spring-security Spring安全授权始终返回空值

uqxowvwt 于 2022-11-11 发布在 Spring

关注(0)|答案(1)|浏览(345)

我正在尝试使用Spring Security 3.2.4从Spring 4.0.6应用程序中的Active Directory收集用户权限。
一些细节：

身份验证成功。我可以得到当前用户名。
预身份验证由JBoss 7.2使用JCIFS（NTLM）完成。
LDAP服务器工作正常，因此主机和端口正确。
域正确。
安全配置.java

@Configuration
@EnableWebMvcSecurity
@PropertySource( "classpath:/resources/ldap-config.properties" )
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Value( "${domain}" )
    private String strDomain;

    @Value( "${ldap.host}" )
    private String strHost;

    @Value( "${ldap.basedn}" )
    private String strBaseDn;

    @Value( "${ldap.userdn}" )
    private String strUserDn;

    @Value( "${ldap.userdn.password}" )
    private String strUserDnPassword;

    @Bean
    public static PropertySourcesPlaceholderConfigurer propertySourcesPlaceholderConfigurer() {
        return new PropertySourcesPlaceholderConfigurer();
    }

    @Bean 
    public ActiveDirectoryGrantedAuthoritiesMapper grantedAuthoritiesMapper() {
        return new ActiveDirectoryGrantedAuthoritiesMapper();
    }

    @Bean
    public ActiveDirectoryLdapAuthenticationProvider activeDirectoryLdapAuthenticationProvider() {

        ActiveDirectoryLdapAuthenticationProvider activeDirectoryLdapAuthenticationProvider = new ActiveDirectoryLdapAuthenticationProvider(strDomain, strHost);
        activeDirectoryLdapAuthenticationProvider.setUseAuthenticationRequestCredentials(true);
        activeDirectoryLdapAuthenticationProvider.setConvertSubErrorCodesToExceptions(true);

        activeDirectoryLdapAuthenticationProvider.setAuthoritiesMapper(this.grantedAuthoritiesMapper());

        return activeDirectoryLdapAuthenticationProvider;
    }

    @Override
    public void configure(AuthenticationManagerBuilder authenticationManagerBuilder) throws Exception {

        authenticationManagerBuilder
        .authenticationProvider(this.activeDirectoryLdapAuthenticationProvider());
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {

        http
            .authorizeRequests()
                .anyRequest().authenticated()
            .and()
            .jee();
    }
}

活动目录授权授权Map器.java

public class ActiveDirectoryGrantedAuthoritiesMapper implements GrantedAuthoritiesMapper {

    // Constants for group defined in LDAP
    private final String ROLE_ADMIN = "A_SPECIFIC_ADMIN_GROUP_IN_AD";
    private final String ROLE_USER = "A_SPECIFIC_GROUP_IN_AD";

    public ActiveDirectoryGrantedAuthoritiesMapper() {
    }

    @Override
    public Collection<? extends GrantedAuthority> mapAuthorities(final Collection<? extends GrantedAuthority> authorities) {

        Set<SecurityContextAuthority> roles = EnumSet.noneOf(SecurityContextAuthority.class);

        for (GrantedAuthority authority : authorities) {

            System.out.println("GrantedAuthority : " + authority.getAuthority());

            if (ROLE_ADMIN.equals(authority.getAuthority())) {
                roles.add(SecurityContextAuthority.ROLE_ADMIN);
            }

            if (ROLE_USER.equals(authority.getAuthority())) {
                roles.add(SecurityContextAuthority.ROLE_USER);
            }
        }

        return roles;
    }

}

安全上下文授权.java

public enum SecurityContextAuthority implements GrantedAuthority {

    ROLE_ADMIN, ROLE_USER;

    @Override
    public String getAuthority() {
        return name();
    }
}

我在控制台中看到的内容：

2014-10-14 14:04:02,557 INFO  [stdout] (http-localhost/127.0.0.1:8080-2) MY_DOMAIN\MY_USERNAME
2014-10-14 14:04:02,557 INFO  [stdout] (http-localhost/127.0.0.1:8080-2) Authorities: []
2014-10-14 14:04:02,557 INFO  [stdout] (http-localhost/127.0.0.1:8080-2) Auth Type: NTLM
2014-10-14 14:04:02,557 INFO  [stdout] (http-localhost/127.0.0.1:8080-2) Is Authenticated: true

打开调试后，我得到了以下额外的详细信息：

2014-10-16 11:10:50,959 DEBUG [org.springframework.security.web.authentication.preauth.j2ee.J2eePreAuthenticatedProcessingFilter] (http-localhost/127.0.0.1:8080-1) Checking secure context token: null
2014-10-16 11:10:50,959 DEBUG [org.springframework.security.web.authentication.preauth.j2ee.J2eePreAuthenticatedProcessingFilter] (http-localhost/127.0.0.1:8080-1) PreAuthenticated J2EE principal: MY_DOMAIN\MY_USERNAME
2014-10-16 11:10:50,959 DEBUG [org.springframework.security.web.authentication.preauth.j2ee.J2eePreAuthenticatedProcessingFilter] (http-localhost/127.0.0.1:8080-1) preAuthenticatedPrincipal = MY_DOMAIN\MY_USERNAME, trying to authenticate
2014-10-16 11:10:50,959 DEBUG [org.springframework.security.web.authentication.preauth.j2ee.J2eeBasedPreAuthenticatedWebAuthenticationDetailsSource] (http-localhost/127.0.0.1:8080-1) J2EE roles [[]] mapped to Granted Authorities: [[]]
2014-10-16 11:10:50,960 DEBUG [org.springframework.security.authentication.ProviderManager] (http-localhost/127.0.0.1:8080-1) Authentication attempt using org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationProvider
2014-10-16 11:10:50,960 DEBUG [org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationProvider] (http-localhost/127.0.0.1:8080-1) PreAuthenticated authentication request: org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationToken@f99efc97: Principal: MY_DOMAIN\MY_USERNAME; Credentials: [PROTECTED]; Authenticated: false; Details: org.springframework.security.web.authentication.preauth.PreAuthenticatedGrantedAuthoritiesWebAuthenticationDetails@380f4: RemoteIpAddress: 127.0.0.1; SessionId: FaMwocWCdZawHD1GvwUcNg8S; []; Not granted any authorities
2014-10-16 11:10:50,960 DEBUG [org.springframework.security.web.authentication.preauth.j2ee.J2eePreAuthenticatedProcessingFilter] (http-localhost/127.0.0.1:8080-1) Authentication success: org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationToken@661034c: Principal: org.springframework.security.core.userdetails.User@f99c56bc: Username: MY_DOMAIN\MY_USERNAME; Password: [PROTECTED]; Enabled: true; AccountNonExpired: true; credentialsNonExpired: true; AccountNonLocked: true; Not granted any authorities; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.preauth.PreAuthenticatedGrantedAuthoritiesWebAuthenticationDetails@380f4: RemoteIpAddress: 127.0.0.1; SessionId: FaMwocWCdZawHD1GvwUcNg8S; []; Not granted any authorities

其他调试信息：