Spring security 将securityContext保存到SecurityContextRepository时发生异常_Spring Security_Jersey_Security

Spring security 将securityContext保存到SecurityContextRepository时发生异常

spring-security jersey security

Spring security 将securityContext保存到SecurityContextRepository时发生异常,spring-security,jersey,security,Spring Security,Jersey,Security,开始使用Spring Security保护我的一些resful服务器资源。我的客户机使用ajax（jQueryAjax）处理请求，我从实现登录功能开始 My Jersey web层包括以下内容： @Path("/login") @Component public class LoginResourceProvider extends ServiceResourceProvider { /*--- Static ---*/ private final static ILogg

开始使用Spring Security保护我的一些resful服务器资源。我的客户机使用ajax（jQueryAjax）处理请求，我从实现登录功能开始

My Jersey web层包括以下内容：

@Path("/login")
@Component
public class LoginResourceProvider extends ServiceResourceProvider {

    /*--- Static ---*/

    private final static ILogger logger = LogManager.getLogger(LoginResourceProvider.class);

    /*--- Members ---*/

    @Inject
    @Qualifier("authenticationManager")
    protected AuthenticationManager authenticationManager;

    @Inject
    protected SecurityContextRepository repository;

    @Inject
    protected RememberMeServices rememberMeServices;

    /*--- Constructors ---*/

    public LoginResourceProvider() {
    super("Login");
    }

    /*--- Public Methods ---*/

    @GET
    public void login() {
    }

    /**
     * A user login attempt
     * 
     * @param username
     *            The user name
     * @param password
     *            The password of the given user name
     * @param request
     * @param response
     * @return A JSON string, indicating if the login is successful
     */
    @POST
    @Produces(MediaType.APPLICATION_JSON)
    public String performLogin(@QueryParam("j_username") String username, @QueryParam("j_password") String password,
        @Context HttpServletRequest request, @Context HttpServletResponse response) {

    // Create a token
    UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken(username, password);
    SecurityContext securityContext = SecurityContextHolder.getContext();

    try {
        // Attempting to authenticate the user
        Authentication auth = authenticationManager.authenticate(token);

        // Updating the SecurityContext, which represents the user's
        // secured, authenticated session
        securityContext.setAuthentication(auth);

        // If the user authenticates successfully then the authentication
        // storing the security context in the HttpSession between requests
        repository.saveContext(securityContext, request, response);

        // object is passed to the remember-me service
        rememberMeServices.loginSuccess(request, response, auth);

        // Successfully authenticated
        return "{\"status\": true}";

        // Bad Credentials
    } catch (BadCredentialsException ex) {
        return "{\"status\": false, \"error\": \"Bad Credentials\"}";
    }
    }
}

我的security-context.xml目前非常基本，足以测试我的登录过程：

<http use-expressions="true">
    <form-login />
    <remember-me />
    <intercept-url pattern="/**" access="permitAll" />
    <intercept-url pattern="/secured/**" access="isAuthenticated()" />
</http>

<authentication-manager alias="authenticationManager">
    <authentication-provider>
        <user-service>
            <user name="bob" password="bobspassword" authorities="ROLE_USER" />
        </user-service>
    </authentication-provider>
</authentication-manager>

感谢您的帮助

好的，我想我明白了

根据需要，使用以下步骤完成身份验证：

获取用户名和密码并将其组合到UsernamePasswordAuthenticationToken实例（我们前面看到的身份验证接口实例）中

令牌被传递给AuthenticationManager的实例进行验证

AuthenticationManager在成功身份验证时返回完全填充的身份验证实例

通过调用SecurityContextHolder.getContext（）.setAuthentication（…），传入返回的身份验证对象，可以建立安全上下文

除了上述步骤之外，我还尝试通过将SecurityContext保存到SecurityContextRepository来在请求之间存储SecurityContext。在请求之间存储SecurityContext的责任应该落在SecurityContextPersistenceFilter上，而SecurityContextPersistenceFilter反过来调用此操作，因此我不需要手动执行此操作，我想我应该只执行上述4个步骤

更新：我想我试着自己实现一些SpringSecurity已经为我实现的东西。我不建议采用这种方法，Spring Security提供了一种更简单的实践。