自定义身份验证提供程序获取每个请求的调用

Question

我正在创建一个自定义身份验证提供程序，它使用第三方系统对用户进行身份验证。用户名和密码以 json 格式发送到服务器。为了实现这一点，我创建了一个自定义过滤器——在 FORM_LOGIN_FILTER 位置调用的 UsernamePasswordAuthenticationFilter。在此之后，我创建了一个自定义身份验证提供程序来使用第三方系统对用户进行身份验证。但是，每个请求都会调用此身份验证过滤器，这会导致每个请求都会调用第三方系统。我做错了什么？

自定义用户名密码验证过滤器：

@Override
public Authentication attemptAuthentication( HttpServletRequest request, HttpServletResponse response)
{
    //Get username password from request
    UsernamePasswordAuthenticationToken token = 
            new UsernamePasswordAuthenticationToken( username, password);
    setDetails(request, token);
    return this.getAuthenticationManager().authenticate(token);
}

自定义身份验证提供程序：

@Override
public Authentication authenticate(Authentication authentication) {
      String username = authentication.getName();
      String password = authentication.getCredentials().toString();
      boolean flag = //use the credentials to try to authenticate against the third party system
    if(flag) {
        return new UsernamePasswordAuthenticationToken(username, password);
    }
    else
        throw new BadCredentialsException("Bad Credentials");
}

@Override
public boolean supports(Class<?> authentication) {
    return true;
}

安全上下文.xml

<http pattern="/resources/**" security="none"/>
<http auto-config="false" use-expressions="true" access-denied-page="/welcome"
      create-session="always" disable-url-rewriting="true" entry-point-ref="customEntryPoint">
    <intercept-url pattern="/" access='permitAll'/>
    <custom-filter ref="loginFilter" position="FORM_LOGIN_FILTER" />
    <intercept-url pattern="/**" access="isAuthenticated()" />
    <logout logout-success-url="/" delete-cookies="JSESSIONID" logout-url="/logout"  invalidate-session="true" />
</http>

<bean id="loginFilter" class="org.temp.secure.CustomUsernamePasswordAuthenticationFilter">
    <beans:property name="requiresAuthenticationRequestMatcher" ref="loginRequestUrlHandler" />
    <beans:property name="authenticationManager" ref="authenticationManager" />
    <beans:property name="usernameParameter" value="username" />
    <beans:property name="passwordParameter" value="password" />
</beans:bean>

<authentication-manager alias="authenticationManager">
    <authentication-provider ref="customAuthenticationProvider" />
</authentication-manager>

<bean id="loginRequestUrlHandler" class="org.springframework.security.web.util.matcher.RegexRequestMatcher">
    <constructor-arg index="0" value="/login" />
    <constructor-arg index="1" value="POST" />
    <constructor-arg index="2" value="false" />
</bean>

<bean id="customEntryPoint" class="org.temp.secure.CustomEntryPoint" />

<bean id="customAuthenticationProvider" class="org.temp.secure.MyAuthenticationProvider"/>

Answer 1

没关系，明白了，问题是我没有设置任何角色，所以它显示身份验证为假。在 UsernamePasswordAuthenticationToken 中设置角色后，不再调用自定义身份验证提供程序..

@Override
public Authentication authenticate(Authentication authentication) {
    String username = authentication.getName();
    String password = authentication.getCredentials().toString();
    boolean flag = //use the credentials to try to authenticate against the third party system
    if(flag) {
        List<GrantedAuthority> authorities = new ArrayList<GrantedAuthority>();
        authorities.add(new SimpleGrantedAuthority("ROLE_ONE"));
        authorities.add(new SimpleGrantedAuthority("ROLE_TWO"));
        return new UsernamePasswordAuthenticationToken(username, password, authorities);
   }
   else
       throw new BadCredentialsException("Bad Credentials"); 
}

@Override
public boolean supports(Class<?> authentication) {
    return true;
}