当应用程序在 pods GKE 中工作时，未传递 SpringSecurityContext

Question

我需要在 servlet 过滤器中获取 UserDetails。所以我像这样从 SecurityContextHolder.getContext().getAuthentication() 得到它 -

  @Override
  public void doFilter(ServletRequest request, ServletResponse response, FilterChain filterChain) throws ServletException, IOException {
     UserDetails userDetails = (UserDetails) SecurityContextHolder.getContext().getAuthentication()
        .getPrincipal();
...
}

本地用户是从安全上下文中获取的，但是当将应用程序部署到 GKE 时，SecurityContextHolder.getContext().getAuthentication() 为空。

我试过像这样将 SecurityContextHolder 配置为 MODE_INHERITABLETHREADLOCAL，但没有用

@Configuration
public class SecurityContextHolderConfig {
  public SecurityContextHolderConfig() {
    SecurityContextHolder.setStrategyName(SecurityContextHolder.MODE_INHERITABLETHREADLOCAL);
  }
}

仍然没有将 SecurityContext 传递给 pod 中的 Filter。（应用程序包装为 WAR）配置 - Spring oauth2-client with JWT authentication (in the header)

Answer 1

这对我有用：

 @Override
  public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws ServletException, IOException {

    HttpServletRequest httpServletRequest =
    (HttpServletRequest) servletRequest;

    Principal userPrincipal = httpServletRequest.getUserPrincipal();

当应用程序在 pods GKE 中工作时，未传递 SpringSecurityContext

SpringSecurityContext is not passed when app is working in pods GKE

spring-security

spring-boot

kubernetes-pod