如何为 json 添加基本身份验证

Question

The application I'm working on already has user authentication (it's a desktop application). I need to add basic authentication on the url /teachers.htm so that a third-party can receive data in json format. How can I do this? Oh, and I can`t use Spring Boot.

security.xml

<security:authentication-manager>
    <security:authentication-provider ref="customAuthProvider">
    </security:authentication-provider>
</security:authentication-manager>

<security:http use-expressions="true" create-session="always">
    <security:expression-handler ref="customExpressionHandler" />
    <security:intercept-url pattern="/**" access="isAuthenticatedIfRequired()" />
    <security:form-login login-page="/login" default-target-url="/index.htm" username-parameter="login" always-use-default-target="true"
            password-parameter="password" authentication-failure-url="/login" />
    <security:logout invalidate-session="true" logout-success-url="/login" logout-url="/logout.htm" />
    <security:session-management session-authentication-strategy-ref="customAuthenticationStrategy" />
</security:http>

CustomAuthenticationProvider

@Override
@Transactional(readOnly = true)
public Authentication authenticate(Authentication authentication) throws AuthenticationException
{
    UserInfo user = userDao.findUserByLogin((String) authentication.getPrincipal());
    WebAuthenticationDetails details = (WebAuthenticationDetails) authentication.getDetails();
    sessionsInfo.addLoggedInUser(details.getSessionId(), user);
    return new TRUsernamePasswordAuthenticationToken(user.getId(), user.getLoginName(),
        user.getName(), user.getUserType(), user.getUserLanguage(), null, authorities,
        organizations, user.getCurrentOrganizationId());
}

Answer 1

There is special tag for that http-basic .

In your case will be something like this:

<security:http use-expressions="true">
    <security:intercept-url pattern="/teachers.htm" access="isAuthenticated()" />
    <security:http-basic />
</security:http>

Answer 2

Cause I already had authentication in the app, I resolved the issue by making two entry-points in Spring Security. The result:

<security:user-service id="apiUserDetailsService">
    <security:user name="user" password="pw" authorities="ROLE_ADMIN" />
</security:user-service>

<security:authentication-manager alias="authenticationManager">
    <security:authentication-provider ref="customAuthProvider">
    </security:authentication-provider>
    <security:authentication-provider user-service-ref="apiUserDetailsService"/>
</security:authentication-manager>

<security:http entry-point-ref="basicAuthEntryPoint" pattern="/pw/**" use-expressions="true">
    <security:intercept-url pattern="/pw/smth.htm" access="hasAnyRole('ROLE_ADMIN')" />
    <security:custom-filter ref="basicAuthenticationFilter" after="BASIC_AUTH_FILTER" />
</security:http>

<bean id="basicAuthEntryPoint" class="org.springframework.security.web.authentication.www.BasicAuthenticationEntryPoint">
    <property name="realmName" value="REST Realm" />
</bean>

<bean id="basicAuthenticationFilter" class="org.springframework.security.web.authentication.www.BasicAuthenticationFilter">
    <property name="authenticationManager" ref="authenticationManager"/>
    <property name="authenticationEntryPoint" ref="basicAuthEntryPoint" />
</bean>

<security:http use-expressions="true" create-session="always">
    <security:expression-handler ref="customExpressionHandler"/>
    <security:intercept-url pattern="/pages/activationcode.jsp" access="permitAll()"/>
    <security:intercept-url pattern="/**/*.css" access="permitAll()"/>
    <security:intercept-url pattern="/**" access="isAuthenticatedIfRequired()"/>
    <security:form-login login-page="/login" default-target-url="/index.htm" username-parameter="login" always-use-default-target="true"
                         password-parameter="password" authentication-failure-url="/login"/>
    <security:logout invalidate-session="true" logout-success-url="/login" logout-url="/logout.htm"/>
    <security:session-management session-authentication-strategy-ref="customAuthenticationStrategy"/>
</security:http>