Java Spring Security AuthenticationCredentialsNotFoundException,SecurityContextHolder.getContext为null
我有一个奇怪的错误,几个小时的调试,我无法理解 更新1:我使用运行在Tomcat 7上的Spring Security 4.0.3 问题很接近,可能是Java Spring Security AuthenticationCredentialsNotFoundException,SecurityContextHolder.getContext为null,java,spring,spring-security,Java,Spring,Spring Security,我有一个奇怪的错误,几个小时的调试,我无法理解 更新1:我使用运行在Tomcat 7上的Spring Security 4.0.3 问题很接近,可能是SecurityContextHolder在response.redirect()过程中丢失,但答案没有帮助 这个问题似乎也很接近,但答案对我来说毫无意义 这是我的配置: @Configuration @EnableWebSecurity @EnableGlobalMethodSecurity(securedEnabled = true) publ
SecurityContextHolder
在response.redirect()
过程中丢失,但答案没有帮助
这个问题似乎也很接近,但答案对我来说毫无意义
这是我的配置:
@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(securedEnabled = true)
public class ProjectSecurityConfiguration extends WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity http) throws Exception {
http.csrf().disable();
http.authorizeRequests().antMatchers("/login").anonymous();
}
@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.inMemoryAuthentication().withUser(Constants.PROFIL_ADMIN).password(Constants.PROFIL_ADMIN).
roles("ADMIN","TEST_SERVICE");
}
}
登录后,我尝试获取安全的URL:
@RequestMapping(value = "/myurl", method = RequestMethod.GET)
@ResponseBody
public boolean getTestService(HttpServletRequest request)
throws SQLException, PoRulesException {
System.out.println("get security context");
System.out.println("--------------------");
SecurityContext secuContext = (SecurityContext) request.getSession().getAttribute("SPRING_SECURITY_CONTEXT");
System.out.println(secuContext);
System.out.println("get security context holder");
System.out.println(SecurityContextHolder.getContext());
return testService.getTestMethod();
}
服务内部的方法
@Secured("ROLE_TEST_SERVICE")
public boolean getTestMethod() {
Sysout.out.println("Hiii")
return true
}
现在,当日志不起作用时,将显示日志:
INFO 2016-07-11 15:57:00,006 [http-bio-8080-exec-3] com.po.mvc.controller.LoginController - Login
INFO 2016-07-11 15:57:00,057 [http-bio-8080-exec-3] com.po.mvc.controller.LoginController - User : axel
INFO 2016-07-11 15:57:00,065 [http-bio-8080-exec-3] com.po.mvc.controller.LoginController - Authenticate : true
INFO 2016-07-11 15:57:00,065 [http-bio-8080-exec-3] com.po.mvc.controller.LoginController - Authenticate : org.springframework.security.authentication.UsernamePasswordAuthenticationToken@bbbc4f45: Principal: org.springframework.security.core.userdetails.User@fc8a: Username: ADM; Password: [PROTECTED]; Enabled: true; AccountNonExpired: true; credentialsNonExpired: true; AccountNonLocked: true; Granted Authorities: ROLE_ADMIN,ROLE_CONSULTER_CA,ROLE_USER; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@fffde5d4: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: 613DFE47B2CE6E29DA3C227F8E028590; Granted Authorities: ROLE_ADMIN, ROLE_TEST_SERVICE
get security context
--------------------
org.springframework.security.core.context.SecurityContextImpl@bbbc4f45: Authentication: org.springframework.security.authentication.UsernamePasswordAuthenticationToken@bbbc4f45: Principal: org.springframework.security.core.userdetails.User@fc8a: Username: ADM; Password: [PROTECTED]; Enabled: true; AccountNonExpired: true; credentialsNonExpired: true; AccountNonLocked: true; Granted Authorities: ROLE_ADMIN,ROLE_CONSULTER_CA,ROLE_USER; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@fffde5d4: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: 613DFE47B2CE6E29DA3C227F8E028590; Granted Authorities: ROLE_ADMIN, ROLE_TEST_SERVICE
get security context holder
org.springframework.security.core.context.SecurityContextImpl@ffffffff: Null authentication
ERROR 2016-07-11 15:57:01,960 [http-bio-8080-exec-10] com.po.exception.GlobalControllerExceptionHandler - org.springframework.security.authentication.AuthenticationCredentialsNotFoundException: An Authentication object was not found in the SecurityContext
org.springframework.security.authentication.AuthenticationCredentialsNotFoundException: An Authentication object was not found in the SecurityContext
at org.springframework.security.access.intercept.AbstractSecurityInterceptor.credentialsNotFound(AbstractSecurityInterceptor.java:378)
at org.springframework.security.access.intercept.AbstractSecurityInterceptor.beforeInvocation(AbstractSecurityInterceptor.java:222)
at org.springframework.security.access.intercept.aopalliance.MethodSecurityInterceptor.invoke(MethodSecurityInterceptor.java:64)
at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179)
at org.springframework.aop.framework.CglibAopProxy$DynamicAdvisedInterceptor.intercept(CglibAopProxy.java:655)
at com.po.service.CAService$$EnhancerBySpringCGLIB$$f6e21857.getVarAndPrevCa(<generated>)
at com.po.mvc.controller.CaController.getVarAndPrevCa(CaController.java:56)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:606)
at org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:222)
at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:137)
at org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:110)
at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandlerMethod(RequestMappingHandlerAdapter.java:814)
at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:737)
at org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:85)
at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:959)
at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:893)
at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:969)
at org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java:860)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:621)
at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:845)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:722)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:304)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:224)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:169)
at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:472)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:168)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:100)
at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:929)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:118)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:405)
at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:964)
at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:515)
at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:304)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
at java.lang.Thread.run(Thread.java:745)
它工作时与不工作时的唯一区别是:
- 当我从我的网站的某个页面进行连接时工作,例如我在
上,这是一个公共网站,并且进入mywebsite.com
它工作mywebsite.com/login?user=me
- 但是如果我来自谷歌,在
mywebsite.com/login?user=me
SPRING\u SECURITY\u CONTEXT
在这两种情况下都是设置的,但不设置SecurityContextHolder
,它在@securied
内部触发了异常
我不想在方法(重定向后)中使用诸如手动检查SecurityContextHolder之类的技巧,如果是
null
设置会话属性SPRING\u SECURITY\u CONTEXT
,它不是null
,我想从根本上解决问题。假设您无法与现有SSO提供程序集成,下面的解决方案可能是您所希望的最佳解决方案
从根本上说,除非您将自己限制在容器中的一个线程内,否则您所做的事情不会起作用(这是一个糟糕的想法)。从SecurityContextHolder
上的文档:
将给定的SecurityContext
与当前执行线程关联
这很重要-当前执行线程。如果发出由线程a处理的登录请求,则尝试转到安全页面,但此请求由线程B处理,则在a上设置的SecurityContext
在B上将不可用
通过在会话中存储安全上下文并根据需要存储/获取它(请参见org.springframework.Security.web.session.SessionManagementFilter
),Spring Security完全能够为您处理此问题。不过,您需要对配置进行一些更改
首先,您需要创建一个从AbstractAuthenticationProcessingFilter
扩展的新类,并重写attemptAuthentication
方法。然后需要注册这个新过滤器,并且需要替换现有的org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter
。该类也是一个很好的地方,可以了解这一切是如何联系在一起的,以及您可以配置什么
这个新的过滤器将按照
public Authentication attemptAuthentication(HttpServletRequest request,
HttpServletResponse response) throws AuthenticationException {
UserLDAP ldapUser = CorpLDAP.findUser(request);
User user = new User(ldapUser.getProfil(), ldapUser.getPwd(), Collections.emptyList());
return new UsernamePasswordAuthenticationToken(user, "", Collections.emptyList());
}
这将返回一个完全经过身份验证的用户,稍后可以使用该用户。这是将存储在SecurityContextHolder
中的内容,可以轻松检索。它还将存储在会话中(如果已配置),因此我建议确保它是可序列化的。由于您不使用密码,我强烈建议不要将其存储在用户
中
希望这将为您指明正确的方向。我终于在这里找到了解决方案 我的配置缺少这一点 最后一步是我们需要映射springSecurityFilterChain。我们可以 通过扩展AbstractSecurityWebApplicationInitializer可以轻松做到这一点 以及可选地重写方法以自定义映射 下面最基本的示例接受默认映射并添加 springSecurityFilterChain具有以下特征: springSecurityFilterChain映射到“/*”springSecurityFilterChain 使用错误和请求的分派类型 springSecurityFilterChain映射在任何servlet之前插入 已配置的筛选器映射 仅仅添加那个类就解决了问题,如果不是,你可以添加@Order “WebApplicationInitializer的订购” 如果在之后添加了任何servlet筛选器映射 AbstractSecurityWebApplicationInitializer被调用,它们可能是 在springSecurityFilterChain之前意外添加。除非 应用程序包含不需要保护的筛选器实例, springSecurityFilterChain应位于任何其他筛选器映射之前。 @Order注释可用于帮助确保 WebApplicationInitializer以确定性顺序加载 订单(1) 公共类SpringWebMvcInitializer扩展 AbstractAnnotationConfigDispatchersServletInitializer{ @凌驾 受保护类[]getRootConfigClasses(){ 返回新类[]{HelloWebSecurityConfiguration.Class}; } ... } @订单(2) 公共类安全WebApplicationInitializer 扩展AbstractSecurityWebApplicationInitializer{ }
在控制器内部的SecurityContext中设置身份验证对象,而不是在Filter>Manager>Provider的经典Spring安全模式中设置身份验证对象,这听起来有些离谱。尽管如此,我还是看到了离谱的东西。根据UsernamePasswordAuthenticationTokenAPI,它有两个构造函数;一个获取和(对象主体、对象凭据),生成未经身份验证的令牌,另一个获取(对象主体、对象凭据、集合什么样的SSO?如果您使用SAML或OAuth,与之适当集成可能会更有意义,而不是尝试使用Spring安全性。如果不是,那么它将有点棘手。老实说,这是一家非常大的公司,已经锁定了进程,我对安全性不感兴趣ty,我们必须处理提供的ldap api,它是
public Authentication attemptAuthentication(HttpServletRequest request,
HttpServletResponse response) throws AuthenticationException {
UserLDAP ldapUser = CorpLDAP.findUser(request);
User user = new User(ldapUser.getProfil(), ldapUser.getPwd(), Collections.emptyList());
return new UsernamePasswordAuthenticationToken(user, "", Collections.emptyList());
}
public class SecurityWebApplicationInitializer
extends AbstractSecurityWebApplicationInitializer {
}
@Order(1)
public class SpringWebMvcInitializer extends
AbstractAnnotationConfigDispatcherServletInitializer {
@Override
protected Class<?>[] getRootConfigClasses() {
return new Class[] { HelloWebSecurityConfiguration.class };
}
...
}
@Order(2)
public class SecurityWebApplicationInitializer
extends AbstractSecurityWebApplicationInitializer {
}