在已配置的spring OUTH和usernamepassword令牌身份验证系统中添加“记住我”功能

我有下面的spring安全配置

<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:beans="http://www.springframework.org/schema/beans"
xsi:schemaLocation="http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.1.xsd
    http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.1.xsd">


<!-- For S2OAuth endpoints -->
<http   pattern="/oauth/token" 
        create-session="stateless" 
        authentication-manager-ref="clientAuthenticationManager" 
        entry-point-ref="oauthAuthenticationEntryPoint"
        xmlns="http://www.springframework.org/schema/security">
    <intercept-url pattern="/oauth/token" access="IS_AUTHENTICATED_FULLY" />
    <anonymous enabled="false" />
    <http-basic entry-point-ref="oauthAuthenticationEntryPoint" />
    <!-- include this only if you need to authenticate clients via request parameters -->
    <custom-filter ref="clientCredentialsTokenEndpointFilter" before="BASIC_AUTH_FILTER" />
</http>

<http use-expressions="true">
    <!-- Authentication policy -->
    <form-login login-page="/signin" login-processing-url="/signin/authenticate" authentication-failure-url="/signin?error=1" />
    <logout logout-url="/signout" delete-cookies="JSESSIONID" />
    <!-- Remember Me -->
    <remember-me services-ref="rememberMeServices" key="myRememberMeKey" />
    <!-- Authorization policy definition: TODO consider replacing with @Secured on @Controllers -->
    <intercept-url pattern="/" access="permitAll" />
    <intercept-url pattern="/favicon.ico" access="permitAll" />
    <intercept-url pattern="/members/**" access="permitAll" />
    <intercept-url pattern="/groups/**" access="permitAll" />
    <intercept-url pattern="/pubsub/**" access="permitAll" />
    <intercept-url pattern="/resources/**" access="permitAll" />
    <intercept-url pattern="/signup" access="permitAll" requires-channel="#{environment['application.secureChannel']}" />   
    <intercept-url pattern="/signin" access="permitAll" requires-channel="#{environment['application.secureChannel']}" />
    <intercept-url pattern="/signin/*" access="permitAll" requires-channel="#{environment['application.secureChannel']}" />
    <intercept-url pattern="/reset" access="permitAll" requires-channel="#{environment['application.secureChannel']}" />
    <!-- TODO this would probably be better mapped to simply /invite?token={token} but not able to vary security policy here based on presence of a request parameter.  Consider @Secured on @Controller. -->               
    <intercept-url pattern="/invite/accept" access="permitAll" requires-channel="#{environment['application.secureChannel']}" />
    <!-- TODO this should be restricted to admin users only -->
    <intercept-url pattern="/admin/**" access="permitAll" />           
    <intercept-url pattern="/**" access="isAuthenticated()" requires-channel="#{environment['application.secureChannel']}" />
    <custom-filter ref="resourceServerFilter" before="EXCEPTION_TRANSLATION_FILTER" />
</http>

<authentication-manager alias="authenticationManager">
    <authentication-provider ref="usernamePasswordAuthenticationProvider" />
</authentication-manager>

<bean id="accessDecisionManager" class="org.springframework.security.access.vote.UnanimousBased" xmlns="http://www.springframework.org/schema/beans">
    <constructor-arg>
        <list>
            <bean class="org.springframework.security.oauth2.provider.vote.ScopeVoter" />
            <bean class="org.springframework.security.access.vote.RoleVoter" />
            <bean class="org.springframework.security.access.vote.AuthenticatedVoter" />
        </list>
    </constructor-arg>
</bean>

<bean id="jdbcRememberMeRepository" class="com.springsource.greenhouse.rememberme.JdbcRememberMeRepository" xmlns="http://www.springframework.org/schema/beans"/>
<bean id="coreUserDetailsService" class="com.springsource.greenhouse.rememberme.RememberMeUserDetailsService" xmlns="http://www.springframework.org/schema/beans"/>

<bean id="rememberMeServices" class="org.springframework.security.web.authentication.rememberme.PersistentTokenBasedRememberMeServices" xmlns="http://www.springframework.org/schema/beans">
  <property name="tokenRepository" ref="jdbcRememberMeRepository" />
  <property name="userDetailsService" ref="coreUserDetailsService" />
  <property name="key" value="myRememberMeKey" />
  <property name="alwaysRemember" value="true" />
</bean>


<!-- For S2OAuth endpoints -->
<authentication-manager id="clientAuthenticationManager" xmlns="http://www.springframework.org/schema/security">
    <authentication-provider user-service-ref="clientDetailsUserService" />
</authentication-manager>

<beans:bean id="clientDetailsUserService" class="org.springframework.security.oauth2.provider.client.ClientDetailsUserDetailsService">
    <beans:constructor-arg ref="clientDetails" />
</beans:bean>

<beans:bean id="oauthAuthenticationEntryPoint" class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint">
    <beans:property name="realmName" value="greenhouseApi" />
</beans:bean>


<beans:import resource="security-oauth-provider.xml" />

 </beans:beans>

---

当我勾选“记住我”复选框时，我看到我的“记住我”数据库已填充，如快照所示。现在我关闭浏览器并尝试访问需要登录的url。我能看到这一页。现在我很困惑，是因为登录还是因为记得我，我才能看到这个页面。其次，我在MemberMe数据库表中看到最后一个日期没有更新。原因是什么？

仅重新启动浏览器是不够的。要测试“记住我”功能，您需要确保会话已过期。如果上次使用的未更新，则表示未使用“记住我”功能。在您的情况下，HTTP会话处于活动状态。您需要停用它，并且有多个选项：

• 等待会话到期。提示：您可以设置最小会话超时，例如在web.xml中设置1分钟
• 或者删除会话cockie（不要删除您域中的所有coockie，记住我也使用coockie）
• 或者停止您的应用程序服务器，然后清理它保存会话数据的目录，然后再次启动它。对于tomcat，它是tomcat_根/工作

在web.xml中将会话超时值设置为1分钟：

<session-config>
    <session-timeout>1</session-timeout>
</session-config>

1.

很酷，谢谢。我从浏览器中删除了cookie。删除cookie后，我再次被重定向到登录页面。我不知道为什么不叫“记住我”这个名字。任何线索。？在MemberMemberAuthenticationFilter.doFilter（…）中创建制动点。您的配置是否正常，是否调用此筛选器？如果这是真的，那么您可以调试它并找到原因。