Spring 3.0安全性 - 授权与认证

Question

我是Spring的新手，我的要求是我不想用用户名和密码对用户进行身份验证。 的用户身份验证是一些其他的应用和我的应用程序获得与folloing细节要求：

1. 用户名
2. 角色

我只是想使用Spring Security根据固定的页面请求中的角色。 我已经考虑编写UserDetailService，但只添加请求数据，Spring仍然要求提供认证信息。 后来我想过写类似如下：

public class UserLogin { 

/* 
@Resource(name = "userDetailsService") 
private UserDetailsService userDetailsService; 
*/ 

@Resource(name = "authenticationManager") 
private AuthenticationManager authenticationManager; 

public boolean login(UserEntity user) { 

    //UserDetails ud = userDetailsService.loadUserByUsername(username); 

    Collection<GrantedAuthority> authorities = new ArrayList<GrantedAuthority>(); 
    for (String role : user.getAuthorities()) { 
     authorities.add(new GrantedAuthorityImpl(role)); 
    } 

    UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken(user.getUsername(), user.getPassword(), authorities); 

    try { 
     Authentication auth = authenticationManager.authenticate(token); 

     SecurityContext securityContext = new SecurityContextImpl(); 

     // Places in ThredLocal for future retrieval 
     SecurityContextHolder.setContext(securityContext); 
     SecurityContextHolder.getContext().setAuthentication(auth); 

    } catch (AuthenticationException e) { 
     return false; 
    } 

    return true; 
} 
} 

上午我在正确的方向前进。如果是这样，如何配置整个事情..在spring-xml中。

Answer 1

您处于所谓的预认证方案中，在此方案中，您将Spring Security配置为仅授权访问，而不是授权访问。请参阅http://static.springsource.org/spring-security/site/docs/3.0.x/reference/preauth.html。这是一个完整的配置，您需要实施AbstractPreAuthenticatedProcessingFilter来认证您的认证方案的UserPrincipal，以及上面提到的自定义UserDetailsService。

<?xml version="1.0" encoding="UTF-8"?> 
<beans:beans 
xmlns:security="http://www.springframework.org/schema/security" 
xmlns:beans="http://www.springframework.org/schema/beans" 
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd 
        http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.0.xsd"> 

<security:global-method-security secured-annotations="enabled" /> 

<beans:bean id="preAuthenticatedProcessingFilterEntryPoint" class="org.springframework.security.web.authentication.Http403ForbiddenEntryPoint" /> 

<security:http auto-config="false" entry-point-ref="preAuthenticatedProcessingFilterEntryPoint"> 
    <security:custom-filter position="PRE_AUTH_FILTER" ref="myCustomPreAuthFilter" /> 
</security:http> 

<beans:bean id="myCustomPreAuthFilter" class="com.mypackage.MyCustomPreAuthFilter"> 
    <beans:property name="authenticationManager" ref="authenticationManager" /> 
</beans:bean> 

<security:authentication-manager alias="authenticationManager"> 
    <security:authentication-provider ref="preauthAuthProvider" /> 
</security:authentication-manager> 

<beans:bean id="preauthAuthProvider" class="org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationProvider"> 
    <beans:property name="preAuthenticatedUserDetailsService"> 
     <beans:bean id="userDetailsServiceWrapper" class="org.springframework.security.core.userdetails.UserDetailsByNameServiceWrapper"> 
      <beans:property name="userDetailsService" ref="myCustomUserDetailsService"/> 
     </beans:bean> 
    </beans:property> 
</beans:bean>