Spring security rest 插件：身份验证失败，未找到 AuthenticationProvider

Posted 2023-02-25

【中文标题】Spring security rest 插件：身份验证失败，未找到 AuthenticationProvider

【英文标题】：Spring security rest plugin: Authentication failed, No AuthenticationProvider found

【发布时间】：2015-06-08 20:26:03

【问题描述】：

我正在尝试将 spring security rest plugin 版本 1.4.1 集成到我的 grails 应用程序中，但遇到一些问题，我正在这样做：

Config.groovy 设置：

  //login end point
    grails.plugin.springsecurity.rest.login.active=true
    grails.plugin.springsecurity.rest.login.endpointUrl='/api/login'
    grails.plugin.springsecurity.rest.login.failureStatusCode='401'

    //for  memcached
    grails.plugin.springsecurity.rest.token.storage.useMemcached=true
    grails.plugin.springsecurity.rest.token.storage.memcached.hosts='localhost:11211'
    grails.plugin.springsecurity.rest.token.storage.memcached.username=''
    grails.plugin.springsecurity.rest.token.storage.memcached.password=''
    grails.plugin.springsecurity.rest.token.storage.memcached.expiration=3600

    //logout endpoint
    grails.plugin.springsecurity.rest.logout.endpointUrl='/api/logout'
    grails.plugin.springsecurity.rest.token.validation.headerName='X-Auth-Token'

    //accept request params as map
    grails.plugin.springsecurity.rest.login.useRequestParamsCredentials=true
    grails.plugin.springsecurity.rest.login.usernamePropertyName='username'
    grails.plugin.springsecurity.rest.login.passwordPropertyName='password'

和

grails.plugin.springsecurity.filterChain.chainMap = [
        '/api/guest/**': 'anonymousAuthenticationFilter,restExceptionTranslationFilter,filterInvocationInterceptor',
        '/api/**': 'JOINED_FILTERS,-exceptionTranslationFilter,-authenticationProcessingFilter,-securityContextPersistenceFilter,-rememberMeAuthenticationFilter',  // Stateless chain
        '/**': 'JOINED_FILTERS,-restTokenValidationFilter,-restExceptionTranslationFilter'                                                                          // Traditional chain
]

从设置中可以看出，我正在使用 Memcache 进行令牌存储，当我通过休息客户端点击 url api/login 时，我得到 401 我启用了日志，其中显示 找不到身份验证提供程序强>

这是日志：

2015-04-03 23:30:31,030 [http-bio-8080-exec-8] DEBUG matcher.AntPathRequestMatcher  - Checking match of request : '/api/login'; against '/api/guest/**'
2015-04-03 23:30:31,031 [http-bio-8080-exec-8] DEBUG matcher.AntPathRequestMatcher  - Checking match of request : '/api/login'; against '/api/**'
2015-04-03 23:30:31,031 [http-bio-8080-exec-8] DEBUG web.FilterChainProxy  - /api/login?username=abu.srs@gmail&password=test456 at position 1 of 8 in additional filter chain; firing Filter: 'RestLogoutFilter'
2015-04-03 23:30:31,031 [http-bio-8080-exec-8] DEBUG web.FilterChainProxy  - /api/login?username=abu.srs@gmail&password=test456 at position 2 of 8 in additional filter chain; firing Filter: 'MutableLogoutFilter'
2015-04-03 23:30:31,031 [http-bio-8080-exec-8] DEBUG web.FilterChainProxy  - /api/login?username=abu.srs@gmail&password=test456 at position 3 of 8 in additional filter chain; firing Filter: 'RestAuthenticationFilter'
2015-04-03 23:30:31,031 [http-bio-8080-exec-8] DEBUG rest.RestAuthenticationFilter  - Actual URI is /api/login; endpoint URL is /api/login
2015-04-03 23:30:31,031 [http-bio-8080-exec-8] DEBUG rest.RestAuthenticationFilter  - Applying authentication filter to this request
2015-04-03 23:30:31,031 [http-bio-8080-exec-8] DEBUG credentials.RequestParamsCredentialsExtractor  - Extracted credentials from request params. Username: abu.srs@gmail, password: [PROTECTED]
2015-04-03 23:30:31,032 [http-bio-8080-exec-8] DEBUG credentials.RequestParamsCredentialsExtractor  - pswrd:  test456
2015-04-03 23:30:31,032 [http-bio-8080-exec-8] DEBUG rest.RestAuthenticationFilter  - Trying to authenticate the request: org.springframework.security.authentication.UsernamePasswordAuthenticationToken@fdd5153a: Principal: abu.srs@gmail; Credentials: [PROTECTED]; Authenticated: false; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@957e: RemoteIpAddress: 127.0.0.1; SessionId: null; Not granted any authorities
2015-04-03 23:30:31,051 [http-bio-8080-exec-8] DEBUG rest.RestAuthenticationFilter  - Authentication failed: No AuthenticationProvider found for org.springframework.security.authentication.UsernamePasswordAuthenticationToken
2015-04-03 23:30:31,051 [http-bio-8080-exec-8] DEBUG rest.RestAuthenticationFailureHandler  - Setting status code to 401
2015-04-03 23:30:31,051 [http-bio-8080-exec-8] DEBUG rest.RestAuthenticationFilter  - Not authenticated. Rest authentication token not generated.

我的另一点是：如果我发出类似localhost:8080/restspring/api/guest/controller/action 的请求（对于未经身份验证的请求），我是否需要为此在 URL 映射中输入一些条目？我的应用程序使用自定义身份验证提供程序。任何想法都会对我有所帮助，谢谢。

【问题讨论】：

你的 grails 版本是什么？

我使用的是 grails 2.4.3 版，如果您需要任何其他信息，请告诉我，thanx。

你的电脑上安装了 Memcached 吗？ alvarosanchez.github.io/grails-spring-security-rest/1.5.0.RC1/… 不要看 401。如果在登录过程中出现一些错误，您将使用此代码（您在配置中配置它）。如果你错过了最后一个。

如果之前一切正常，那么您能否显示您的 urlMapping 和控制器（如果不是默认值）

@Abs 您说过您的应用程序使用自定义身份验证提供程序，您能否扩展此内容并让我们知道您的应用程序在做什么，您如何/在哪里注册自定义身份验证提供程序等。

【参考方案1】：

未找到身份验证提供程序

问题可能是您在身份验证提供程序的 support() 方法中总是返回 false。 参考：No AuthenticationProvider found for UsernamePasswordAuthenticationToken

如果我提出这样的要求 localhost:8080/restspring/api/guest/controller/action（对于 未经身份验证的请求）我需要在 URL 映射中做一些输入吗 为此？

是的，您需要在 url 映射中进行一些输入。因为默认的url映射是：

"/$controller/$action?/$id?(.$format)?"
            constraints 
                // apply constraints here
            
        

这无法生成您需要的网址，即localhost:8080/restspring/api/guest/controller/action