Session Spring安全预认证-即使主体未更改,也为我提供了一个新会话
为了与Tivoli Access Manager集成,我在Grails应用程序中实现了一个spring安全预认证过滤器 对于我的web应用程序中的每个请求,都会调用过滤器——尽管过滤器返回与前一个请求相同的主体,但它似乎创建了一个新会话。我已经创建了一个ApplicationListener来侦听身份验证事件,我可以看到一个新的AuthenticationSuccessEvent,每个请求都有一个新的会话id 这意味着我的所有会话变量在每次请求时都会被清除——这没什么大不了的,但它破坏了Uploader插件 当我为预验证筛选器打开调试日志时,我看到它认为主体已更改,即使它没有:Session Spring安全预认证-即使主体未更改,也为我提供了一个新会话,session,grails,spring-security,Session,Grails,Spring Security,为了与Tivoli Access Manager集成,我在Grails应用程序中实现了一个spring安全预认证过滤器 对于我的web应用程序中的每个请求,都会调用过滤器——尽管过滤器返回与前一个请求相同的主体,但它似乎创建了一个新会话。我已经创建了一个ApplicationListener来侦听身份验证事件,我可以看到一个新的AuthenticationSuccessEvent,每个请求都有一个新的会话id 这意味着我的所有会话变量在每次请求时都会被清除——这没什么大不了的,但它破坏了Uplo
2015-03-04 11:34:57.769 foobar.TamAuthenticationFilter Checking secure context token: org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationToken@f0666480: Principal: grails.plugin.springsecurity.userdetails.GrailsUser@3125618: Username: 66734; Password: [PROTECTED]; Enabled: true; AccountNonExpired: true; credentialsNonExpired: true; AccountNonLocked: true; Granted Authorities: ROLE_ADMIN,ROLE_APPROVER; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@fffde5d4: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: 87928D9E25D98DD3CCFAC5D67689E609; Granted Authorities: ROLE_ADMIN, ROLE_APPROVER
2015-03-04 11:34:57.770 foobar.TamAuthenticationFilter Pre-authenticated principal has changed to 66734 and will be reauthenticated
2015-03-04 11:34:57.770 foobar.TamAuthenticationFilter Invalidating existing session
2015-03-04 11:34:57.771 foobar.TamAuthenticationFilter preAuthenticatedPrincipal = 66734, trying to authenticate
如何使spring security对预身份验证筛选器返回的每个主体使用相同的会话,而不是为每个请求创建一个新的会话
这是我的过滤器:
package foobar
import org.springframework.security.web.authentication.preauth.AbstractPreAuthenticatedProcessingFilter
import grails.util.Environment
import grails.util.Holders
import groovy.util.logging.Log4j
@Log4j
class TamAuthenticationFilter extends AbstractPreAuthenticatedProcessingFilter {
java.lang.Object getPreAuthenticatedCredentials(javax.servlet.http.HttpServletRequest request)
{
"N/A"
}
java.lang.Object getPreAuthenticatedPrincipal(javax.servlet.http.HttpServletRequest request)
{
Long staffId = getStaffIdFromTamHeader(request)
if(!staffId)
log.error "iv-user header not found"
return staffId
}
/**
* Get Staff ID from the ivUser Tamheader.
* @param request
* @return
*/
static public Long getStaffIdFromTamHeader(request) {
return request.getHeader("iv-user")
}
}
LoggingSecurityEventListener:
package foobar
import groovy.util.logging.Log4j
import org.springframework.context.ApplicationListener
import org.springframework.security.authentication.event.AbstractAuthenticationEvent
@Log4j
class LoggingSecurityEventListener implements
ApplicationListener<AbstractAuthenticationEvent> {
void onApplicationEvent(AbstractAuthenticationEvent event) {
def username = event.authentication.principal
def address = event.authentication.details.remoteAddress
def sessionId = event.authentication.details.sessionId
log.info "event=${event.class.simpleName} username=${username} remoteAddress=${address} sessionId=${sessionId}"
}
}
config.groovy:
grails.plugin.springsecurity.useSecurityEventListener = true
grails.plugin.springsecurity.providerNames = ['tamAuthenticationProvider']
grails.plugin.springsecurity.userLookup.userDomainClassName = 'strobe.auth.User'
grails.plugin.springsecurity.userLookup.authorityJoinClassName = 'strobe.auth.UserRole'
grails.plugin.springsecurity.authority.className = 'strobe.auth.Role'
grails.plugin.springsecurity.securityConfigType="InterceptUrlMap"
grails.plugin.springsecurity.interceptUrlMap = [
'/foobar/**': ['ROLE_USER']]
bootstrap.groovy:
def init = { servletContext -> SpringSecurityUtils.clientRegisterFilter('tamAuthenticationFilter',
SecurityFilterPosition.PRE_AUTH_FILTER.order + 10)
}
我已经找到了问题的解决方案-我从getPreauthenticatedPrincipal()返回了一个很长的值,这混淆了spring安全性,因为AbstractPreauthenticatedProcessingFilter中的方法requiresAuthentication()有以下代码行:
if ((principal instanceof String) && currentUser.getName().equals(principal)) {
return false;
}
它希望主体是字符串。每次我返回一个长会话,它都会重新验证并给我一个新会话
我真不敢相信解决方案竟如此简单,我花了两天时间才弄明白
我认为问题的一部分在于spring中关于预验证的文档很少,还有以下方法签名:
java.lang.Object getPreAuthenticatedPrincipal(javax.servlet.http.HttpServletRequest request)
这并不清楚地表明返回类型
java.lang.Object getPreAuthenticatedPrincipal(javax.servlet.http.HttpServletRequest request)