如何在spring boot security中的另一个微服务中调用我的身份验证微服务

Question

I have implemented an authentication service using Spring Security which has access to a database which stores user data. Now I want to implement another service (open a totally new project) where I only specify the url of my authentication service. I used .loginProcessingUrl() and changed the login page in the spring security configuration but that does not work. How do I make the new service authenticate using my authentication service?

Answer 1

You could use a custom AuthenticationProvider to do the authentication for you.

Here's a barebones example:

1. Create a CustomRemoteAuthenticationProvider that calls your authentication service:

public class CustomRemoteAuthenticationProvider implements AuthenticationProvider {

    @Override
    public Authentication authenticate(Authentication authentication) 
               throws AuthenticationException {

        String username = authentication.getName();
        String password = authentication.getCredentials().toString();

        // call your authentication service
        // ... and return a UsernamePasswordAuthenticationToken

    }

    @Override
    public boolean supports(Class<?> authentication) {
        return authentication.equals(UsernamePasswordAuthenticationToken.class);
    }
}

2. Declare your CustomRemoteAuthenticationProvider as a bean (which you could do in WebSecurityConfigurerAdapter ), which will get picked up and added to the AuthenticationManager automatically:

@Bean
public CustomRemoteAuthenticationProvider customRemoteAuthenticationProvider() {
    return new CustomRemoteAuthenticationProvider();
}

Note : You could do all of this in one step by adding @Component directly to CustomRemoteAuthenticationProvider . Also, check out the javadoc for AuthenticationProvider for a list of AuthenticationProvider s if you want more ideas on how to write one. DaoAuthenticationProvider is commonly used with JdbcDaoImpl to authenticate against a database.