Spring Security pre-authentication - 给我一个新的会话,即使主体没有改变

Posted

技术标签:

【中文标题】Spring Security pre-authentication - 给我一个新的会话,即使主体没有改变【英文标题】:Spring Security pre-authentication - gives me a new session even though principal is unchanged 【发布时间】:2015-05-04 18:55:53 【问题描述】:

为了与 Tivoli Access Manager 集成,我在 Grails 应用程序中实现了 spring 安全性预认证过滤器。

过滤器在我的 Web 应用程序中的每个请求都被调用 - 尽管过滤器返回的主体与之前的请求相同,但它似乎创建了一个新会话。我创建了一个 ApplicationListener 来监听身份验证事件,我可以看到一个新的 AuthenticationSuccessEvent,每个请求都有一个新的会话 ID。

这意味着我的所有会话变量在每次请求时都会被清除——这没什么大不了的,但它会破坏上传器插件。

当我为我的预身份验证过滤器打开调试日志记录时,我看到它认为主体已更改,即使它没有:

2015-03-04 11:34:57.769 foobar.TamAuthenticationFilter Checking secure context token: org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationToken@f0666480: Principal: grails.plugin.springsecurity.userdetails.GrailsUser@3125618: Username: 66734; Password: [PROTECTED]; Enabled: true; AccountNonExpired: true; credentialsNonExpired: true; AccountNonLocked: true; Granted Authorities: ROLE_ADMIN,ROLE_APPROVER; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@fffde5d4: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: 87928D9E25D98DD3CCFAC5D67689E609; Granted Authorities: ROLE_ADMIN, ROLE_APPROVER
2015-03-04 11:34:57.770 foobar.TamAuthenticationFilter Pre-authenticated principal has changed to 66734 and will be reauthenticated
2015-03-04 11:34:57.770 foobar.TamAuthenticationFilter Invalidating existing session
2015-03-04 11:34:57.771 foobar.TamAuthenticationFilter preAuthenticatedPrincipal = 66734, trying to authenticate

如何让 spring security 对预身份验证过滤器返回的每个主体使用相同的会话,而不是为每个请求创建一个新会话?

这是我的过滤器:

package foobar

import org.springframework.security.web.authentication.preauth.AbstractPreAuthenticatedProcessingFilter
import grails.util.Environment
import grails.util.Holders
import groovy.util.logging.Log4j

@Log4j
class TamAuthenticationFilter extends   AbstractPreAuthenticatedProcessingFilter 

java.lang.Object getPreAuthenticatedCredentials(javax.servlet.http.HttpServletRequest request)

    "N/A"


java.lang.Object getPreAuthenticatedPrincipal(javax.servlet.http.HttpServletRequest request)

    Long staffId = getStaffIdFromTamHeader(request)
    if(!staffId)
        log.error "iv-user header not found"

    return staffId


/**
 * Get Staff ID from the ivUser Tamheader.
 * @param request
 * @return
 */
static public Long getStaffIdFromTamHeader(request) 
    return request.getHeader("iv-user")



LoggingSecurityEventListener:

 package foobar

 import groovy.util.logging.Log4j
 import org.springframework.context.ApplicationListener
 import org.springframework.security.authentication.event.AbstractAuthenticationEvent


 @Log4j
 class LoggingSecurityEventListener implements
    ApplicationListener<AbstractAuthenticationEvent> 

void onApplicationEvent(AbstractAuthenticationEvent event) 

    def username = event.authentication.principal
    def address = event.authentication.details.remoteAddress
    def sessionId = event.authentication.details.sessionId

    log.info "event=$event.class.simpleName username=$username remoteAddress=$address sessionId=$sessionId"



 

resources.groovy:

beans = 
//
// grabs the user id from the tam headers 
//
tamAuthenticationFilter(TamAuthenticationFilter) 
    authenticationManager = ref('authenticationManager')
    checkForPrincipalChanges = true


tamAuthenticationProvider(PreAuthenticatedAuthenticationProvider) 
   preAuthenticatedUserDetailsService = ref('authenticationUserDetailsService')


//
// we do not want to redirect to the auth/login page since we are using tam
//
authenticationEntryPoint(Http403ForbiddenEntryPoint)

securityEventListener(LoggingSecurityEventListener)

config.groovy:

 grails.plugin.springsecurity.useSecurityEventListener = true
 grails.plugin.springsecurity.providerNames = ['tamAuthenticationProvider']

 grails.plugin.springsecurity.userLookup.userDomainClassName = 'strobe.auth.User'
 grails.plugin.springsecurity.userLookup.authorityJoinClassName = 'strobe.auth.UserRole'
 grails.plugin.springsecurity.authority.className = 'strobe.auth.Role'
 grails.plugin.springsecurity.securityConfigType="InterceptUrlMap"
 grails.plugin.springsecurity.interceptUrlMap = [
                                            '/foobar/**':                   ['ROLE_USER']]

bootstrap.groovy:

 def init =  servletContext ->                   SpringSecurityUtils.clientRegisterFilter('tamAuthenticationFilter',
            SecurityFilterPosition.PRE_AUTH_FILTER.order + 10)
 

【问题讨论】:

【参考方案1】:

我找到了解决问题的方法——我从 getPreauthenticatedPrincipal() 返回了一个 Long,它混淆了 spring 安全性,因为 AbstractPreauthenticatedProcessingFilter 中的方法 requiresAuthentication() 有这行代码:

    if ((principal instanceof String) && currentUser.getName().equals(principal)) 
        return false;
    

它期望主体是一个字符串。每次我返回很长时间时,它都会重新进行身份验证并给我一个新的会话。

我不敢相信解决方案这么简单,我花了 2 天时间才弄清楚!!!

我认为部分问题是关于春季预认证的文档不足以及以下方法签名:

java.lang.Object getPreAuthenticatedPrincipal(javax.servlet.http.HttpServletRequest request)

没有明确暗示返回类型。

【讨论】:

以上是关于Spring Security pre-authentication - 给我一个新的会话,即使主体没有改变的主要内容,如果未能解决你的问题,请参考以下文章

Spring Security:2.4 Getting Spring Security

没有 JSP 的 Spring Security /j_spring_security_check

Spring-Security

Spring Security 登录错误:HTTP 状态 404 - /j_spring_security_check

未调用 Spring Security j_spring_security_check

Spring Security入门(3-7)Spring Security处理页面的ajax请求