カスタムトークンに基づく認証

Question

リクエストヘッダーにカスタムトークンに基づく認証を実装しようとしています。

私はthis questionの受け入れられた答えを読んで、カスタムトークン、フィルタ、および認証プロバイダを作成しました。

問題：

私は "GET /ログイン" してみてください：

• フィルタは
• と呼ばれるトークンはauthenticationProviderが呼び出されない
• が作成されます。そのメソッドもsupportsは呼び出されません！

ブラウザコンソールでは、/loginへの2 HTTP 302の呼び出しがあります。

EDIT：実際には、認証プロバイダは、エンドポイントを角度から呼び出す（AJAX/XHR呼び出しの結果）場合にのみ無視されます。 Postmanからエンドポイントを呼び出すと、認証プロバイダが呼び出されます。

EDIT：春のセキュリティデバッグログ：

2016-10-27 19:57:46.724 DEBUG 9752 --- [nio-8080-exec-3] o.s.security.web.FilterChainProxy  : /login at position 1 of 10 in additional filter chain; firing Filter: 'WebAsyncManagerIntegrationFilter' 
2016-10-27 19:57:46.725 DEBUG 9752 --- [nio-8080-exec-3] o.s.security.web.FilterChainProxy  : /login at position 2 of 10 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter' 
2016-10-27 19:57:46.725 DEBUG 9752 --- [nio-8080-exec-3] w.c.HttpSessionSecurityContextRepository : No HttpSession currently exists 
2016-10-27 19:57:46.725 DEBUG 9752 --- [nio-8080-exec-3] w.c.HttpSessionSecurityContextRepository : No SecurityContext was available from the HttpSession: null. A new one will be created. 
2016-10-27 19:57:46.725 DEBUG 9752 --- [nio-8080-exec-3] o.s.security.web.FilterChainProxy  : /login at position 3 of 10 in additional filter chain; firing Filter: 'HeaderWriterFilter' 
2016-10-27 19:57:46.725 DEBUG 9752 --- [nio-8080-exec-3] o.s.s.w.header.writers.HstsHeaderWriter : Not injecting HSTS header since it did not match the requestMatcher org.springframework.security.web.header.writers.HstsHeaderWriter$SecureRequestMatcher@43bffae5 
2016-10-27 19:57:46.725 DEBUG 9752 --- [nio-8080-exec-3] o.s.security.web.FilterChainProxy  : /login at position 4 of 10 in additional filter chain; firing Filter: 'LogoutFilter' 
2016-10-27 19:57:46.725 DEBUG 9752 --- [nio-8080-exec-3] o.s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/login'; against '/logout' 
2016-10-27 19:57:46.725 DEBUG 9752 --- [nio-8080-exec-3] o.s.security.web.FilterChainProxy  : /login at position 5 of 10 in additional filter chain; firing Filter: 'MyFilter' 
2016-10-27 19:57:46.726 DEBUG 9752 --- [nio-8080-exec-3] w.c.HttpSessionSecurityContextRepository : SecurityContext is empty or contents are anonymous - context will not be stored in HttpSession. 
2016-10-27 19:57:46.726 DEBUG 9752 --- [nio-8080-exec-3] s.s.w.c.SecurityContextPersistenceFilter : SecurityContextHolder now cleared, as request processing completed 
2016-10-27 19:57:46.768 DEBUG 9752 --- [nio-8080-exec-4] o.s.security.web.FilterChainProxy  : /login at position 1 of 10 in additional filter chain; firing Filter: 'WebAsyncManagerIntegrationFilter' 
2016-10-27 19:57:46.769 DEBUG 9752 --- [nio-8080-exec-4] o.s.security.web.FilterChainProxy  : /login at position 2 of 10 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter' 
2016-10-27 19:57:46.769 DEBUG 9752 --- [nio-8080-exec-4] w.c.HttpSessionSecurityContextRepository : No HttpSession currently exists 
2016-10-27 19:57:46.770 DEBUG 9752 --- [nio-8080-exec-4] w.c.HttpSessionSecurityContextRepository : No SecurityContext was available from the HttpSession: null. A new one will be created. 
2016-10-27 19:57:46.770 DEBUG 9752 --- [nio-8080-exec-4] o.s.security.web.FilterChainProxy  : /login at position 3 of 10 in additional filter chain; firing Filter: 'HeaderWriterFilter' 
2016-10-27 19:57:46.771 DEBUG 9752 --- [nio-8080-exec-4] o.s.s.w.header.writers.HstsHeaderWriter : Not injecting HSTS header since it did not match the requestMatcher org.springframework.security.web.header.writers.HstsHeaderWriter$SecureRequestMatcher@43bffae5 
2016-10-27 19:57:46.771 DEBUG 9752 --- [nio-8080-exec-4] o.s.security.web.FilterChainProxy  : /login at position 4 of 10 in additional filter chain; firing Filter: 'LogoutFilter' 
2016-10-27 19:57:46.771 DEBUG 9752 --- [nio-8080-exec-4] o.s.s.w.u.matcher.AntPathRequestMatcher : Checking match of request : '/login'; against '/logout' 
2016-10-27 19:57:46.771 DEBUG 9752 --- [nio-8080-exec-4] o.s.security.web.FilterChainProxy  : /login at position 5 of 10 in additional filter chain; firing Filter: 'MyFilter' 
2016-10-27 19:57:46.772 DEBUG 9752 --- [nio-8080-exec-4] w.c.HttpSessionSecurityContextRepository : HttpSession being created as SecurityContext is non-default 
2016-10-27 19:57:46.774 DEBUG 9752 --- [nio-8080-exec-4] w.c.HttpSessionSecurityContextRepository : SecurityContext stored to HttpSession: 'org.springframework.security.core.context.SecurityContextImpl@17085d: Authentication: com.mycompany.myapp.configuration.MyToken@17085d: Principal: null; Credentials: [PROTECTED]; Authenticated: false; Details: null; Not granted any authorities' 
2016-10-27 19:57:46.774 DEBUG 9752 --- [nio-8080-exec-4] s.s.w.c.SecurityContextPersistenceFilter : SecurityContextHolder now cleared, as request processing completed 

トークン：

public class MyToken extends AbstractAuthenticationToken { 

    private String token; 

    public MyToken(String token) { 
     super(null); 
     this.token = token; 
    } 

    @Override 
    public Object getCredentials() { 
     return token; 
    } 

    @Override 
    public Object getPrincipal() { 
     return null; 
    } 
} 

フィルタ：

public class MyFilter extends AbstractAuthenticationProcessingFilter { 

    public MyFilter() { 
     super("/login"); 
    } 

    @Override 
    public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException, IOException, ServletException { 
     String x_token = request.getHeader("x_token"); 
     String method = request.getMethod(); 
     if(x_token != null && method.equals("GET")) { 
      return new MyToken(x_token); 
     } 
     return null; 
    } 
} 

認証プロバイダ：

@Component 
public class MyAuthenticationProvider implements AuthenticationProvider { 
    @Override 
    public Authentication authenticate(Authentication authentication) throws AuthenticationException { 
     MyToken token = (MyToken) authentication; 
     if(token.getCredentials() != null) { 
      token.setAuthenticated(true); 
      return token; 
     } 
     return null; 
    } 

    @Override 
    public boolean supports(Class<?> authentication) { 
     return authentication.equals(MyToken.class); 
    } 
} 

そして最後に、セキュリティ設定：あなたはAbstractAuthenticationProcessingFilterのカスタムサブクラスでAuthenticationManagerを呼び出す必要があり

@Configuration 
@EnableGlobalMethodSecurity(prePostEnabled = true) 
@Order(SecurityProperties.ACCESS_OVERRIDE_ORDER) 
public class SecurityConfiguration extends WebSecurityConfigurerAdapter { 

    @Autowired 
    private MyAuthenticationProvider myAuthenticationProvider; 

    @Override 
    protected void configure(HttpSecurity http) throws Exception { 
     // configure filters 
     http.addFilterBefore(new MyFilter(), UsernamePasswordAuthenticationFilter.class); 

     // configure authentication providers 
     http.authenticationProvider(myAuthenticationProvider); 

     // disable csrf 
     http.csrf().disable(); 

     // setup security 
     http.authorizeRequests() 
       .anyRequest() 
       .fullyAuthenticated() 
       .and().httpBasic(); 
    } 
} 

Answer 1

、Spring Security Reference次を参照してください。

フィルタは、コンフィグレーションされたAuthenticationManagerを呼び出して呼び出します各認証要求。

AbstractAuthenticationProcessingFilter#attemptAuthenticationも参照してください：

は、実際の認証を行います。認証プロセスがまだ進行中であることを示す、成功した認証

戻りヌルを示す、

1. 戻る認証されたユーザのための人口認証トークン： 実装では、次のいずれかを実行する必要があります。帰国する前に、実装はプロセスを完了するために必要な追加作業を実行する必要があります。 HttpSessionに格納されている

   たSecurityContext：：「org.springframework.securityを認証プロセスは

を失敗した場合

は、ログを参照してください、あなたの実装は、認証トークンを返さないAuthenticationExceptionを投げます。 core.context.SecurityContextImpl@17085d：認証：com.mycompany.myapp.configuration.MyToken@17085d：プリンシパル：null;資格：[プロテクト]; 認証済み：偽;詳細：null;いずれの当局の

も参照してください付与されていません：

• GaeAuthenticationFilter
• UsernamePasswordAuthenticationFilter
• OpenIDAuthenticationFilter
• CasAuthenticationFilter