Spring Security无法捕捉ApplicationListener中的登录失败

Question

@Component
public class MyApplicationListener implements ApplicationListener<AbstractAuthenticationEvent> {

    private static Logger logger = LogManager.getLogger(MyApplicationListener);

    @Override
    public void onApplicationEvent(AbstractAuthenticationEvent abstractAuthenticationEvent) {

        if (abstractAuthenticationEvent instanceof AbstractAuthenticationFailureEvent) {

            logger.warn("Detected an invalid login");

        } else if (abstractAuthenticationEvent instanceof AuthenticationSuccessEvent) {

            logger.info("A user logged in successfully");
        }
    }
}

我更改了监听器，以便它记录所有applicationevent，如下所示：

@Component
public class MyApplicationListener implements ApplicationListener<ApplicationEvent> {

    private static Logger logger = LogManager.getLogger(MyApplicationListener);

    @Override
    public void onApplicationEvent(ApplicationEvent applicationEvent) {

        logger.info("Got an event of type {}", applicationEvent.getClass());
    }
}

但是，记录的唯一与安全相关的事件类型为org.springframework.security.authentication.event.InteractiveAuthenticationSuccessEvent。失败的登录不会触发任何事件。我会很感激你的指点，谢谢。

Answer 1

也许有点晚了，但我得到了同样的问题，并以这种方式解决它：

在configureGlobal方法中:auth.AuthenticationEventPublisher（defaultAuthenticationEventPublisher（））；

不要忘记将DefaultAuthenticationEventPublisher声明为Bean

@Bean
public DefaultAuthenticationEventPublisher defaultAuthenticationEventPublisher(){
    return new DefaultAuthenticationEventPublisher();
}