为什么spring security无法获取用户名？答案

【问题标题】：Why can't spring security get a username?为什么spring security无法获取用户名？
【发布时间】：2014-06-18 09:39:36
【问题描述】：

我正在使用spring security，我似乎无法查看用户是否成功登录以挽救我的生命然后获取实际用户名。 'spring' (SecurityContextHolder) 和 'J2EE' (request.getUserPrincipal()) 方式都返回空值。

我的 web.xml

  <filter>
    <filter-name>AuthFilter</filter-name>
    <filter-class>com.company.security.AuthFilter</filter-class>
  </filter>
  <filter-mapping>
    <filter-name>AuthFilter</filter-name>
    <url-pattern>/*</url-pattern>
  </filter-mapping>
  <filter>
    <filter-name>springSecurityFilterChain</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
  </filter>
  <filter-mapping>
    <filter-name>springSecurityFilterChain</filter-name>
    <url-pattern>/*</url-pattern>
  </filter-mapping>
....
  <servlet>
    <servlet-name>agent-desktop</servlet-name>
    <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
    <load-on-startup>1</load-on-startup>
  </servlet>
  <servlet-mapping>
    <servlet-name>agent-desktop</servlet-name>
    <url-pattern>/</url-pattern>
  </servlet-mapping>

弹簧配置：

<mvc:resources mapping="/r/**" location="/resources/" />

Spring 安全配置：

<beans:beans xmlns="http://www.springframework.org/schema/security"
    xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.springframework.org/schema/beans
    http://www.springframework.org/schema/beans/spring-beans-4.0.xsd
    http://www.springframework.org/schema/security
    http://www.springframework.org/schema/security/spring-security-3.2.xsd">

    <http auto-config="true">
        <intercept-url pattern="/agent/**" access="ROLE_USER" />
        <intercept-url pattern="/supervisor/**" access="ROLE_USER" />
        <form-login login-page="/r/views/login.html" default-target-url="/dashboard" authentication-failure-url="/r/views/loginfailed.html" />
        <logout logout-success-url="/logout" />
    </http>

    <authentication-manager>
        <authentication-provider>
            <user-service>
                <user name="admin" password="pw123" authorities="ROLE_USER, ROLE_ADMIN" />
            </user-service>
        </authentication-provider>
    </authentication-manager>

</beans:beans>

这是我的过滤代码：

public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
    HttpServletRequest req = (HttpServletRequest) request;
    HttpSession session = req.getSession();
     Authentication auth = SecurityContextHolder.getContext().getAuthentication();
     if(auth != null)
     {
      String name = auth.getName(); //get logged in username
          System.out.println("name:"+name);
      User user = (User)auth.getPrincipal();
      if(user != null)
          System.out.println("user:"+user.getUsername());
     }
    if(req.getUserPrincipal() != null) // someone has logged in - IT IS ALWAYS NULL
        {
              /// IT NEVER GETS IN HERE!!!!!!!!!!

【问题讨论】：

您的问题解决了吗？

标签： java jakarta-ee spring-security

【解决方案1】：

我怀疑您错过了在 web.xml 中包含过滤器。您可能想从 here 阅读有关如何配置 spring 安全性的信息

 <filter>
    <filter-name>springSecurityFilterChain</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>

【讨论】：

我的 web.xml 中确实有这个。我已经编辑了原始帖子以反映。谢谢。
您应该尝试将安全过滤器放在自定义过滤器之前，过滤器的定位问题
感谢 Sudarshan，成功了！至少，它适用于 SPRING 安全性，而不是 J2EE 安全性，但无论如何，只要我能获得用户名。谢谢！刚刚将 Spring 委托过滤器移到我的过滤器之前，现在 Spring Security Authentication 对象被填充（不为空）。

【解决方案2】：

在 web.xml 中使用此代码而不是过滤器。

<!-- Spring Security -->
    <filter>
        <filter-name>springSecurityFilterChain</filter-name>
        <filter-class>
                  org.springframework.web.filter.DelegatingFilterProxy
                </filter-class>
    </filter>

    <filter-mapping>
        <filter-name>springSecurityFilterChain</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

要获取登录用户详细信息，请使用类似这样的单独类

public class AccountUtils {
    public static Authentication getAuthentication() {
        return SecurityContextHolder.getContext().getAuthentication();
    }

    public static UserAccount getLoginUserAccount() {
        if (getAuthentication() != null && getAuthentication().getPrincipal() instanceof UserAccount) {
            return (UserAccount)getAuthentication().getPrincipal();
        }
        return null;
    }

    public static String getLoginUserId() {
        UserAccount account = getLoginUserAccount();
        return (account == null) ? null : account.getUserId();
    }

    private AccountUtils() {}
}

【讨论】：