谷歌的带有openid的Spring安全性在生产环境中不起作用答案

【问题标题】：Spring security with openid for google not working in production environment谷歌的带有openid的Spring安全性在生产环境中不起作用
【发布时间】：2012-08-27 10:46:34
【问题描述】：

我正在使用 spring mvc 和 spring security（版本 3.1）。该网络应用程序为用户提供了使用 google/gmail 帐户进行登录的选项。这在我的开发环境中运行良好，但是当部署到生产服务器时，注册过程失败，因为在提供正确的 google 凭据时显示错误凭据异常事件。这是我的 spring-security.xml 配置中的 openid 配置：

<openid-login   
    login-processing-url="/j_spring_openid_security_check"
    default-target-url="/home"
    user-service-ref="userOpenIdDetailsService" 
    authentication-failure-handler-ref="openIdAuthFailureHandler"/>
<logout logout-success-url="/login?rc=2" />

<beans:bean id="userOpenIdDetailsService" class="com.xxx.service.OpenIdUserDetailsServiceImpl"/>

<beans:bean id="openIdAuthFailureHandler" class="com.xxx.controllers.OpenIDAuthenticationFailureHandler">
    <beans:property name="defaultFailureUrl" value="/login?rc=6"/>
</beans:bean>

我已经实现了一个身份验证失败处理程序来处理注册过程，当返回一个 openid 身份但未在我的数据库中注册时：

public class OpenIDAuthenticationFailureHandler extends
    SimpleUrlAuthenticationFailureHandler {

    private static Logger logger = Logger.getLogger(OpenIDAuthenticationFailureHandler.class);

    @Override
    public void onAuthenticationFailure(HttpServletRequest request,
        HttpServletResponse response,              org.springframework.security.core.AuthenticationException exception)
        throws IOException, ServletException {      
            if(exception instanceof UsernameNotFoundException
                && exception.getAuthentication() instanceof OpenIDAuthenticationToken
                && ((OpenIDAuthenticationToken)exception.getAuthentication()).
                getStatus().equals(OpenIDAuthenticationStatus.SUCCESS)) {
                    DefaultRedirectStrategy redirectStrategy = new          DefaultRedirectStrategy();

                    OpenIDAuthenticationToken token = (OpenIDAuthenticationToken)exception.getAuthentication();
                    String url = token.getIdentityUrl();

                    request.getSession(true).setAttribute("USER_OPENID_CREDENTIAL", url);
                    String inviteId = (String)request.getSession().getAttribute("INVITE_ID");
                    if (inviteId != null) {
                        redirectStrategy.sendRedirect(request, response, "/setup/invite/" + inviteId + "/complete");
                    } else {            
                        //redirect to create account page
                        redirectStrategy.sendRedirect(request, response, "/setup/openid/complete");
                    }
                } else {
                    OpenIDAuthenticationToken token = (OpenIDAuthenticationToken)exception.getAuthentication();
                    logger.debug("Token Identity: " + token.getIdentityUrl());
                    logger.debug("Open ID authentication failure: " + exception.getMessage());
                    logger.debug("Auth Exception: " + exception.toString());
                    super.onAuthenticationFailure(request, response, exception);
                }
        }
}

所以我期待一个 UsernameNotFoundException，它在上面的注册处理程序中处理，但我得到一个 org.springframework.security.authentication.BadCredentialsException。从日志中：

Log --> 10:19:17 DEBUG org.springframework.security.openid.OpenIDAuthenticationFilter - Supplied OpenID identity is https://www.google.com/accounts/o8/id?id=open-id-token-here
Log --> 10:19:17 DEBUG org.springframework.security.openid.OpenIDAuthenticationFilter - Authentication request failed: org.springframework.security.authentication.BadCredentialsException: Log in failed - identity could not be verified
Log --> 10:19:17 DEBUG org.springframework.security.openid.OpenIDAuthenticationFilter - Updated SecurityContextHolder to contain null Authentication
Log --> 10:19:17 DEBUG org.springframework.security.openid.OpenIDAuthenticationFilter - Delegating to authentication failure handlercom.xxx.controllers.OpenIDAuthenticationFailureHandler@435fef7d
Log --> 10:19:17 DEBUG com.xxx.controllers.OpenIDAuthenticationFailureHandler - Token Identity: Unknown
Log --> 10:19:17 DEBUG com.xxx.controllers.OpenIDAuthenticationFailureHandler - Open ID authentication failure: Log in failed - identity could not be verified
Log --> 10:19:17 DEBUG com.xxx.controllers.OpenIDAuthenticationFailureHandler - Auth Exception: org.springframework.security.authentication.BadCredentialsException: Log in failed - identity could not be verified

【问题讨论】：

今天我也开始发生这种情况。我的设置已经工作了几个月，突然我开始收到相同的“登录失败 - 无法验证身份”BadCredentialsException。一切都在我的开发机器上运行，但在我的生产环境中失败。你的问题解决了吗？
从未找到解决此特定问题的方法，尽管必须有人在生产中使用此特定设置..

标签： spring-mvc spring-security openid

【解决方案1】：

事实证明，生产服务器上的时钟可能与用于验证 OpenId 请求的互联网时间不同步。就我而言，我的服务器已经运行了 177 天而没有重新启动。服务器时钟差了一分钟。重新启动即可解决问题。否则，将服务器时钟与互联网时间服务器同步也可以解决问题。

【讨论】：