如何在 spring 安全性中配置自定义身份验证过滤器 - 使用 java 配置

Question

我正在尝试为 spring 基于安全的身份验证配置自定义过滤器。这是用户名密码过滤器的简单覆盖。我的问题是我不知道如何使用 java 配置来配置它。每次我点击“/admin/login” - 它进入我的过滤器并导致异常而不是进入登录页面 - 但 antmatchers 应该允许访问 /admin/login。

如果我禁用我的过滤器，它可以正常工作。我已经阅读了一些相关问题，但似乎没有一个能让我找到答案。

谁能告诉我如何修复下面的配置以支持自定义过滤器？

/**
 * the security configuration.
 */
@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    DataSource dataSource;

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }


    @Bean
    UserNotifier userNotifier() {
        UserNotifier us = new UserNotifier();
        return us;
    }



    @Bean
    AuthenticationProvider customAuthenticationProvider() {
        SystemUserAuthenticationProvider impl = new SystemUserAuthenticationProvider();

        /* other properties etc */
        return impl ;
    }

    @Bean
    SystemUserService systemUserService(){
        SystemUserService systemUserService = new SystemUserService();
        return systemUserService;
    }

    @Bean
    SystemAuthenticationFilter systemAuthenticationFilter() throws Exception {
        SystemAuthenticationFilter f = new SystemAuthenticationFilter();

        f.setAuthenticationManager(this.authenticationManager());
        f.setPasswordParameter("password");
        f.setUsernameParameter("email");
        f.setPostOnly(true);
        f.setAuthenticationFailureHandler(exceptionMappingAuthenticationFailureHandler());
        f.setAuthenticationSuccessHandler(savedRequestAwareAuthenticationSuccessHandler());
        f.setFilterProcessesUrl("/login");

        return f;
    }

    @Bean
    SavedRequestAwareAuthenticationSuccessHandler savedRequestAwareAuthenticationSuccessHandler(){
        SavedRequestAwareAuthenticationSuccessHandler sv = new SavedRequestAwareAuthenticationSuccessHandler();
        sv.setDefaultTargetUrl("/admin/customers");
        return sv;
    }





    @Bean
    AuditorAware<SystemUser> auditorAware(){
        SystemUserAuditorAware adw = new SystemUserAuditorAware();
        return adw;
    }

    @Bean
    ExceptionMappingAuthenticationFailureHandler exceptionMappingAuthenticationFailureHandler(){
        ExceptionMappingAuthenticationFailureHandler ex = new ExceptionMappingAuthenticationFailureHandler();
        Map<String, String> mappings = new HashMap<String, String>();
        mappings.put("org.springframework.security.authentication.CredentialsExpiredException", "/admin/login?reset");
        mappings.put("org.springframework.security.authentication.LockedException", "/admin/login?locked");
        mappings.put("org.springframework.security.authentication.BadCredentialsException", "/admin/login?error");
        mappings.put("org.springframework.security.core.userdetails.UsernameNotFoundException", "/admin/login?error");

        ex.setExceptionMappings(mappings);
        return ex;
    }

   @Override
   protected void configure(AuthenticationManagerBuilder auth) throws Exception {
       auth.authenticationProvider(customAuthenticationProvider());
  }

    @Override
    public void configure(WebSecurity web) throws Exception {
        web
                .ignoring()
                .antMatchers("/resources/**")
        ;
    }



    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http

                .authorizeRequests()
                .antMatchers("/admin/login", "/admin/login/new**", "/admin/register", "/admin/logout", "/assets/**", "/admin/session/timeout").permitAll()
                .antMatchers("/admin/**").hasRole("ADMIN")
                .anyRequest().permitAll()
                .and()
                .formLogin()
                .failureHandler(exceptionMappingAuthenticationFailureHandler())
                .loginProcessingUrl("/login")
                .loginPage("/admin/login")
                .usernameParameter("username")
                .passwordParameter("password")
                .defaultSuccessUrl("/admin/orders")

                .and()
                .logout()
                .logoutUrl("/logout")
                .and()
                .requiresChannel()
                .antMatchers("/admin/**").requiresSecure()
                .and()
                .addFilterBefore(systemAuthenticationFilter(), UsernamePasswordAuthenticationFilter.class);
    }

}

Answer 1

没关系，我通过更改登录处理中的正则表达式修复了它 url。它似乎在干扰之前的antmatcher。

因此，通过将表单登录和自定义过滤器配置中的登录处理 url 更改为 "log_in"，登录页面现在无需授权即可访问。

如何在 spring 安全性中配置自定义身份验证过滤器 - 使用 java 配置

How to configure custom authentication filter in spring security - using java config

spring

spring-security