将JSF登录页面与Spring Security集成

Question

我正在尝试将JSF Web应用程序与Spring Security集成。

目前我正在通过一种方法登录：在此方法中进行身份验证并根据用户重定向到目标页面。

登录页面（Login.xhtml）：

 <h:form id="login">
   <h:outputLabel for="email" value="E-mail: "/> 
   <p:inputText id="email" value="#{loginManagedBean.usuario.email}" required="true"/>
   <p:message for="email"/>

   <h:outputLabel for="pass" value="Contraseña: "/>                
   <p:password id="pass" value="#{loginManagedBean.usuario.password}" required="true"/>
   <p:message for="pass"/>

   <!-- <input type="hidden" name="${_csrf.parameterName}" value="${_csrf.token}"/> -->

   <p:commandButton value="Login" update="@form" action="#{loginManagedBean.autenticar()}"/>
 </h:form>

loginManagedBean。autenticar（）（身份验证和重定向的方法）：

如何替换此页面和方法以使用SpringSecurity？

SpringSecurityConfig：

@Override
protected void configure(HttpSecurity http) throws Exception {

    //.csrf() is optional, enabled by default, if using WebSecurityConfigurerAdapter constructor
    // Have to disable it for POST methods:
    // http://stackoverflow.com/a/20608149/1199132
    http.csrf().disable();

    // Logout and redirection:
    // http://stackoverflow.com/a/24987207/1199132
    http
            .logout()
            .logoutRequestMatcher(new AntPathRequestMatcher("/logout"))
            .deleteCookies("JSESSIONID")
            .invalidateHttpSession(true)
            .logoutSuccessUrl("/login.xhtml");

    http
            .authorizeRequests()
            //Permit access for all to error and denied views
            .antMatchers("/WEB-INF/errorpages/general.xhtml", "/WEB-INF/errorpages/accessDenied.xhtml", "/WEB-INF/errorpages/expired.html", "/login.xhtml")
            .permitAll()
            // Only access with admin role
            .antMatchers("/admin/**")
            .hasRole("ADMIN")
            //Permit access only for some roles
            .antMatchers("/alumno/**")
            .hasRole("ALUMNO")
            //Permit access only for some roles
            .antMatchers("/profesor/**")
            .hasRole("PROFESOR")
            //If user doesn't have permission, forward him to login page
            .and()
            .formLogin()
            .loginPage("/login.xhtml")
            .usernameParameter("login:email")
            .passwordParameter("login:pass")
            .loginProcessingUrl("/login") //
            .defaultSuccessUrl("/admin/homeAdmin.xhtml")
            .and()
            .exceptionHandling()
            .accessDeniedPage("/WEB-INF/errorpages/accessDenied.xhtml");
}

Answer 1

登录按钮操作应该首先像这样执行重定向，并将流传递给spring security。

ExternalContext context = FacesContext.getCurrentInstance().getExternalContext();
RequestDispatcher dispatcher = ((ServletRequest) context.getRequest()).getRequestDispatcher("/login");
dispatcher.forward((ServletRequest) context.getRequest(), (ServletResponse) context.getResponse());
FacesContext.getCurrentInstance().responseComplete();

Answer 2

我不希望使用JSF进行身份验证，而是使用普通HTML表单（之前配置了身份验证入口点）：

<form action="#{request.contextPath}/j_spring_security_check"
    method="post">
    <h:panelGrid styleClass="centered tight-grid" columns="2">
        <p:outputLabel>Usuario</p:outputLabel>
        <input type="text" id="username" name="username"
            required="required" />
        <p:outputLabel>Contraseña</p:outputLabel>
        <input type="password" id="password" name="password"
            required="required" />
    </h:panelGrid>
    <h:panelGrid>
        <button type="submit">
            <span class="ui-button-text">Login</span>
        </button>
    </h:panelGrid>
</form>

这将执行到Spring Security认证入口点的POST。用户登录后，您可以使用AuthenticationSuccessHandler或默认目标url重定向到JSF应用程序。