使用Spring Security进行授权和认证

Question

I have a web service that I have built on top of Spring. I am currently authenticating using Spring Security as follows:

@Configuration
@EnableGlobalMethodSecurity(securedEnabled=true)
@EnableWebSecurity

public class ServerSecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private Properties properties;

    private static final String ALL_URI = "/v1/**";
    private static final String HEALTH_URI = "/v1/healthCheck";

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.addFilterBefore(getFilter(), BasicAuthenticationFilter.class);
        http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
        http.authorizeRequests()
                .antMatchers(HEALTH_URI).permitAll()
                .anyRequest().authenticated();
        http.csrf().disable();
    }

    private AuthenticationFilter getFilter() {
        return new AuthenticationFilter( properties.getKey());
    }
}

My AuthenticationFilter class extends AbstractAuthenticationProcessingFilter and performs the actual authentication. If I want to add Authorization to my security, would I just make those checks in the attemptAuthentication method apart of the AuthenticationFilter? Or is there a better way to do it? The way I understand it is that Authorization and Authentication should be done independently. You first authenticate, and then you verify the permissions. So, I would assume there would be a better approach to do authorization within Spring Security rather than just adding it to the attemptAuthentication method.

Answer 1

You need a AuthenticationProvider to do authenticate, implement the AuthenticationProvider and override the authentication and supports methods, and then inject to the AuthenticationManager .

attemptAuthentication method in filter is usually to get authentication (eg UsernamePasswordFilter gets username and password from request, and then builds a UsernamePasswordAuthenticationToken to AuthenticationManager ),

supports method tests the AuthenticationProvider whether can be used to do authenticate.(eg DaoAuthenticationProvider supports UsernamePasswordAuthenticationToken )

authenticate method is used to do authenticate(eg DaoAuthenticationProvider gets the real password by username and then compare to the user input), this method should return an Authentication that is already authenticated(eg UsernamePasswordAuthenticationToken ), and this authentication should contains the user authorities(this can be used to hasRole('xxx') ), or use detail and so on.

After attemptAuthentication successful, the Authentication will set into SecurityContextHolder . and then you can use the hasRole('xx') , or something else.