Java 为什么@AuthenticationPrincipal返回身份验证而不是主体对象？

我想用注释在控制器方法中检索当前用户。文件规定如下：

将方法参数或方法返回值绑定到Authentication.getPrincipal（）的注释

但事实上，我得到的是

Authentication

对象，而不是

Authentication.getPrincipal（）

这是我的简单控制器方法：

@RequestMapping("/")
public @ResponseBody String index(@AuthenticationPrincipal final WindowsAuthenticationToken user) {
    return String.format("Welcome to the home page, %s!", user.getName());
}

实现

身份验证

。在这个实现中，

getPrincipal

返回一个

上面的控制器方法可以工作，但当我将参数类型更改为

WindowsPrincipal

并尝试访问网站时，会出现以下错误页面：

Whitelabel Error Page

This application has no explicit mapping for /error, so you are seeing this as a fallback.

Tue Mar 03 15:13:52 CET 2015
There was an unexpected error (type=Internal Server Error, status=500).
argument type mismatch HandlerMethod details: Controller [pkg.HomeController] Method [public java.lang.String pkg.HomeController.index(waffle.servlet.WindowsPrincipal)] Resolved arguments: [0] [type=waffle.spring.WindowsAuthenticationToken] [value=waffle.spring.WindowsAuthenticationToken@121a2581]

这是我的配置文件：

package pkg;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.annotation.web.servlet.configuration.EnableWebMvcSecurity;
import org.springframework.security.web.authentication.www.BasicAuthenticationFilter;

import waffle.servlet.spi.BasicSecurityFilterProvider;
import waffle.servlet.spi.NegotiateSecurityFilterProvider;
import waffle.servlet.spi.SecurityFilterProvider;
import waffle.servlet.spi.SecurityFilterProviderCollection;
import waffle.spring.NegotiateSecurityFilter;
import waffle.spring.NegotiateSecurityFilterEntryPoint;
import waffle.windows.auth.impl.WindowsAuthProviderImpl;

@Configuration
@EnableWebMvcSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private NegotiateSecurityFilterEntryPoint negotiateSecurityFilterEntryPoint;

    @Autowired
    private NegotiateSecurityFilter waffleNegotiateSecurityFilter;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.exceptionHandling().authenticationEntryPoint(negotiateSecurityFilterEntryPoint).and()
                .addFilterBefore(waffleNegotiateSecurityFilter, BasicAuthenticationFilter.class).authorizeRequests()
                .anyRequest().fullyAuthenticated();
    }

    @Bean
    public WindowsAuthProviderImpl waffleAuthProvider() {
        return new WindowsAuthProviderImpl();
    }

    @Bean
    public NegotiateSecurityFilterProvider negotiateSecurityFilterProvider(
            final WindowsAuthProviderImpl waffleAuthProvider) {
        return new NegotiateSecurityFilterProvider(waffleAuthProvider);
    }

    @Bean
    public BasicSecurityFilterProvider basicSecurityFilterProvider(final WindowsAuthProviderImpl waffleAuthProvider) {
        return new BasicSecurityFilterProvider(waffleAuthProvider);
    }

    @Bean
    public SecurityFilterProviderCollection waffleSecurityFilterProviderCollection(
            final NegotiateSecurityFilterProvider negotiateSecurityFilterProvider,
            final BasicSecurityFilterProvider basicSecurityFilterProvider) {
        final SecurityFilterProvider[] providers = { negotiateSecurityFilterProvider, basicSecurityFilterProvider };

        return new SecurityFilterProviderCollection(providers);
    }

    @Bean
    public NegotiateSecurityFilterEntryPoint negotiateSecurityFilterEntryPoint(
            final SecurityFilterProviderCollection waffleSecurityFilterProviderCollection) {
        final NegotiateSecurityFilterEntryPoint entryPoint = new NegotiateSecurityFilterEntryPoint();

        entryPoint.setProvider(waffleSecurityFilterProviderCollection);

        return entryPoint;
    }

    @Bean
    public NegotiateSecurityFilter waffleNegotiateSecurityFilter(
            final SecurityFilterProviderCollection waffleSecurityFilterProviderCollection) {
        final NegotiateSecurityFilter filter = new NegotiateSecurityFilter();

        filter.setProvider(waffleSecurityFilterProviderCollection);

        return filter;
    }

}

---

为什么行为与应该的不同？

这是因为您的

WindowsPrincipal

实现了

Principal

。删除implements子句，它将再次工作。我遇到了同样的问题，这就解决了它。

我的主要对象没有实现

UserDetails

。因为

WindowsPrincipal

是外部库的一个类，所以我无法对其进行任何更改。最后，我创建了一个新的过滤器，将

WindowsPrincipal

封装在一个实现

UserDetails

的类中。现在，我使用

@AuthenticationPrincipal

获得了正确的主体对象。请发布包装类好吗？@PabloKarlsson不幸的是，我再也无法访问它了。但是包装器类不是棘手的部分。只需创建一个实现

UserDetails

的类，该类的成员类型为

WindowsPrincipal

。然后决定哪些方法委托给

WindowsPrincipal

。据我所知，您还需要一个自定义的

Authentication

类来保存

UserDetails

。