如何在spring security中只通过ip地址验证用户？

Question

I have table with users. There is "ip_address" column in this table.

I have server - java server I have web app on spring boot.

Spring boot communicates with java server by rest.

I need realize authonticate user in system by ip. Whem user open web page - spring boot app get remoteIpAddress( String ipAddress = request.getRemoteAddr(); ) and pass it to java server in url. java server ckeck this ip in db in table users and if user can login return this user to spring boot app.

I want realize this with spring security. But when i open web page, in browser opened dialog window for input login and password. But I do not need login and password. I need if user is not null - give access to pages and save the user.

and if I input login and password and press "ok" button I move to my IPAddressBasedAuthenticationProvider

@Component
public class IPAddressBasedAuthenticationProvider implements AuthenticationProvider {
    @Autowired
    private HttpServletRequest request;
    @Autowired
    AuthService authService;

    @Override
    public Authentication authenticate(Authentication authentication) throws AuthenticationException {
        String ipAddress = request.getRemoteAddr();
        AuthLkUser authLkUserByIp = authService.getAuthLkUserByIp(ipAddress);

        if (authLkUserByIp == null) return null;

        boolean b = authService.checkAuthLkUser(authLkUserByIp);
        if (b) return null;
        final List<GrantedAuthority> grantedAuths = new ArrayList<>();
        GrantedAuthority grantedAuthority = new SimpleGrantedAuthority("ROLE_ADMIN");
        grantedAuths.add(grantedAuthority);
        UsernamePasswordAuthenticationToken result = new UsernamePasswordAuthenticationToken(authentication.getName(), authentication.getCredentials(), grantedAuths);
        result.setDetails(authentication.getDetails());
        return result;
    }

    @Override
    public boolean supports(Class<?> aClass) {
        return true;
    }
}

And in this class saved user to session. And after that when I open web pages i not need input login and password. it contains in session. but my wep page not openned with error

Whitelabel Error Page

This application has no explicit mapping for /error, so you are seeing this as a fallback.
Mon Jul 11 14:27:59 ALMT 2016
There was an unexpected error (type=Forbidden, status=403).
Access is denied

Answer 1

For Spring Boot applications that run with the embedded Apache Tomcat container, you can use the org.apache.catalina.filters.RemoteAddrFilter from Apache Tomcat.

 @Bean
 public FilterRegistrationBean remoteAddressFilter() {
  FilterRegistrationBean filterRegistrationBean = new FilterRegistrationBean();
  RemoteAddrFilter filter = new RemoteAddrFilter();
 // filter.setAllow("127.0.0.1");
  filter.setAllow("127\\.0\\.0\\.1");
  filterRegistrationBean.setFilter(filter);
  filterRegistrationBean.addUrlPatterns("/gs/serving-web-content/testParameters");
  return filterRegistrationBean;
 }

allow : A regular expression (using java.util.regex) that the remote client's IP address is compared to. If this attribute is specified, the remote address MUST match for this request to be accepted. If this attribute is not specified, all requests will be accepted UNLESS the remote address matches a deny pattern.

You can refer this article - How do I restrict access to my application by IP address?

Answer 2

You can use Expression-Based Access Control provided by Spring. To secure individual URL, you are able to do something like this:

<http use-expressions="true">
    <intercept-url pattern="/admin*"
        access="hasRole('admin') and hasIpAddress('192.168.1.0/24')"/>
    ...
  </http>

Where you created expression like if he has role admin and his IP address is xxx.xxx.xx, then it is allowed. So you are looking for hasIpAddress . More about expression-based access control is in their docs .

If you want to create this restrictions for Spring Boot and if you are using Apache Tomcat, then you are able to to enable a Servlet Filter ( here is description) and then you can just enable Remote Address Filter and then set addresses which you want to allow. More abouy this filter is in Apache Tomcat docs .

And another one option is that if you will use Spring Security. There is class WebAuthenticationDetails which provide method getRemoteAddress() .