身份验证Manager.authenticate方法没有被调用

Question

我试图按照API密钥身份验证代码从这个答案：https://stackoverflow.com/a/48448901

我创建了我的过滤器类：

package com.propfinancing.CADData.web;

import javax.servlet.http.HttpServletRequest;
import org.slf4j.LoggerFactory;
import org.springframework.security.web.authentication.preauth.AbstractPreAuthenticatedProcessingFilter;

public class PullAPIKeyFromHeaderFilter extends AbstractPreAuthenticatedProcessingFilter {
  private String apiKeyHeaderName;
  
  public PullAPIKeyFromHeaderFilter(String apiKeyHeaderName) {
    this.apiKeyHeaderName = apiKeyHeaderName;
  }
  
  @Override
  protected Object getPreAuthenticatedPrincipal(HttpServletRequest request) {
    String headerValue = request.getHeader(apiKeyHeaderName);
    return request.getHeader(headerValue);
  }

  @Override
  protected Object getPreAuthenticatedCredentials(HttpServletRequest request) {
    return apiKeyHeaderName;
  }
}

然后我实现了我的安全配置：

package com.propfinancing.CADData.web;

import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.annotation.Order;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.BadCredentialsException;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.annotation.web.configurers.ExpressionUrlAuthorizationConfigurer;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;

@Configuration
@EnableWebSecurity
@Order(1)
public class APIKeySecurityConfig extends WebSecurityConfigurerAdapter {
  @Value("${caddata.apiKey.header.name}")
  private String apiKeyHeaderName;

  @Value("${caddata.apiKey}")
  private String apiKey;

  @Override
  protected void configure(HttpSecurity httpSecurity) throws Exception {
    PullAPIKeyFromHeaderFilter pullAPIKeyFromHeaderfilter = new PullAPIKeyFromHeaderFilter(apiKeyHeaderName);
    
    AuthenticationManager authManager = new AuthenticationManager() {
      @Override
      public Authentication authenticate(Authentication authentication) 
      throws AuthenticationException {
        String principal = (String) authentication.getPrincipal();
        if (!apiKey.equals(principal))
          throw new BadCredentialsException("Invalid API key");
        authentication.setAuthenticated(true);
        return authentication;
      }
    };
    pullAPIKeyFromHeaderfilter.setAuthenticationManager(authManager);
    
    httpSecurity.antMatcher("/**");
    httpSecurity.addFilter(pullAPIKeyFromHeaderfilter);
    httpSecurity.requiresChannel().anyRequest().requiresSecure();
    httpSecurity.csrf().disable();
    httpSecurity.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
    ExpressionUrlAuthorizationConfigurer<HttpSecurity>.ExpressionInterceptUrlRegistry urlAuthConfigurer = httpSecurity.authorizeRequests();
    ExpressionUrlAuthorizationConfigurer<HttpSecurity>.AuthorizedUrl authorizedUrl = urlAuthConfigurer.anyRequest();
    authorizedUrl.authenticated();
  }
}

当我用头作为请求的一部分对应用程序进行外部调用时，我得到一个403禁止响应。我可以看到过滤器从头中拉出键。这部分正在工作。

但是，不会调用authenticate（）方法来检查头是否有效。我不确定我错过了什么，代码在我看来是一样的。

有什么想法吗？

Answer 1

我无法让上面的代码正常工作，但我改变了它，在该线程上使用了第二个答案https://stackoverflow.com/a/63852212正如预期的那样。

Answer 2

看起来基类不对https://docs.spring.io/spring-security/site/docs/4.0.x/apidocs/org/springframework/security/web/authentication/preauth/AbstractPreAuthenticatedProcessingFilter.html :

这样做的目的只是从传入的请求中提取有关主体的必要信息，而不是对它们进行身份验证。

试着扩展https://docs.spring.io/spring-security/site/docs/4.0.x/apidocs/org/springframework/security/web/authentication/AbstractAuthenticationProcessingFilter.html。