我有一个 auth-cas 库,它为我的 Spring Boot 项目提供身份验证。
在这个 auth-cas 库中有一个类扩展WebSecurityConfigurerAdapter
具有以下配置功能
@Override
@ConditionalOnProperty(value = "ugent.cas.serviceUrl", matchIfMissing = true)
@ConditionalOnClass(Cas.class)
protected void configure(HttpSecurity http) throws Exception {
http.exceptionHandling().authenticationEntryPoint(casAuthenticationEntryPoint());
if (basicAuthenticationProviders != null) {
http.addFilter(basicAuthFilter());
}
http.addFilter(casAuthenticationFilter())
.addFilter(requestSSOLogoutToCASServerLogoutFilter())
.logout()
.deleteCookies("JSESSIONID")
.permitAll()
.logoutSuccessUrl("/logout.html")
.and()
.csrf()
.disable()
.headers()
.frameOptions()
.disable();
http.authorizeRequests()
.antMatchers(HttpMethod.OPTIONS, "/api/**").permitAll()
.antMatchers("/**").authenticated();
}
因为这应该是黑匣子,所以我添加了自己的WebSecurityConfigurerAdapter
看起来像这样:
@Configuration
//@Order(Integer.MAX_VALUE)
//@Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)
@Order(1)
public class AuthSecurityConfiguration extends WebSecurityConfigurerAdapter {
@Override
public void configure(WebSecurity webSecurity) throws Exception {
webSecurity
.ignoring()
// All of Spring Security will ignore the requests
.antMatchers("/choose.html")
.antMatchers("/account/*");
}
@Override
protected void configure(HttpSecurity http) throws Exception {
http/*.addFilter(usernamePasswordAuthenticationFilter())
.formLogin()
.permitAll()
.and()
.logout()
.deleteCookies("JSESSIONID")
.permitAll()
.logoutSuccessUrl("/logout.html")
.and()
.csrf()
.disable()
.headers()
.frameOptions()
.disable();
*/
.authorizeRequests()
.anyRequest().authenticated()
.and()
.authenticationProvider(AuthenticationProvider())
.formLogin()
.permitAll()
.and()
.csrf()
.disable()
.headers()
.frameOptions()
.disable()
;
}
@Bean
public AuthenticationProvider AuthenticationProvider() {
return new LCAAuthenticationProvider();
}
@Bean
public UsernamePasswordAuthenticationFilter usernamePasswordAuthenticationFilter () throws Exception{
UsernamePasswordAuthenticationFilter filter = new UsernamePasswordAuthenticationFilter ();
filter.setAuthenticationManager(authenticationManager());
return filter;
}
}
我的自定义 AuthenticationProvider 实现了“AuthenticationProvider”,并在页面中将我重定向到 /login 页面,并且我可以使用用户库中的凭据登录。
唯一的问题是,当我已经登录到另一个 auth cas 网络时,我应该经过身份验证,但它仍然提示我使用自定义身份验证提供程序。
我需要如何配置 HttpSecurity 以便它与我的 2 个身份验证提供程序一起使用。
其他相关问题,我如何从被忽略的页面 /choose.html 中提供使用 2 个身份验证提供程序之一登录的选项?
EDIT
这是我当前的“WebSecurityConfigurererAdapter”配置
@Configuration
//@Order(Integer.MAX_VALUE)
//@Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)
@Order(0)
public class AuthSecurityConfiguration extends WebSecurityConfigurerAdapter {
/**
* The authProvider bean used as a cas authentication provider.
*/
@Autowired
private LCAAuthenticationProvider authProvider;
@Override
public void configure(WebSecurity webSecurity) throws Exception {
webSecurity
.ignoring()
// All of Spring Security will ignore the requests
.antMatchers("/choose.html")
.antMatchers("/account/*");
}
@Autowired
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
auth.authenticationProvider(authProvider);
}
/**
* The authenticationManagerBean bean.
*
* @return the authenticationManagerBean
* @throws Exception
*/
@Override
public AuthenticationManager authenticationManagerBean() throws Exception {
return super.authenticationManagerBean();
}
/**
* The loginUrlAuthenticationEntryPoint bean
*
* @return the loginUrlAuthenticationEntryPoint
*/
@Bean
public LoginUrlAuthenticationEntryPoint loginUrlAuthenticationEntryPoint() {
LoginUrlAuthenticationEntryPoint ep = new LoginUrlAuthenticationEntryPoint("/choose.html");
//ep.setLoginUrl(cas.getLoginUrl());
return ep;
}
@Override
protected void configure(HttpSecurity http) throws Exception {
http.exceptionHandling().authenticationEntryPoint(loginUrlAuthenticationEntryPoint());
http.addFilter(usernamePasswordAuthenticationFilter())
.formLogin()
.permitAll()
.and()
.logout()
.deleteCookies("JSESSIONID")
.permitAll()
.logoutSuccessUrl("/logout.html")
.and()
.csrf()
.disable()
.headers()
.frameOptions()
.disable();
/*
.authorizeRequests()
.anyRequest().authenticated()
.and()
.authenticationProvider(AuthenticationProvider())
.formLogin()
.loginPage("choose.html")
.permitAll()
.and()
.csrf()
.disable()
.headers()
.frameOptions()
.disable()
;
*/
}
@Bean
public LCAAuthenticationProvider lcaAuthenticationProvider() {
return new LCAAuthenticationProvider();
}
@Bean
public UsernamePasswordAuthenticationFilter usernamePasswordAuthenticationFilter () throws Exception{
UsernamePasswordAuthenticationFilter filter = new UsernamePasswordAuthenticationFilter ();
filter.setAuthenticationManager(authenticationManager());
return filter;
}
}
但我收到以下错误:
Exception in thread "main" java.lang.RuntimeException: java.lang.reflect.InvocationTargetException
at org.springframework.boot.loader.MainMethodRunner.run(MainMethodRunner.java:62)
at java.lang.Thread.run(Unknown Source)
Caused by: java.lang.reflect.InvocationTargetException
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
at java.lang.reflect.Method.invoke(Unknown Source)
at org.springframework.boot.loader.MainMethodRunner.run(MainMethodRunner.java:54)
... 1 more
Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'springSecurityFilterChain' defined in class path resource [org/springframework/security/config/annotation/web/configuration/WebSecurityConfiguration.class]: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [javax.servlet.Filter]: Factory method 'springSecurityFilterChain' threw exception; nested exception is org.springframework.security.config.annotation.AlreadyBuiltException: This object has already been built
at org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:599)
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateUsingFactoryMethod(AbstractAutowireCapableBeanFactory.java:1123)
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1018)
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:510)
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:482)
at org.springframework.beans.factory.support.AbstractBeanFactory$1.getObject(AbstractBeanFactory.java:306)
at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:230)
at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:302)
at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:197)
at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:296)
at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:197)
at org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingletons(DefaultListableBeanFactory.java:772)
at org.springframework.context.support.AbstractApplicationContext.finishBeanFactoryInitialization(AbstractApplicationContext.java:839)
at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:538)
at org.springframework.boot.context.embedded.EmbeddedWebApplicationContext.refresh(EmbeddedWebApplicationContext.java:118)
at org.springframework.boot.SpringApplication.refresh(SpringApplication.java:766)
at org.springframework.boot.SpringApplication.createAndRefreshContext(SpringApplication.java:361)
at org.springframework.boot.SpringApplication.run(SpringApplication.java:307)
at org.springframework.boot.SpringApplication.run(SpringApplication.java:1191)
at org.springframework.boot.SpringApplication.run(SpringApplication.java:1180)
at be.ugent.lca.Application.main(Application.java:16)
... 6 more
Caused by: org.springframework.beans.BeanInstantiationException: Failed to instantiate [javax.servlet.Filter]: Factory method 'springSecurityFilterChain' threw exception; nested exception is org.springframework.security.config.annotation.AlreadyBuiltException: This object has already been built
at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:189)
at org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:588)
... 26 more
Caused by: org.springframework.security.config.annotation.AlreadyBuiltException: This object has already been built
at org.springframework.security.config.annotation.AbstractSecurityBuilder.build(AbstractSecurityBuilder.java:44)
at org.springframework.security.config.annotation.web.configuration.WebSecurityConfiguration.springSecurityFilterChain(WebSecurityConfiguration.java:105)
at org.springframework.security.config.annotation.web.configuration.WebSecurityConfiguration$$EnhancerBySpringCGLIB$$699e3cc3.CGLIB$springSecurityFilterChain$2(<generated>)
at org.springframework.security.config.annotation.web.configuration.WebSecurityConfiguration$$EnhancerBySpringCGLIB$$699e3cc3$$FastClassBySpringCGLIB$$e656a0ba.invoke(<generated>)
at org.springframework.cglib.proxy.MethodProxy.invokeSuper(MethodProxy.java:228)
at org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:355)
at org.springframework.security.config.annotation.web.configuration.WebSecurityConfiguration$$EnhancerBySpringCGLIB$$699e3cc3.springSecurityFilterChain(<generated>)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
at java.lang.reflect.Method.invoke(Unknown Source)
at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:162)
我可以将错误追溯到第 44 行https://github.com/spring-projects/spring-security/blob/master/config/src/main/java/org/springframework/security/config/annotation/AbstractSecurityBuilder.java https://github.com/spring-projects/spring-security/blob/master/config/src/main/java/org/springframework/security/config/annotation/AbstractSecurityBuilder.java但我找不到是什么原因造成的