通过spring security基于远程身份验证响应对用户进行身份验证

Question

I have similar problem to this one . I need to pass user credentials to remote basic authentication and get response. I'm new to Spring Security and I don't know how to invoke this remote authentication inside my code. In the answer to the referenced question somone posted some Java code and I have three question to it.

@Override
      protected UserDetails retrieveUser(String username,
            UsernamePasswordAuthenticationToken authentication)
            throws AuthenticationException {
         //Improve this line:
        String password = authentication.getCredentials().toString();
        // Invoke your webservice here
        GrantedAuthority[] grantedAuth = loginWebService.login(username, password);
        // create UserDetails. Warning: User is deprecated!
        UserDetails userDetails = new User(username, password, grantedAuth);
        return userDetails;
      }

1) How should I improve String password = authentication.getCredentials().toString();

2) // Invoke your webservice here how to invoke that webservice?

3) Is simply putting this class as a bean in my Java Config for Spring Security enough?

EDIT: I achieved my goal so I will leave this implementation here for others who may come across this question. You just need to register this as a bean and pass to authenticationProvider()

public class WebServiceAuthenticationProvider implements AuthenticationProvider {

    final static org.slf4j.Logger logger = LoggerFactory.getLogger(WebServiceAuthenticationProvider.class);

    @Value("${wsdl.remote.url}")
    String webpage;

    @Override
    public Authentication authenticate(Authentication authentication) throws AuthenticationException {
        final String username = (String) authentication.getPrincipal();
        final String password = (String) authentication.getCredentials();
        CookieHandler.setDefault(new CookieManager(null, CookiePolicy.ACCEPT_ALL));
        if (password == null || username == null) {
            throw new BadCredentialsException("Bad credentials");
        }

        Authenticator.setDefault(new Authenticator() {
            @Override
            protected PasswordAuthentication getPasswordAuthentication() {
                return new PasswordAuthentication(
                        username,
                        password.toCharArray());
            }
        });

        HashSet<GrantedAuthority> grantedAuth = new HashSet<>();

        String auth = username + ":" + password;
        byte[] authEncBytes = Base64.encodeBase64(auth.getBytes());
        String authStringEnc = new String(authEncBytes);

        URL url = null;
        try {
            url = new URL(webpage);
        } catch (MalformedURLException ex) {
            logger.debug("Malformed url {}!", webpage);
        }
        URLConnection connection = null;
        try {
            connection = url.openConnection();
        } catch (IOException ex) {
            logger.debug("IOException while opening url connection");
        }
        logger.debug("Authorization"+"Basic " + authStringEnc);
        connection.setRequestProperty("Authorization", "Basic " + authStringEnc);
        InputStream is = null;
        try {
            is = connection.getInputStream();
        } catch (IOException ex) {
            logger.debug("IOException while getting input stream");
            logger.debug("Authentication unsuccesfull");
            return authentication;
        }
        InputStreamReader isr = new InputStreamReader(is);
        int numCharsRead;
        char[] charArray = new char[1024];
        StringBuffer sb = new StringBuffer();
        try {
            while ((numCharsRead = isr.read(charArray)) > 0) {
                sb.append(charArray, 0, numCharsRead);
            }
        } catch (IOException ex) {
            logger.debug("IOException {}", ex.getMessage());
        }
        String result = sb.toString();
        logger.debug("Result: {}", result);

        if (result.length() != 0) {
            logger.debug("Äuthentication successfull");
            UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken(authentication.getPrincipal(), authentication.getCredentials(), grantedAuth);
            return token;
        } else {
            logger.debug("Äuthentication unsuccessfull");
            return authentication;
        }
    }

    @Override
    public boolean supports(Class<?> authentication) {
        logger.debug("Requested auth: {} {}", authentication, authentication.equals(UsernamePasswordAuthenticationToken.class));
        if (authentication.equals(UsernamePasswordAuthenticationToken.class)) {
            return true;
        } else {
            return false;
        }
    }
}

Answer 1

1) What do you wish to improve?

2) Assuming you are accessing a RESTful API, you could use a RestTemplate .

3) If your JavaConfig extends the WebSecurityConfigurerAdapter you need to define it in this way:

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

@Bean
public UserDetailsService userDetailsService() {
    return new YourUserDetailService ();
}

@Override
protected void configure(HttpSecurity http)
        throws Exception {
    http.authorizeRequests()
            .anyRequest().authenticated().and()
            .formLogin().and().userDetailService(userDetailService());
}

[...]

}