Spring Security 5和JSF 2.2 Bean身份验证

Question

我必须使用jsf配置Spring Security 5，此下面的代码在Spring Security 4中工作正常，但当我迁移到版本5时，身份验证过程不会触发：

登录表单如下所示：

<h:form id="loginForm" prependId="false">
    <p:messages autoUpdate="true" showDetail="false" showSummary="true" showIcon="false" />
    <div class="ui-fluid">
        <p:panelGrid columns="1" layout="grid" styleClass="ui-panelgrid-blank">
            <h:outputLabel for="username" value="#{msg['login.login']}" />
            <p:inputText id="username" value="#{userBean.userDTO.username}" required="true" requiredMessage="#{msg['login.login.required']}" label="#{msg['login.login']}" />

            <h:outputLabel for="password" value="#{msg['login.password']}" />
            <p:password id="password" required="true" feedback="false" label="#{msg['login.password']}" requiredMessage="#{msg['login.password.required']}" />
            <p:spacer />
            <p:commandButton type="submit" value="#{msg['login.btn']}" action="#{userBean.doLogin}" ajax="false" />
        </p:panelGrid>
    </div>
</h:form>

JSF Bean：

public String doLogin() throws ServletException, IOException {
    ExternalContext context = FacesContext.getCurrentInstance().getExternalContext();
    RequestDispatcher dispatcher = ((ServletRequest) context.getRequest()).getRequestDispatcher("/login");
    dispatcher.forward((ServletRequest) context.getRequest(), (ServletResponse) context.getResponse());
    FacesContext.getCurrentInstance().responseComplete();
    Authentication auth = SecurityContextHolder.getContext().getAuthentication();
    if (auth != null && !(auth instanceof AnonymousAuthenticationToken) && auth.isAuthenticated()) {
        logDebug(LOGGER, getPartCodeLoggedPartner(), "Authentification");
        UserSecurity userSecurity = (UserSecurity) ((Authentication) auth).getPrincipal();
        setUserRight(getLoggedUser(), userSecurity);
    }
    return "";
}

以及安全配置：

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    /** The utilisateur service. */
    @Autowired
    private UserDetailsService utilisateurService;

    /*
     * (non-Javadoc)
     * 
     * @see org.springframework.security.config.annotation.web.configuration.
     * WebSecurityConfigurerAdapter#configure(org.springframework.security.
     * config.annotation.web.builders.HttpSecurity)
     */

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        // require all requests to be authenticated except for the resources
        http.authorizeRequests().antMatchers("/javax.faces.resource/**", "/resources/**", "/index.jsp", "/views/login.jsf", "/pages/public/**").permitAll().anyRequest().authenticated();
        // login
        http.formLogin().loginPage("/views/login.jsf").loginProcessingUrl("/login").usernameParameter("username").passwordParameter("password").failureUrl("/views/login.jsf?error=true")
                .defaultSuccessUrl("/views/home.jsf");
        // logout
        http.logout().logoutUrl("/logout").invalidateHttpSession(true).logoutSuccessUrl("/views/login.jsf");
        // not needed as JSF 2.2 is implicitly protected against CSRF
        http.csrf().disable();
    }

    /**
     * Md 5 password encoder.
     *
     * @return the message digest password encoder
     */
    @Bean
    public MessageDigestPasswordEncoder md5PasswordEncoder() {
        return new MessageDigestPasswordEncoder("MD5");
    }

    /**
     * Configure global.
     *
     * @param auth
     *            the auth
     * @throws Exception
     *             the exception
     */
    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        // Setting Service to find User in the database.
        // And Setting PassswordEncoder
        auth.userDetailsService(utilisateurService).passwordEncoder(md5PasswordEncoder());

    }
}

当我提交登录表单时，身份验证未被触发！我在这个配置中忘记了什么吗？

在Spring Security 4中，触发登录和注销的操作如下所示：

            ExternalContext context = FacesContext.getCurrentInstance().getExternalContext();
            RequestDispatcher dispatcher = ((ServletRequest) context.getRequest()).getRequestDispatcher("/j_spring_security_login");
            dispatcher.forward((ServletRequest) context.getRequest(), (ServletResponse) context.getResponse());
            FacesContext.getCurrentInstance().responseComplete();

和注销：

            ExternalContext context = FacesContext.getCurrentInstance().getExternalContext();
            RequestDispatcher dispatcher = ((ServletRequest) context.getRequest()).getRequestDispatcher("/j_spring_security_logout");
            dispatcher.forward((ServletRequest) context.getRequest(), (ServletResponse) context.getResponse());
            FacesContext.getCurrentInstance().responseComplete();
            context.invalidateSession();

我尝试将j_spring_security_登录改为登录，将j_spring_security_注销改为注销，但不起作用

Answer 1

我知道这很古老，但我在Spring boot安全性和JSF方面遇到了同样的问题。

基于@molhorm回答，你只需声明过滤链即可转发！

把这个放在你的web.xml

<filter>
    <filter-name>springSecurityFilterChain</filter-name>
    <filter-class>
        org.springframework.web.filter.DelegatingFilterProxy
    </filter-class>
</filter>
<filter-mapping>
    <filter-name>springSecurityFilterChain</filter-name>
    <url-pattern>/*</url-pattern>
    <dispatcher>FORWARD</dispatcher>
    <dispatcher>REQUEST</dispatcher>
</filter-mapping>

它应该会起作用。

Answer 2

我认为问题可能是Spring Security 5过滤器链不再具有用于转发的默认调度程序映射。我没有找到一种简单的方法在Java配置中添加这个映射，所以我最终直接在doLogin方法中使用authenticationProvider来修复它。

替换：

RequestDispatcher requestDispatcher = ((ServletRequest) externalContext.getRequest()).getRequestDispatcher("/login");
requestDispatcher.forward((ServletRequest) externalContext.getRequest(), (ServletResponse) externalContext.getResponse());
FacesContext.getCurrentInstance().responseComplete();

有了这个：

try {
    UsernamePasswordAuthenticationToken authenticationToken = new UsernamePasswordAuthenticationToken( username, password ); 
    Authentication authentication = authenticationProvider.authenticate(authenticationToken);
    SecurityContextHolder.getContext().setAuthentication(authentication);
} catch (Exception e) {
    LOGGER.error("Login failed");
    SecurityContextHolder.getContext().setAuthentication(null);
}

    authentication.isAuthenticated()...