在Spring启动安全系统中关闭授权服务时的授权错误处理

Question

在我的spring boot web应用程序中，我使用了第三方服务进行授权，我的应用程序只是一个内容提供商。父应用程序使用site minder进行身份验证。我的应用程序在头中获取用户Id，并调用第三方api设置具有权限的UserDetails。

我的要求是处理场景时，第三方服务的授权是关闭。目前，在本例中，我将UserDetails设置为没有角色，因为每个endpoint都被授权绑定，所以如果授权的第三方服务关闭，我将得到403。

但我想显示不同的消息，如果用户缺乏授权和授权服务关闭。

public class WebSecurityCustomConfig extends WebSecurityConfigAdapter {
 private UserDetailsService userDetails;
 protected void configure(HttpSecurity http) {
   http.csrf().disable().authorizeRequests().antMatchers("/*).permitAll()
   .anyRequests()
   .hasAnyAuthority("MODULEX","MODULEY");

 http.addFilterBefore(requestHeaderAuthFilter(), 
   BasicAuthenticationFilter.class);
    http.exceptionHandling().authenticationEntryPoint(customEntryPoint());
 }

 protect void configure(AuthenticationManagerBuilder builder) {
   PreAuthenticaticatedAuthenticationProvider auth = new 
             PreAuthenticaticatedAuthenticationProvider ();
  auth.setPreAuthenticatedUserDetailsService(new 
      UserDetailsByNameServiceWrapper<>(userDetails));
  }
 }

  public class CustomUserDetailsService implements UserDetailsService {
    private final AuthorizationService authService;
    @Inject
     public CustoUserDetailsService(AuthorizationService authService) {
       this.authService = authService;
       }
       public UserDetails loadUserByUsername(String username) {
         return new User(username, "", 
                 authService.getAuthorities(username));  
        // authService is a  third party jar and if their upstream service 
           //is down , it throws a runtime exception
      }
      }

当前处理auth服务异常

     public UserDetails loadUserByUsername(String username) {
         try{
         return new User(username, "", 
                 authService.getAuthorities(username));  
       }
          catch(AuthServiceException e) {
               return new User(username, "", 
                 Collections.emptyList());  
               } 
      }

Answer 1

实现authenticationentrypoint并重写commentence()方法，如下所示。

public class RestAuthenticationEntryPoint implements AuthenticationEntryPoint {

    @Override
    public void commence(
            HttpServletRequest request, 
            HttpServletResponse response, 
            AuthenticationException authException) throws IOException, ServletException {

        response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Unauthorized");

    }

}

然后，在WebSecurityCustomConfig类中创建一个方法，初始化RestAuthenticationEntryPoint类，如下所示。

public AuthenticationEntryPoint authenticationEntryPoint() {
    RestAuthenticationEntryPoint ep = new RestAuthenticationEntryPoint();
    return ep;
}

然后将以下行更改为http.exceptionHandling().authenticationEntryPoint（customEntryPoint（））；
改为
http.exceptionHandling().authenticationEntryPoint（authenticationEntryPoint（））；