Spring Boot 安全 - 多个 WebSecurityConfigurerAdapter

Question

我有一个 auth-cas 库，可为我的 Spring Boot 项目提供身份验证。 在这个 auth-cas 库中有一个类扩展 WebSecurityConfigurerAdapter 具有以下配置功能

@Override
@ConditionalOnProperty(value = "ugent.cas.serviceUrl", matchIfMissing = true)
@ConditionalOnClass(Cas.class)
protected void configure(HttpSecurity http) throws Exception {
    http.exceptionHandling().authenticationEntryPoint(casAuthenticationEntryPoint());

    if (basicAuthenticationProviders != null) {
        http.addFilter(basicAuthFilter());
    }

    http.addFilter(casAuthenticationFilter())
            .addFilter(requestSSOLogoutToCASServerLogoutFilter())
            .logout()
            .deleteCookies("JSESSIONID")
            .permitAll()
            .logoutSuccessUrl("/logout.html")
            .and()
            .csrf()
            .disable()
            .headers()
            .frameOptions()
            .disable();

    http.authorizeRequests()
            .antMatchers(HttpMethod.OPTIONS, "/api/**").permitAll()
            .antMatchers("/**").authenticated();
}   

因为这应该是黑盒子，所以我添加了自己的 WebSecurityConfigurerAdapter，如下所示：

@Configuration
//@Order(Integer.MAX_VALUE)
//@Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)
@Order(1)
public class AuthSecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Override
    public void configure(WebSecurity webSecurity) throws Exception {
        webSecurity
                .ignoring()
                // All of Spring Security will ignore the requests
                .antMatchers("/choose.html")
                .antMatchers("/account/*");
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http/*.addFilter(usernamePasswordAuthenticationFilter())
                .formLogin()
                .permitAll()
                .and()
                .logout()
                .deleteCookies("JSESSIONID")
                .permitAll()
                .logoutSuccessUrl("/logout.html")
                .and()
                .csrf()
                .disable()
                .headers()
                .frameOptions()
                .disable();
            */    

                .authorizeRequests()
                .anyRequest().authenticated()
                .and()
                .authenticationProvider(AuthenticationProvider())
                .formLogin()
                .permitAll()
                .and()
                .csrf()
                .disable()
                .headers()
                .frameOptions()
                .disable()
                ;

    }

    @Bean
    public AuthenticationProvider AuthenticationProvider() {
        return new LCAAuthenticationProvider();
    }

    @Bean
    public UsernamePasswordAuthenticationFilter usernamePasswordAuthenticationFilter () throws Exception{
        UsernamePasswordAuthenticationFilter  filter = new UsernamePasswordAuthenticationFilter ();
        filter.setAuthenticationManager(authenticationManager());
        return filter;
    }
}

我的自定义 AuthenticationProvider 实现了“AuthenticationProvider”，并在页面中将我重定向到 /login 页面，我可以使用我的用户群中的凭据登录。 唯一的问题是，当我已经登录另一个 auth cas 网络时，我应该进行身份验证，但它仍然会提示我使用我的自定义身份验证提供程序。

我需要如何配置 HttpSecurity 以便它与我的 2 个身份验证提供程序一起使用。

其他相关问题，我如何从被忽略的页面 /choose.html 中选择使用 2 个身份验证提供商之一登录？

编辑

这是我当前的“WebSecurityConfigurererAdapter”配置

@Configuration
//@Order(Integer.MAX_VALUE)
//@Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)
@Order(0)
public class AuthSecurityConfiguration extends WebSecurityConfigurerAdapter {

    /**
     * The authProvider bean used as a cas authentication provider.
     */
    @Autowired
    private LCAAuthenticationProvider authProvider;

    @Override
    public void configure(WebSecurity webSecurity) throws Exception {
        webSecurity
                .ignoring()
                // All of Spring Security will ignore the requests
                .antMatchers("/choose.html")
                .antMatchers("/account/*");
    }

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        auth.authenticationProvider(authProvider);
    }

        /**
     * The authenticationManagerBean bean.
     *
     * @return the authenticationManagerBean
     * @throws Exception
     */
    @Override
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }

    /**
     * The loginUrlAuthenticationEntryPoint bean
     *
     * @return the loginUrlAuthenticationEntryPoint
     */
    @Bean
    public LoginUrlAuthenticationEntryPoint loginUrlAuthenticationEntryPoint() {
        LoginUrlAuthenticationEntryPoint ep = new LoginUrlAuthenticationEntryPoint("/choose.html");
        //ep.setLoginUrl(cas.getLoginUrl());

        return ep;
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.exceptionHandling().authenticationEntryPoint(loginUrlAuthenticationEntryPoint());

        http.addFilter(usernamePasswordAuthenticationFilter())
                .formLogin()
                .permitAll()
                .and()
                .logout()
                .deleteCookies("JSESSIONID")
                .permitAll()
                .logoutSuccessUrl("/logout.html")
                .and()
                .csrf()
                .disable()
                .headers()
                .frameOptions()
                .disable();
            /*  

                .authorizeRequests()
                .anyRequest().authenticated()
                .and()
                .authenticationProvider(AuthenticationProvider())
                .formLogin()
                .loginPage("choose.html")
                .permitAll()
                .and()
                .csrf()
                .disable()
                .headers()
                .frameOptions()
                .disable()
                ;
           */  
    }

    @Bean
    public LCAAuthenticationProvider lcaAuthenticationProvider() {
        return new LCAAuthenticationProvider();
    }

    @Bean
    public UsernamePasswordAuthenticationFilter usernamePasswordAuthenticationFilter () throws Exception{
        UsernamePasswordAuthenticationFilter  filter = new UsernamePasswordAuthenticationFilter ();
        filter.setAuthenticationManager(authenticationManager());
        return filter;
    }
}

但我收到以下错误：

Exception in thread "main" java.lang.RuntimeException: java.lang.reflect.InvocationTargetException
        at org.springframework.boot.loader.MainMethodRunner.run(MainMethodRunner.java:62)
        at java.lang.Thread.run(Unknown Source)
Caused by: java.lang.reflect.InvocationTargetException
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
        at java.lang.reflect.Method.invoke(Unknown Source)
        at org.springframework.boot.loader.MainMethodRunner.run(MainMethodRunner.java:54)
        ... 1 more
Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'springSecurityFilterChain' defined in class path resource [org/springframework/security/config/annotation/web/configuration/WebSecurityConfiguration.class]: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [javax.servlet.Filter]: Factory method 'springSecurityFilterChain' threw exception; nested exception is org.springframework.security.config.annotation.AlreadyBuiltException: This object has already been built
        at org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:599)
        at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateUsingFactoryMethod(AbstractAutowireCapableBeanFactory.java:1123)
        at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1018)
        at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:510)
        at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:482)
        at org.springframework.beans.factory.support.AbstractBeanFactory$1.getObject(AbstractBeanFactory.java:306)
        at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:230)
        at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:302)
        at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:197)
        at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:296)
        at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:197)
        at org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingletons(DefaultListableBeanFactory.java:772)
        at org.springframework.context.support.AbstractApplicationContext.finishBeanFactoryInitialization(AbstractApplicationContext.java:839)
        at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:538)
        at org.springframework.boot.context.embedded.EmbeddedWebApplicationContext.refresh(EmbeddedWebApplicationContext.java:118)
        at org.springframework.boot.SpringApplication.refresh(SpringApplication.java:766)
        at org.springframework.boot.SpringApplication.createAndRefreshContext(SpringApplication.java:361)
        at org.springframework.boot.SpringApplication.run(SpringApplication.java:307)
        at org.springframework.boot.SpringApplication.run(SpringApplication.java:1191)
        at org.springframework.boot.SpringApplication.run(SpringApplication.java:1180)
        at be.ugent.lca.Application.main(Application.java:16)
        ... 6 more
Caused by: org.springframework.beans.BeanInstantiationException: Failed to instantiate [javax.servlet.Filter]: Factory method 'springSecurityFilterChain' threw exception; nested exception is org.springframework.security.config.annotation.AlreadyBuiltException: This object has already been built
        at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:189)
        at org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:588)
        ... 26 more
Caused by: org.springframework.security.config.annotation.AlreadyBuiltException: This object has already been built
        at org.springframework.security.config.annotation.AbstractSecurityBuilder.build(AbstractSecurityBuilder.java:44)
        at org.springframework.security.config.annotation.web.configuration.WebSecurityConfiguration.springSecurityFilterChain(WebSecurityConfiguration.java:105)
        at org.springframework.security.config.annotation.web.configuration.WebSecurityConfiguration$$EnhancerBySpringCGLIB$$699e3cc3.CGLIB$springSecurityFilterChain$2(<generated>)
        at org.springframework.security.config.annotation.web.configuration.WebSecurityConfiguration$$EnhancerBySpringCGLIB$$699e3cc3$$FastClassBySpringCGLIB$$e656a0ba.invoke(<generated>)
        at org.springframework.cglib.proxy.MethodProxy.invokeSuper(MethodProxy.java:228)
        at org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:355)
        at org.springframework.security.config.annotation.web.configuration.WebSecurityConfiguration$$EnhancerBySpringCGLIB$$699e3cc3.springSecurityFilterChain(<generated>)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
        at java.lang.reflect.Method.invoke(Unknown Source)
        at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:162)

我可以将错误追溯到https://github.com/spring-projects/spring-security/blob/master/config/src/main/java/org/springframework/security/config/annotation/AbstractSecurityBuilder.java 中的第 44 行，但我找不到导致此问题的原因

Answer 1

你需要把auth过滤器和用户名密码过滤器放到你自己的配置中（AuthSecurityConfiguration），先做，然后定义choose.html的入口点，和一个过滤器来处理来自choose.html的请求，然后重定向到不同的 url（例如 /login 或 /auth）取决于选择。所以它会像下面一样。（我以前做过类似的事情，所以我只是复制它们，你可以改成你自己的）

<security:http xmlns="http://www.springframework.org/schema/security" entry-point-ref="clientAuthenticationEntryPoint">
        <intercept-url pattern="/login" access="IS_AUTHENTICATED_ANONYMOUSLY" />
        <intercept-url pattern="/choose.html" access="IS_AUTHENTICATED_ANONYMOUSLY" />
        <intercept-url pattern="/autherror" access="IS_AUTHENTICATED_ANONYMOUSLY" />
        <intercept-url pattern="/**/**" access="IS_AUTHENTICATED_FULLY"/>
        <custom-filter ref="logoutFilter" position="LOGOUT_FILTER" />
        <custom-filter ref="authenticationBrokerProcessingFilter" after="LOGOUT_FILTER" />
        <custom-filter ref="oauth2ClientContextFilter" after="EXCEPTION_TRANSLATION_FILTER"/>
        <custom-filter ref="oAuth2AuthenticationProcessingFilter" before="FILTER_SECURITY_INTERCEPTOR"/>
        <form-login
                login-page="/login"
                default-target-url="/main"
                username-parameter="username"
                password-parameter="password"
                login-processing-url="/loginSubmit"
                authentication-failure-handler-ref="passwordFailureHandler"
                authentication-success-handler-ref="passwordAuthenticationSuccessHandler"
                always-use-default-target="false"
                />
        <csrf />
        <access-denied-handler ref="accessDeniedHandler" />
    </security:http>


<bean id="clientAuthenticationEntryPoint" class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint">
        <constructor-arg name="loginFormUrl" value="/choose.html"/>
    </bean>

从xml中可以看到，有两种认证方式，auth2和username password。 authenticationBrokerProcessingFilter 将处理来自choose.html的请求；

用户名密码过滤器将处理来自login页面的请求/loginSubmit；

auth2 过滤器将使用代码处理来自 sso 的请求 /oauth2-login。