Grails Spring Security扩展用户属性

Question

我有一个项目，它将成为现有ERP应用程序的附加组件。我已经让SSO正常工作，具有基本的Spring Security设置（请参阅我的票证：Grails和CAS基本设置）。此外，我没有使用s2快速入门。

我对Java开发还是新手，所以请耐心等待。。。我一直在浏览文档和示例，在某些方面，我对所看到的内容感到更困惑。我有几个问题：

1）此设置允许我访问登录用户的用户名，但仅此而已？如何访问User对象以访问这些属性？现在，我正在使用：

def userDetails = springSecurityService.principal
then: userDetails ?.getUsername() to get the username
and: userDetails ?.getAuthorities() to get roles

这一切都正常，除了这是访问这些属性的最佳方式吗？i、 例如，userdetails中是否有其他属性，以及如何访问这些属性？

也许这个问题的答案取决于我下一步该怎么做。。。

2） 我正在使用CAS进行身份验证，但现在我想从LDAP中提取一些附加属性。我尝试过创建这样的自定义UserDetailsServicehttp://grails-plugins.github.io/grails-spring-security-core/docs/manual/guide/userDetailsService.html但即使在我通过了最初的编译错误之后，它似乎仍然需要用户域类。如果我想用附加值扩展UserDetails，我必须实现用户域类吗？

在我的例子中，我真的只需要一个LDAP属性，而这一切似乎需要很多提升才能实现。我看了又看，但找不到一个好的工作/简单的例子来做这件事。。。许多人参与了Gorm或安装了s2 quickstart。

蒂亚，

豆

这是我的配置...见最后的错误：

    grails.plugins.springsecurity.providerNames = ['casAuthenticationProvider']

grails.plugins.springsecurity.cas.active = true
grails.plugins.springsecurity.cas.sendRenew = false
grails.plugins.springsecurity.cas.serverUrlEncoding = 'UTF-8'
grails.plugins.springsecurity.cas.key = 'changeme'

grails.plugins.springsecurity.cas.loginUri = '/login'
grails.plugins.springsecurity.cas.serviceUrl = '${grails.serverURL}/j_spring_cas_security_check'
grails.plugins.springsecurity.cas.serverUrlPrefix = 'https://cas2.mydomain.com:8443/cas'
grails.plugins.springsecurity.cas.proxyCallbackUrl = '${grails.serverURL}/secure/receptor'
grails.plugins.springsecurity.cas.proxyReceptorUrl = '/secure/receptor'

grails.plugins.springsecurity.logout.afterLogoutUrl = 'https://cas2.mydomain.com:8443/cas/logout?service=' + appProtocol + '://cas2.mydomain.com:' + appPort + '/' + appName + '/'

grails.plugins.springsecurity.cas.artifactParameter = 'ticket'
grails.plugins.springsecurity.cas.serviceParameter = 'service'
grails.plugins.springsecurity.cas.filterProcessesUrl = '/j_spring_cas_security_check'
grails.plugins.springsecurity.cas.useSingleSignout = true

grails.server.loopback.url = ""

//Spring Security Core Config

grails.plugins.springsecurity.rejectIfNoRule = false // V.044::to fix redirect loop::true
grails.plugins.springsecurity.securityConfigType = "InterceptUrlMap"
/*
 * Order matters...put the most restrictive first
 */
grails.plugins.springsecurity.interceptUrlMap = [
    '/js/**': ['IS_AUTHENTICATED_ANONYMOUSLY'],
    '/css/**': ['IS_AUTHENTICATED_ANONYMOUSLY'],
    '/images/**': ['IS_AUTHENTICATED_ANONYMOUSLY'],
    '/login/**': ['IS_AUTHENTICATED_ANONYMOUSLY'],
    '/logout/**': ['IS_AUTHENTICATED_ANONYMOUSLY'],
    '/secure/receptor': ['IS_AUTHENTICATED_ANONYMOUSLY'],  // <- allows CAS to contact the receptor
    '/protected/**': ['IS_AUTHENTICATED_FULLY'],
    '/unprotected/**': ['IS_AUTHENTICATED_ANONYMOUSLY','IS_AUTHENTICATED_FULLY'],
    '/filtered/edit':      ["hasRole('ROLE_XYZ')"],
    '/filtered/create': ["authentication.uid == 'criderk'"],
    '/filtered/list': ["hasRole('ROLE_44808')"],
    '/filtered/index': ["hasRole('ROLE_44808')"],
    '/': ['IS_AUTHENTICATED_ANONYMOUSLY','IS_AUTHENTICATED_FULLY']

]


grails.plugins.springsecurity.ldap.search.attributesToReturn = ['uid','mail']

grails.plugins.springsecurity.userLookup.userDomainClassName = 'basecas_04.User'
grails.plugins.springsecurity.userLookup.authorityJoinClassName = 'basecas_04.UserRole'
grails.plugins.springsecurity.authority.className = 'basecas_04.Role'

// Place your Spring DSL code here
beans = {


    // load ldap roles from spring security
    initialDirContextFactory(org.springframework.security.ldap.DefaultSpringSecurityContextSource,
        "ldap://xx.xx.xx.xx:389"){
        userDn = "cn=admin,dc=mydomain,dc=com"
        password = "pw"
    }

    ldapUserSearch(org.springframework.security.ldap.search.FilterBasedLdapUserSearch,
        "ou=employees,dc=mydomain,dc=com", "uid={0}", initialDirContextFactory){

    }

    ldapAuthoritiesPopulator(org.springframework.security.ldap.userdetails.DefaultLdapAuthoritiesPopulator,
        initialDirContextFactory,"ou=groups,dc=mydomain,dc=com"){
          groupRoleAttribute = "gidNumber"
          groupSearchFilter = "memberUid={1}"
          searchSubtree = true
          rolePrefix = "ROLE_"
          convertToUpperCase = true
          ignorePartialResultException = true
    }

    ldapUserDetailsService(org.springframework.security.ldap.userdetails.LdapUserDetailsService,
    ldapUserSearch,
    ldapAuthoritiesPopulator)

    userDetailsService(basecas_04.CustomUserDetailsService)


}

package basecas_04

import org.codehaus.groovy.grails.plugins.springsecurity.GrailsUser
import org.springframework.security.core.GrantedAuthority
import org.springframework.security.core.userdetails.User

class MyUserDetails extends GrailsUser {   

    final String mail   

    MyUserDetails(String username, String password, boolean enabled,
                 boolean accountNonExpired, boolean credentialsNonExpired,
                 boolean accountNonLocked,
                 Collection<GrantedAuthority> authorities,
                 long id, String mail) {

    super(username, password, enabled, accountNonExpired,
            credentialsNonExpired, accountNonLocked, authorities, id)      

    this.mail = mail
   }
}

package basecas_04


import org.codehaus.groovy.grails.plugins.springsecurity.GrailsUser  import org.codehaus.groovy.grails.plugins.springsecurity.GrailsUserDetailsService import org.codehaus.groovy.grails.plugins.springsecurity.SpringSecurityUtils  import org.springframework.security.core.authority.GrantedAuthorityImpl  import org.springframework.security.core.userdetails.UserDetails  import org.springframework.security.core.userdetails.UsernameNotFoundException


import basecas_04.User

class CustomUserDetailsService implements GrailsUserDetailsService {        static final List NO_ROLES = [new GrantedAuthorityImpl(SpringSecurityUtils.NO_ROLE)]            UserDetails loadUserByUsername(String username, boolean loadRoles)      throws UsernameNotFoundException {                  return loadUserByUsername(username)             }           UserDetails loadUserByUsername(String username)     throws UsernameNotFoundException {             
                User.withTransaction { status ->   
                                User user = User.findByUsername(username)                       if (!user)                              throw new UsernameNotFoundException('User not found', username)                 

                        def authorities = user.authorities.collect {
                new GrantedAuthorityImpl(it.authority)          }                         
                        return new MyUserDetails(user.username, user.password, user.enabled, !user.accountExpired,                 
                !user.passwordExpired, !user.accountLocked,                 
                authorities ?: NO_ROLES, user.id, user.mail)                    }           }   }

class User {

    transient springSecurityService

    String username
    String password
    String mail
    //String displayName
    boolean enabled
    boolean accountExpired
    boolean accountLocked
    boolean passwordExpired

    static constraints = {
        username blank: false, unique: true
        password blank: false
    }

    static mapping = {
        password column: '`password`'
    }

    Set<Role> getAuthorities() {
        UserRole.findAllByUser(this).collect { it.role } as Set
    }

    def beforeInsert() {
        encodePassword()
    }

    def beforeUpdate() {
        if (isDirty('password')) {
            encodePassword()
        }
    }

    protected void encodePassword() {
        password = springSecurityService.encodePassword(password)
    }
}

我出错了

2014-02-18 08:37:48,106[超文本传输协议-apr-8444-exec-9]错误错误。GrailsExceptionResolver-处理请求时发生MissingProperty tyException：[GET] /basecas_04/protected/list没有这样的属性：类的id：java.util.concurrent.LdapUserDetailsImpl可能的解决方案： dn。堆栈跟踪如下：basecas_04MissingProperty tyException：没有这样的属性：类的id：xecutor.java:615LdapUserDetailsImpl可能的解决方案： dn在java.lang.SpringSecurityShread.runorker.run的货币用户（SpringSecurityService.groovy:80）。grails.plugin.cache.web.filter.PageFragmentCachingFilter.do过滤器（PageFragmentCachingFilter.java:195）在grails.plugin.cache.web.filter.AbstractFilter.do过滤器（AbstractFilter.java:63）在SingleSignOutFilter.do过滤器（SingleSignOutFilter.java:65）在java.util.concurrent.ThreadPoolExecutor.runWorker（ThreadPoolExecutor.java:1145）在org.springframework.security.ldap.userdetails.ThreadPoolExector$Wgroovy.lang.（ThreadPoolEorg.springframework.security.ldap.userdetails.）在grails.plugins.springsecurity.ervice.get（T

对此有任何想法：

类：org没有这样的属性：id。springframework。安全ldap。用户详细信息。LdapUserDetailsImpl

Answer 1

在Spring Security bean迷宫中导航可能有点困难。好的一面是，一旦你掌握了方向，这就是一个非常强大和灵活的豆子迷宫：）

>

对于#2，此链接可能有助于：http://swordsystems.com/2011/12/21/spring-security-cas-ldap/

Answer 2

你的答案可能在这里：spring-security-ldap（如果你正在使用这个，因为我相信这是你也在使用的？）：https://github.com/grails-plugins/grails-spring-security-ldap/blob/master/src/java/grails/plugin/springsecurity/ldap/userdetails/GrailsLdapUserDetailsManager.java-t

快速搜索：

安全ldap。用户详细信息。LdapUserDetailsManager

返回：

http://docs.spring.io/spring-security/site/docs/3.0.x/apidocs/org/springframework/security/ldap/userdetails/LdapUserDetailsManager.html#loadUserByUsername（java.lang.字符串）

loadUserByUsername

公共UserDetails loadUserByUsername（String username）引发UsernameNotFoundException、DataAccessException

从接口复制的描述：UserDetailsService根据用户名定位用户。在实际实现中，搜索可能不区分大小写，也可能不区分大小写，具体取决于实现实例的配置方式。在这种情况下，返回的UserDetails对象的用户名可能与实际请求的用户名不同。。

Specified by:
    loadUserByUsername in interface UserDetailsService

Parameters:
    username - the username identifying the user whose data is required. 
Returns:
    **a fully populated user record (never null)**