上下文注入的SecurityContext为空

Question

@Context
private SecurityContext secContext;

@RequestScoped
public class CurrentUserProducer implements Serializable {

    /**
     * Default
     */
    private static final long serialVersionUID = 1L;

    @Context
    private SecurityContext secContext;

    /**
     * Tries to find logged in user in user db (by name) and returns it. If not
     * found a new user with role {@link UserRole#USER} is created.
     * 
     * @return found user a new user with role user
     */
    @Produces
    @CurrentUser
    public User getCurrentUser() {
        if (secContext == null) {
            throw new IllegalStateException("Can't inject security context - security context is null.");
        //... code to retrieve or create new user
        return user;
    }

}

那么如何解决这个问题呢？为什么SecurityContext为空。

Answer 1

正如我在评论中所说的

SecurityContext是一个JAX-RS组件，只能注入到其他JAX-RS组件中。你只有一个CDI豆。您可以尝试使其成为一个EJB，并注入SessionContext。请参见以编程方式保护企业Bean

还没有测试，但似乎为行动工作。这是一个EE堆栈解决方案。

@Provider
public class UserContextFilter implements ContainerRequestFilter {

    @Override
    public void filter(ContainerRequestContext context) throws IOException {
        SecurityContext securityContext = context.getSecurityContext();
        String username = securityContext.getUserPrincipal().getName();

        ResteasyProviderFactory.pushContext(User.class, new User(username));
    }  
}