我希望使用一个自定义的认证过滤器,它可以:
- 捕获加密的头部令牌
- 在验证后,以无状态的方式提取用户详细信息并将其添加到当前请求的安全上下文中
我想能够使用这个安全上下文持有者正确获取有关当前请求用户的详细信息,并正确处理他们的请求。
@RequestMapping(value = "/simple", method = RequestMethod.POST)
@ResponseBody
@Transactional
@Preauthorize(...)
public String simple(){
//collect the user's current details from the getPrinciple() and complete the transaction...
Object principal = SecurityContextHolder.getContext().getAuthentication().getPrincipal();
return "Simple";
}
我之前在XML中做过这样的事情:
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:security="http://www.springframework.org/schema/security"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans-3.2.xsd
http://www.springframework.org/schema/security
http://www.springframework.org/schema/security/spring-security-3.2.xsd">
<security:global-method-security
secured-annotations="enabled" />
<security:http pattern="/**"
auto-config="true" disable-url-rewriting="true" use-expressions="true">
<security:custom-filter ref="authenticationTokenProcessingFilter"
position="FORM_LOGIN_FILTER" />
<security:intercept-url pattern="/authenticate"
access="permitAll" />
<security:intercept-url pattern="/secure/**"
access="isAuthenticated()" />
</security:http>
<bean id="CustomAuthenticationEntryPoint" class="org.foo.CustomAuthenticationEntryPoint" />
<bean class="org.foo.AuthenticationTokenProcessingFilter" id="authenticationTokenProcessingFilter">
<constructor-arg ref="authenticationManager" />
</bean>
</beans>
然而,我希望它能够在较新的Spring Boot
应用程序中正常工作,在非XML的WebSecurityConfigurerAdapter中,就像他们Spring Boot文件中的示例一样:
@Bean
public ApplicationSecurity applicationSecurity() {
return new ApplicationSecurity();
}
@Order(Ordered.LOWEST_PRECEDENCE - 8)
protected static class ApplicationSecurity extends WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity http) throws Exception {
// this is obviously for a simple "login page" not a custom filter!
http.authorizeRequests().anyRequest().fullyAuthenticated().and().formLogin()
.loginPage("/login").failureUrl("/login?error").permitAll();
}
}
有任何建议或类似的例子吗?