ProviderManager。针对BadCredentialsException调用了两次身份验证

Question

Spring 4.1和Spring Security 3.2：我们实现了一个自定义身份验证提供程序，如果用户输入了错误的密码，它会抛出一个Bad凭据异常。当抛出Bad凭据异常时，将调用ProviderManager.authenticate方法，该方法将再次调用自定义身份验证中的身份验证方法。当抛出LockedException时，不会再次调用自定义身份验证提供程序中的Authenate方法。我们计划保留登录尝试次数的计数，因此我们不希望身份验证方法被调用两次。有人知道为什么自定义身份验证类中的身份验证方法会被调用两次吗？

WebConfig:


  @Configuration
@EnableWebMvcSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private CustomAuthenticationProvider customAuthenticationProvider;

    @Autowired
    private AMCiUserDetailsService userDetailsService;

    @Autowired
    private CustomImpersonateFailureHandler impersonateFailureHandler;

    @Autowired
    private LoginFailureHandler loginFailureHandler;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .csrf().disable()
            .authorizeRequests()
                .antMatchers("/jsp/*.css","/jsp/*.js","/images/**").permitAll()  
                .antMatchers("/login/impersonate*").access("hasRole('ADMIN') or hasRole('ROLE_PREVIOUS_ADMINISTRATOR')") 
                .anyRequest().authenticated()                                    
                .and()
            .formLogin()
                .loginPage("/login.jsp")
                .defaultSuccessUrl("/jsp/Home.jsp",true)                
                .loginProcessingUrl("/login.jsp")                                 
                .failureHandler(loginFailureHandler)
                .permitAll()
                .and()
            .logout()
                .logoutSuccessUrl("/login.jsp?msg=1")
                .permitAll()
                .and()
            .addFilter(switchUserFilter())
            .authenticationProvider(customAuthenticationProvider);

            http.exceptionHandling().accessDeniedPage("/jsp/SecurityViolation.jsp");  //if user not authorized to a page, automatically forward them to this page.
            http.headers().addHeaderWriter(new XFrameOptionsHeaderWriter(XFrameOptionsMode.SAMEORIGIN)); 
    }


    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.authenticationProvider(customAuthenticationProvider);
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    //Used for the impersonate functionality
    @Bean CustomSwitchUserFilter switchUserFilter() {
        CustomSwitchUserFilter filter = new CustomSwitchUserFilter();
        filter.setUserDetailsService(userDetailsService);
        filter.setTargetUrl("/jsp/Impersonate.jsp?msg=0");
        filter.setSwitchUserUrl("/login/impersonate");
        filter.setExitUserUrl("/logout/impersonate");
        filter.setFailureHandler(impersonateFailureHandler);
        return filter;
    }
}

自定义身份验证提供程序：

@Component
public class CustomAuthenticationProvider implements AuthenticationProvider {

    @Autowired(required = true)
    private HttpServletRequest request;

    @Autowired
    private AMCiUserDetailsService userService;

    @Autowired
    private PasswordEncoder encoder;

    public Authentication authenticate(Authentication authentication) throws AuthenticationException {

        String username = authentication.getName().trim();
        String password = ((String) authentication.getCredentials()).trim();
        if (StringUtils.isEmpty(username) || StringUtils.isEmpty(password)) {
            throw new BadCredentialsException("Login failed! Please try again.");
        }


        UserDetails user;
        try {
            user = userService.loadUserByUsername(username);
            //log successful attempt
            auditLoginBean.setComment("Login Successful");
            auditLoginBean.insert(); 
        } catch (Exception e) {
             try {
                //log unsuccessful attempt
                auditLoginBean.setComment("Login Unsuccessful");
                auditLoginBean.insert();
             } catch (Exception e1) {
                // TODO Auto-generated catch block
             }
            throw new BadCredentialsException("Please enter a valid username and password.");
        }

        if (!encoder.matches(password, user.getPassword().trim())) {
            throw new BadCredentialsException("Please enter a valid username and password.");
        }

        if (!user.isEnabled()) {
            throw new DisabledException("Please enter a valid username and password.");
        }

        if (!user.isAccountNonLocked()) {
            throw new LockedException("Account locked. ");
        }

        Collection<? extends GrantedAuthority> authorities = user.getAuthorities();
        List<GrantedAuthority> permlist = new ArrayList<GrantedAuthority>(authorities);

        return new UsernamePasswordAuthenticationToken(user, password, permlist);
    }


    public boolean supports(Class<? extends Object> authentication) {
        return (UsernamePasswordAuthenticationToken.class.isAssignableFrom(authentication));
    }

Answer 1

可能有一种情况，您没有覆盖configure（AuthenticationManagerBuilder），但仍然相同的AuthenticationProver的Authentication方法会被调用两次，就像菲尔在接受的答案中的评论中提到的那样。

那是为什么呢？

原因是，当您不重写configure（AuthenticationManagerBuilder）并拥有AuthenticationProviderbean时，它将由Spring Security注册，您不必做任何其他事情。

但是，当重写配置（AuthenticationManagerBuilder）时，Spring Security会调用它，并且不会尝试自行注册任何提供程序。如果您好奇，可以查看相关方法。disableLocalConfigreAuthentiationBldr如果您重写confiure（AuthentiationManagerBuilder）则为真。

因此，简单地说，如果您只想注册一个自定义AuthenticationProvider，那么请不要覆盖配置（AuthenticationManagerBuilder），不要调用身份验证提供者（AuthenticationProvider）在配置（HttpSecurity）中，只需通过注释@Component使您的AuthentiationProviver实现bean，您就可以开始了。

Answer 2

原因是您添加了两次身份验证提供程序，一次在configure（HttpSecurity）中，一次在configure（AuthenticationManagerBuilder）中。这将创建一个带有两项的ProviderManager，这两项都是您的提供者。

在处理身份验证时，将按顺序询问提供者，直到成功，除非抛出锁定异常或类似的状态异常，否则循环将中断。