效测试(loginDTO loginDTO) {

MultiValueMap<String, String> body = new LinkedMultiValueMap<String, String>();
HttpHeaders headers = new HttpHeaders();

body.add(
     "j_username",
     loginDTO.getJ_username());

body.add(
     "j_password",
     loginDTO.getJ_password());

HttpEntity<?> httpEntity = new HttpEntity<Object>(
                          body, headers);
headers.add(
        "Accept",
        MediaType.APPLICATION_JSON_VALUE);
restTemplate.exchange(
              "http://localhost:8080/XXX/j_spring_security_check",
              HttpMethod.POST,
              httpEntity,
              HttpServletResponse.class);
} 

这不工作，我得到:500内部服务器错误，为什么？

>

第二个选项-我执行了以下操作：

public void test2(loginDTO loginDTO, HttpServletRequest request) {

  UsernamePasswordAuthenticationToken token =
                new UsernamePasswordAuthenticationToken(
                          loginDTO.getJ_username(),
                          loginDTO.getJ_password());

  token.setDetails(new WebAuthenticationDetails(request));
  Authentication authentication = this.authenticate(token);

  SecurityContextHolder.getContext().setAuthentication(authentication);

  this.sessionRegistry.registerNewSession(
                    request.getSession().getId(),
                    authentication.getPrincipal());
}

问题是在身份验证上没有调用成功。感觉不对，我错过了使用Spring安全的意义。

正确的原因是什么？

Answer 1

好吧，所以我结合了@Ralph和@manish答案，这就是我所做的：

（二角色身份验证筛选是用户名密码身份验证筛选的扩展）

 public void manualAuthentication(loginDTO loginDTO, HttpServletRequest request, HttpServletResponse response) throws IOException,
        ServletException {

    AddableHttpRequest addableHttpRequest = new AddableHttpRequest(
                                       request);

    addableHttpRequest.addParameter(
                    "j_username",
                    loginDTO.getJ_username());
    addableHttpRequest.addParameter(
                    "j_password",
                    loginDTO.getJ_password());

    UsernamePasswordAuthenticationToken token = (UsernamePasswordAuthenticationToken) twoFactorAuthenticationFilter.attemptAuthentication(
                                                                          addableHttpRequest,
                                                                          response);
    if (token.isAuthenticated()) {
        twoFactorAuthenticationFilter.successfulAuthentication(
                                   addableHttpRequest,
                                   response,
                                   null,
                                   token);
    }


    }

它工作正常

Answer 2

当您想尽可能多地使用正常的身份验证过程时，您可以创建一个包含登录名和密码的mockedHttpServletRequest和HttpServletResponse（org.springframework.mock.web.MockHttpServletRequest和org.springframework.mock.web.MockHttpServletResponse），然后调用

 UsernamePasswordAuthenticationFilter.attemptAuthentication(
            HttpServletRequest request,
            HttpServletResponse response)`

之后，您还需要调用SessionAuthenticationStrategy.onAuthentication（…）和成功身份验证（…）

由于私人领域，这有点棘手，所以这是我的解决方案：

public class ExtendedUsernamePasswordAuthenticationFilter
                           extends UsernamePasswordAuthenticationFilter {


    @Override
    public void manualAuthentication(String login,
                                     String password,
                                     HttpServletRequest httpServletRequest)
                              throws IOException, ServletException {

        /** I do not mock the request, I use the existing request and
            manipulate them*/
        AddableHttpRequest addableHttpRequest =
                                  new AddableHttpRequest(httpServletRequest);
        addableHttpRequest.addParameter("j_username", login);
        addableHttpRequest.addParameter("j_password", password);

        MockHttpServletResponse mockServletResponse =
                                  new MockHttpServletResponse();
        Authentication authentication = this.attemptAuthentication(
                                                addableHttpRequest,
                                                mockServletResponse);

        this.reflectSessionStrategy().onAuthentication(
                                        authentication,
                                        addableHttpRequest,
                                        mockServletResponse);
        this.successfulAuthentication(addableHttpRequest,
                                      mockServletResponse,
                                      authentication);
    }

    private SessionAuthenticationStrategy reflectSessionStrategy() {

        Field sessionStrategyField =
                      ReflectionUtils.findField(
                             AbstractAuthenticationProcessingFilter.class,
                             "sessionStrategy",
                             SessionAuthenticationStrategy.class);
        ReflectionUtils.makeAccessible(sessionStrategyField);

        return (SessionAuthenticationStrategy)
               ReflectionUtils.getField(sessionStrategyField, this);
    }
}

< code>AddableHttpRequest就像一个基于真实请求的模拟

public class AddableHttpRequest extends HttpServletRequestWrapper {

    /** The params. */
    private HashMap<String, String> params = new HashMap<String, String>();


    public AddableHttpRequest(HttpServletRequest request) {
        super(request);
    }

    @Override
    public String getMethod() {
        return "POST";
    }

    @Override
    public String getParameter(final String name) {
        // if we added one, return that one
        if (params.get(name) != null) {
            return params.get(name);
        }
        // otherwise return what's in the original request
        return super.getParameter(name);
    }

    public void addParameter(String name, String value) {
        params.put(name, value);
    }    
}

另一种方法是实现您自己的身份验证过滤器。这是一个调用身份验证管理器的类。.但是这个类也负责调用有关身份验证的所有内容（抽象身份验证处理过滤器.doFilter所做的）”

Answer 3

我通常会做以下事情：

@Controller
public class AuthenticationController
{
  @Autowired
  AuthenticationManager authenticationManager;

  @Autowired
  SecurityContextRepository securityContextRepository;

  @RequestMapping(method = Array(RequestMethod.POST), value = Array("/authenticate"))
  public String authenticate(@RequestParam String username, @RequestParam String password, HttpServletRequest request, HttpServletResponse response)
  {
    Authentication result = this.authenticationManager.authenticate(new UsernamePasswordAuthenticationToken(username, password));

    SecurityContextHolder.getContext.setAuthentication(result);

    this.securityContextRepository.saveContext(SecurityContextHolder.getContext(), request, response);

    return "successView";
  }
}

使用这种方法的原因是：

1. 非常简单，如果您忽略异常处理等，只需几行代码。
2. 利用现有的Spring Security组件。
3. 使用应用程序配置中配置的Spring Security组件，并允许在需要时更改它们。例如，可以针对RDBMS、LDAP、Web服务、Active Directory等进行身份验证，而无需自定义代码担心。