如何使用Spring Security允​​许转发到外部URL

Question

I am wondering how can I make my "redirect:" workin with Spring Security. All /auth* pathes work correctly. But when it cames up to [1] it just doesn't redirect. Spring Security 4.0.2.RELEASE, Spring MVC 4.0.8.RELEASE

@Controller
@RequestMapping(value = "/auth")
public class SomeAuthController {

    @RequestMapping(value = "/external")
    public String externalAuth(...) {
        if(someCondition) return "redirect:" + someExternalUrl; // [1] https://external-service.com 
        else return "redirect:/"
    }

}



@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(securedEnabled = true)
public class SecurityConfig extends WebSecurityConfigurerAdapter {


    @Autowired 
    public void registerGlobalAuthentication(AuthenticationManagerBuilder auth, 
                                             ShaPasswordEncoder shaPasswordEncoder,
                                             List<AuthenticationProvider> authProviders)
                                                                throws Exception {
        for(AuthenticationProvider provider : authProviders) auth.authenticationProvider(provider);
    }

    @Bean(name="myAuthenticationManager")
    @Override
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf().disable().authorizeRequests().antMatchers("/resources/**").permitAll();

        http.authorizeRequests().antMatchers("/auth/**", "/").permitAll().anyRequest().authenticated();

        http.formLogin()
                .loginPage("/auth/login")
                .loginProcessingUrl("/j_spring_security_check")
                .usernameParameter("j_username")
                .passwordParameter("j_password")
                .failureUrl("/auth/login?error")
                .permitAll();

        http.logout()
                .permitAll()
                .logoutUrl("/auth/logout")
                .logoutSuccessUrl("/")
                .invalidateHttpSession(true);
    }


}

Answer 1

Okay guys. Here's my answer. Hope it will help someone. The first thing is to enable JSR250 in the security configuration bean.

@EnableGlobalMethodSecurity(securedEnabled = true, jsr250Enabled = true)
public class SecurityConfig extends WebSecurityConfigurerAdapter {

Afterwards I added @PermitAll annotation for a method which contained redirecting.

@PermitAll
@RequestMapping(value = "/external")
public String externalAuth(...) {
    if(someCondition) return "redirect:" + someExternalUrl; // [1] https://external-service.com 
    else return "redirect:/"
}

That's all. Have a nice debugging J