为特定 url 加载不同的身份验证提供程序

Question

我想为不同的 url 加载不同的身份验证提供程序。例如，如果我的 url 匹配“/foo/something”，则加载 FooProvider 和“bar/something”-> BarProvider。问题是当我点击“bar/something”url 时，sessionScope 参数（我在提供者的构造函数中传递它）仍然是“foo”。这意味着，FooProvider 已加载，但这不是我所期望的。 有什么我想念的吗？提前致谢。

 abstract class TokenAuthenticationProvider (
        protected val sessionScope: SessionScope
    ) : AuthenticationProvider { 

    private fun authenticateToken(authentication: TokenAuthentication): Authentication { 
        println("sessionScope $sessionScope")
    }
}

@Component
class FooAuthenticationProvider : TokenAuthenticationProvider (sessionScope = SessionScope.Foo)

@Component
class BarAuthenticationProvider : TokenAuthenticationProvider (sessionScope = SessionScope.Bar)


@Configuration
@EnableWebSecurity
class WebSecurityConfiguration @Autowired constructor(
    private val fooProvider: FooProvider,
    private val barProvider: BarProvider,
    private val authFilter: AuthFilter,
    private val corsFilter: CustomCorsFilter
) : WebSecurityConfigurerAdapter() {

    override fun configure(http: HttpSecurity) {

        ... 

        http.authorizeRequests()
            .antMatchers("foo/**")
            .fullyAuthenticated()
            .and()
            .authenticationProvider(fooProvider)

        http.authorizeRequests()
            .antMatchers("bar/**")
            .fullyAuthenticated()
            .and()
            .authenticationProvider(barProvider)

          ... 
    }

    override fun configure(auth: AuthenticationManagerBuilder) {
        auth.authenticationProvider(fooProvider)
        auth.authenticationProvider(barProvider)
    }
}

Answer 1

您需要配置两个WebSecurityConfigurerAdapter，并在HttpSecurity的顶层添加一个antMatcher。

@Configuration
@Order(1)
class FooWebSecurityConfiguration(val provider: FooProvider) : WebSecurityConfigurerAdapter() {

    override fun configure(http: HttpSecurity) {
        http.antMatcher("/foo/**")
            .authorizeRequests()
            .antMatchers("/foo/**")
            .fullyAuthenticated()
            .and()                
            .authenticationProvider(provider)
    }
}

@Configuration
@Order(2)
class BarWebSecurityConfiguration(val provider: BarProvider) : WebSecurityConfigurerAdapter() {

    override fun configure(http: HttpSecurity) {
        http.antMatcher("/bar/**")
            .authorizeRequests()
            .antMatchers("/bar/**")
            .fullyAuthenticated()              
            .and()
            .authenticationProvider(provider)
    }
}