我必须说我对整个模型非常困惑,我需要帮助将所有浮动部件粘合在一起。
我没有做 Spring REST,只是简单的 WebMVC 控制器。
我的任务:我想要一个带有用户名+通过身份验证的表单登录。我想针对 3rd 方服务进行身份验证。成功后我想返回一个 cookie 但不使用默认的 cookie 令牌机制。我希望 cookie 有一个 JWT 令牌。通过利用 cookie 机制,每个请求都将使用 JWT 发送。
因此,为了分解它,我需要处理以下模块:
成功验证后用我的自定义实现替换 cookie 会话令牌
在每次请求时从 cookie 中解析 JWT(使用过滤器)
从 JWT 中提取用户详细信息/数据以供控制器访问
有什么困惑?(请纠正我哪里错了)
第三方认证
要针对第 3 方进行身份验证,我需要通过扩展 AuthenticationProvider 来拥有一个自定义提供程序
public class JWTTokenAuthenticationProvider implements AuthenticationProvider {
@Override
public Authentication authenticate( Authentication authentication ) throws AuthenticationException {
// auth against 3rd party
// return Authentication
return new UsernamePasswordAuthenticationToken( name, password, new ArrayList<>() );
}
@Override
public boolean supports(Class<?> authentication) {
return authentication.equals( UsernamePasswordAuthenticationToken.class );
}
}
问题:
用 JWT 替换 cookie 令牌
不知道如何优雅地做到这一点,我可以想到很多方法,但它们不是 Spring Security 方法,我不想打破流程。将不胜感激这里的任何建议!
使用来自 cookie 的每个请求解析 JWT
据我了解,我需要像这样扩展 AbstractAuthenticationProcessingFilter
public class CookieAuthenticationFilter extends AbstractAuthenticationProcessingFilter {
@Override
public Authentication attemptAuthentication( HttpServletRequest request, HttpServletResponse response )
throws AuthenticationException, IOException, ServletException {
String token = "";
// get token from a Cookie
// create an instance to Authentication
TokenAuthentication authentication = new TokenAuthentication(null, null);
return getAuthenticationManager().authenticate(tokenAuthentication);
}
@Override
public void doFilter(ServletRequest req, ServletResponse res,
FilterChain chain) throws IOException, ServletException {
super.doFilter(req, res, chain);
}
}
问题:
似乎我拥有了我需要的所有部分,除了 cookie 会话替换,但我无法将它们放入一个连贯的模型中,我需要一个足够了解机制的人,这样我就可以将所有这些粘合到一个模块中.
更新 1
好的,我想我已经开始了...... https://github.com/spring-projects/spring-security/blob/master/web/src/main/java/org/springframework/security/web/身份验证/用户名密码 AuthenticationFilter.java
此过滤器将自己注册到 POST ->"/login" 然后创建一个 UsernamePasswordAuthenticationToken 实例并将控制权传递给下一个过滤器。
问题是 cookie 会话的设置位置....
更新 2
dos 的这一部分给出了我所缺少的顶级流程,对于正在经历这个的人来说,看看这里...... http://docs.spring.io/spring-security/site/docs/current/reference/htmlsingle/#tech-intro-authentication
本节关于 AuthenticationProvider... http://docs.spring.io/spring-security/site/docs/current/reference/htmlsingle/#core-services-authentication-manager
更新 3 - 工作案例,这是最好的方法吗?
因此,在深入研究了 Spring Security 文档及其来源之后,我得到了初始模型。现在,这样做,我意识到有不止一种方法可以做到这一点。关于为什么选择这种方式 VS Denys 在下面提出的任何建议?
下面的工作示例...
为了让它按照原始帖子中描述的方式工作,这就是需要发生的事情......
自定义过滤器
public class CookieAuthenticationFilter extends AbstractAuthenticationProcessingFilter {
public CookieAuthenticationFilter( RequestMatcher requestMatcher ) {
super( requestMatcher );
setAuthenticationManager( super.getAuthenticationManager() );
}
@Override
public Authentication attemptAuthentication( HttpServletRequest request, HttpServletResponse response )
throws AuthenticationException, IOException, ServletException {
String token = "";
// get token from a Cookie
Cookie[] cookies = request.getCookies();
if( cookies == null || cookies.length < 1 ) {
throw new AuthenticationServiceException( "Invalid Token" );
}
Cookie sessionCookie = null;
for( Cookie cookie : cookies ) {
if( ( "someSessionId" ).equals( cookie.getName() ) ) {
sessionCookie = cookie;
break;
}
}
// TODO: move the cookie validation into a private method
if( sessionCookie == null || StringUtils.isEmpty( sessionCookie.getValue() ) ) {
throw new AuthenticationServiceException( "Invalid Token" );
}
JWTAuthenticationToken jwtAuthentication = new JWTAuthenticationToken( sessionCookie.getValue(), null, null );
return jwtAuthentication;
}
@Override
public void doFilter(ServletRequest req, ServletResponse res,
FilterChain chain) throws IOException, ServletException {
super.doFilter(req, res, chain);
}
}
身份验证提供程序
将提供程序附加到由 UsernamePasswordAuthenticationFilter 生成的 UsernamePasswordAuthenticationToken,后者将自身附加到“/login”POST。对于带有 POST 到“/login”的表单登录,将生成 UsernamePasswordAuthenticationToken 并且您的提供者将被触发
@Component
public class ApiAuthenticationProvider implements AuthenticationProvider {
@Autowired
TokenAuthenticationService tokenAuthService;
@Override
public Authentication authenticate( Authentication authentication ) throws AuthenticationException {
String login = authentication.getName();
String password = authentication.getCredentials().toString();
// perform API call to auth against a 3rd party
// get User data
User user = new User();
// create a JWT token
String jwtToken = "some-token-123"
return new JWTAuthenticationToken( jwtToken, user, new ArrayList<>() );
}
@Override
public boolean supports( Class<?> authentication ) {
return authentication.equals( UsernamePasswordAuthenticationToken.class );
}
}
自定义身份验证对象
对于 JWT,我们希望拥有自己的身份验证令牌对象,以便在堆栈中携带我们想要的数据。
public class JWTAuthenticationToken extends AbstractAuthenticationToken {
User principal;
String token;
public JWTAuthenticationToken( String token, User principal, Collection<? extends GrantedAuthority> authorities ) {
super( authorities );
this.token = token;
this.principal = principal;
}
@Override
public Object getCredentials() {
return null;
}
@Override
public Object getPrincipal() {
return principal;
}
public void setToken( String token ) {
this.token = token;
}
public String getToken() {
return token;
}
}
身份验证成功处理程序
当我们的自定义提供程序通过针对第三方对用户进行身份验证并生成 JWT 令牌来完成它的工作时,就会调用它,这是 Cookie 进入响应的地方。
@Component
public class AuthenticationSuccessHandler extends SavedRequestAwareAuthenticationSuccessHandler {
@Override
public void onAuthenticationSuccess(
HttpServletRequest request,
HttpServletResponse response,
Authentication authentication) throws IOException, ServletException {
if( !(authentication instanceof JWTAuthenticationToken) ) {
return;
}
JWTAuthenticationToken jwtAuthenticaton = (JWTAuthenticationToken) authentication;
// Add a session cookie
Cookie sessionCookie = new Cookie( "someSessionId", jwtAuthenticaton.getToken() );
response.addCookie( sessionCookie );
//clearAuthenticationAttributes(request);
// call the original impl
super.onAuthenticationSuccess( request, response, authentication );
}
}
把这一切联系在一起
@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
@Autowired @Required
ApiAuthenticationProvider apiAuthProvider;
@Autowired @Required
AuthenticationSuccessHandler authSuccessHandler;
@Autowired @Required
SimpleUrlAuthenticationFailureHandler authFailureHandler;
@Override
protected void configure( AuthenticationManagerBuilder auth ) throws Exception {
auth.authenticationProvider( apiAuthProvider );
}
@Override
protected void configure( HttpSecurity httpSecurity ) throws Exception {
httpSecurity
// don't create session
.sessionManagement()
.sessionCreationPolicy( SessionCreationPolicy.STATELESS )
.and()
.authorizeRequests()
.antMatchers( "/", "/login", "/register" ).permitAll()
.antMatchers( "/js/**", "/css/**", "/img/**" ).permitAll()
.anyRequest().authenticated()
.and()
// login
.formLogin()
.failureHandler( authFailureHandler )
//.failureUrl( "/login" )
.loginPage("/login")
.successHandler( authSuccessHandler )
.and()
// JWT cookie filter
.addFilterAfter( getCookieAuthenticationFilter(
new AndRequestMatcher( new AntPathRequestMatcher( "/account" ) )
) , UsernamePasswordAuthenticationFilter.class );
}
@Bean
SimpleUrlAuthenticationFailureHandler getAuthFailureHandler() {
SimpleUrlAuthenticationFailureHandler handler = new SimpleUrlAuthenticationFailureHandler( "/login" );
handler.setDefaultFailureUrl( "/login" );
//handler.setUseForward( true );
return handler;
}
CookieAuthenticationFilter getCookieAuthenticationFilter( RequestMatcher requestMatcher ) {
CookieAuthenticationFilter filter = new CookieAuthenticationFilter( requestMatcher );
filter.setAuthenticationFailureHandler( authFailureHandler );
return filter;
}
}