使用kerberos/spnego身份验证的弹簧安全性

Question

我使用kerberos身份验证的弹簧安全性成功工作。但似乎Spring框架正在调用KerberosServiceAuthenticationProvider.userDetailsS​​ervice来获取角色，我认为它只会获取角色一次，直到会话失效。我的配置看起来像

<?xml version="1.0" encoding="UTF-8"?> 
<beans:beans xmlns="http://www.springframework.org/schema/security" 
     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
     xmlns:util="http://www.springframework.org/schema/util" 
     xmlns:beans="http://www.springframework.org/schema/beans" 
     xsi:schemaLocation="http://www.springframework.org/schema/beans 
     http://www.springframework.org/schema/beans/spring-beans.xsd 
     http://www.springframework.org/schema/util 
     http://www.springframework.org/schema/util/spring-util-3.0.xsd 
     http://www.springframework.org/schema/security 
     http://www.springframework.org/schema/security/spring-security-3.0.xsd"> 

    <http entry-point-ref="spnegoEntryPoint" auto-config="false"> 
     <intercept-url pattern="/login*" access="IS_AUTHENTICATED_ANONYMOUSLY" /> 
     <intercept-url pattern="/j_spring_security_check*" access="IS_AUTHENTICATED_ANONYMOUSLY"/> 
    <intercept-url pattern="/**" access="IS_AUTHENTICATED_FULLY" /> 

    <custom-filter ref="spnegoAuthenticationProcessingFilter" position="BASIC_AUTH_FILTER" /> 
     <form-login login-page="/login.html" default-target-url="/" always-use-default-target="true"/> 
    </http> 

    <authentication-manager alias="authenticationManager"> 
     <authentication-provider ref="kerberosServiceAuthenticationProvider" /> 
     <authentication-provider ref="kerberosAuthenticationProvider"/> 
    </authentication-manager> 

    <beans:bean id="spnegoEntryPoint" 
    class="org.springframework.security.extensions.kerberos.web.SpnegoEntryPoint" /> 

<beans:bean id="spnegoAuthenticationProcessingFilter" 
    class="org.springframework.security.extensions.kerberos.web.SpnegoAuthenticationProcessingFilter"> 
     <beans:property name="failureHandler"> 
    <beans:bean class="org.springframework.security.web.authentication.ExceptionMappingAuthenticationFailureHandler"> 
    <beans:property name="defaultFailureUrl" value="/login.html" /> 
       <beans:property name="allowSessionCreation" value="true"/> 
    </beans:bean> 
    </beans:property> 
    <beans:property name="authenticationManager" ref="authenticationManager" /> 
</beans:bean> 

    <beans:bean id="kerberosServiceAuthenticationProvider" 
    class="org.springframework.security.extensions.kerberos.KerberosServiceAuthenticationProvider"> 
    <beans:property name="ticketValidator"> 
    <beans:bean 
    class="org.springframework.security.extensions.kerberos.SunJaasKerberosTicketValidator"> 
    <beans:property name="servicePrincipal" value="HTTP/mywebserver.corpza.corp.co.za"/> 
    <beans:property name="keyTabLocation" value="classpath:mywebserver.keytab" /> 
    <beans:property name="debug" value="true"/> 
    </beans:bean> 
    </beans:property> 
    <beans:property name="userDetailsService" ref="dummyUserDetailsService" /> 
</beans:bean> 

    <beans:bean id="kerberosAuthenticationProvider" class="org.springframework.security.extensions.kerberos.KerberosAuthenticationProvider"> 
    <beans:property name="kerberosClient"> 
    <beans:bean class="org.springframework.security.extensions.kerberos.SunJaasKerberosClient"> 
    <beans:property name="debug" value="true" /> 
    </beans:bean> 
    </beans:property> 
    <beans:property name="userDetailsService" ref="dummyUserDetailsService" /> 
</beans:bean> 

    <beans:bean class="org.springframework.security.extensions.kerberos.GlobalSunJaasKerberosConfig"> 
    <beans:property name="debug" value="true" /> 
    <beans:property name="krbConfLocation" value="/etc/krb5.conf" /> 
</beans:bean> 

    <beans:bean id="dummyUserDetailsService" class="main.server.DummyUserDetailsService"/> 

    </beans:beans> 

所以我DummyUserDetailsS​​ervice.loadUserByUsername（Styring用户名）在每次请求的安全页面时调用，我加载从数据库中的用户角色，不希望运行的查询每次请求，是否有任何配置我需要做，以防止这种情况？

Answer 1

感谢迈克尔，我把它通过扩展Sp​​negoAuthenticationProcessingFilter类并覆盖的doFilter

public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) 
      throws IOException, ServletException { 
     HttpServletRequest request = (HttpServletRequest) req; 
     HttpServletResponse response = (HttpServletResponse) res; 
     if (skipIfAlreadyAuthenticated) { 
      Authentication existingAuth = SecurityContextHolder.getContext().getAuthentication(); 
      if (existingAuth != null && existingAuth.isAuthenticated() 
        && (existingAuth instanceof AnonymousAuthenticationToken) == false) { 
       chain.doFilter(request, response); 
       return; 
      } 
     }  
     super.doFilter(req, res, chain); 
    } 

Answer 2

告知Spring Security将身份验证缓存在HTTP Session中。 Here是如何。