Spring Boot安全性LDAP身份验证

Question

@Configuration
@EnableWebSecurity
@Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {

        http.httpBasic().and().authorizeRequests().antMatchers("/**").permitAll()
            .anyRequest().authenticated()
            .and().formLogin().loginPage("/login")
            .usernameParameter("username")
            .passwordParameter("password")
            .failureUrl("/login?error");

    }

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        auth
            .ldapAuthentication()
                .userDnPatterns("uid={0},ou=people")
                .groupSearchBase("ou=groups")
                .contextSource().ldif("classpath:test-server.ldif");
    }
}

Answer 1

您应该将代码更改为以下内容：

   @Override
   protected void configure(HttpSecurity http) throws Exception {
   http.httpBasic().and().authorizeRequests()
   .anyRequest().authenticated()
   .and().formLogin().loginPage("/login")
   .usernameParameter("username")
   .passwordParameter("password")
   .failureUrl("/login?error");

通过放入

.antMatchers("/**").permitAll()

您只允许每个用户访问每个页面而不需要任何身份验证。