Spring Security for SiteMinder 的存在仅用于接收用户。但是,要接收角色,您需要创建扩展的身份验证过程。这将使用角色对用户进行身份验证。
内root-security.xml
<beans:bean id="userDetailsService" class="test.sm.SiteMinderUserDetailsService"/>
<beans:bean id="preauthAuthProvider" class="org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationProvider">
<beans:property name="preAuthenticatedUserDetailsService">
<beans:bean id="userDetailsServiceWrapper" class="org.springframework.security.core.userdetails.UserDetailsByNameServiceWrapper">
<beans:property name="userDetailsService" ref="userDetailsService" />
</beans:bean>
</beans:property>
</beans:bean>
<beans:bean id="siteminderFilter" class="test.sm.SiteMinderFilter">
<beans:property name="principalRequestHeader" value="SM_USER" />
<beans:property name="rolesRequestHeader" value="SM_ROLE" />
<beans:property name="rolesDelimiter" value="," />
<beans:property name="authenticationManager" ref="authenticationManager" />
</beans:bean>
<authentication-manager alias="authenticationManager">
<authentication-provider ref="preauthAuthProvider" />
</authentication-manager>
SiteMinder 用户详细信息服务
public class SiteMinderUserDetailsService extends PreAuthenticatedGrantedAuthoritiesUserDetailsService implements
UserDetailsService {
@Override
public UserDetails loadUserByUsername(String arg0) throws UsernameNotFoundException {
SiteMinderUserDetails userDetails = new SiteMinderUserDetails();
userDetails.setUsername(arg0);
return userDetails;
}
@Override
protected UserDetails createuserDetails(Authentication token, Collection<? extends GrantedAuthority> authorities) {
return super.createuserDetails(token, authorities);
}
}
SiteMinder 用户详细信息
public class SiteMinderUserDetails implements UserDetails {
// implement all methods
}
站点管理器过滤器
public class SiteMinderFilter extends RequestHeaderAuthenticationFilter {
private String rolesRequestHeader;
private String rolesDelimiter;
@Override
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException, NullPointerException {
String roles = (String) ((HttpServletRequest)request).getHeader(getRolesRequestHeader());
String[] rolesArray = roles.split(rolesDelimiter);
Collection<SimpleGrantedAuthority> auth = new ArrayList<SimpleGrantedAuthority>();
for (String s : rolesArray) {
auth.add(new SimpleGrantedAuthority(s));
}
SiteMinderUserDetails userDetails = new SiteMinderUserDetails();
userDetails.setUsername((String) super.getPreAuthenticatedPrincipal(((HttpServletRequest)request)));
userDetails.setAuthorities(auth);
AuthenticationImpl authentication = new AuthenticationImpl();
authentication.setAuthenticated(true);
authentication.setAuthorities(auth);
authentication.setPrincipal(userDetails);
authentication.setCredentials(super.getPreAuthenticatedCredentials(((HttpServletRequest)request)));
SecurityContextHolder.getContext().setAuthentication(authentication);
super.doFilter(request, response, chain);
}
public SiteMinderFilter() {
super();
}
@Override
public void setPrincipalRequestHeader(String principalRequestHeader) {
super.setPrincipalRequestHeader(principalRequestHeader);
}
public void setRolesRequestHeader(String rolesRequestHeader) {
this.rolesRequestHeader = rolesRequestHeader;
}
public String getRolesRequestHeader() {
return rolesRequestHeader;
}
public void setRolesDelimiter(String rolesDelimiter) {
this.rolesDelimiter = rolesDelimiter;
}
public String getRolesDelimiter() {
return rolesDelimiter;
}
}
认证实现
public class AuthenticationImpl implements Authentication {
// implement all methods
}