Spring Security - custom filter
Question
I'm using this environment:
- spring 4.0.5
- spring security 3.2.4
In my environment I have a SSO system and I need to integrate my web applicationin this system. This system is a private product. The final result of the SSO mechanism is to put a parameter in the request header. So what I should do in my application is:
- check if a header parameter is present in the request
- if the header parameter is not present, I have to redirect to the login page of this system
- if the header parameter is present, I have to authenticate on the Spring security context
This scenario is similar to the CAS integration scenario; so I started from CAS integration; I wrote my custom filter, I wrote my custom entry point and all other classes needed to handle the requests, but I'm facing some issues; now I can authenticate in spring context but, also after authenticated, it's like if I'm not authenticated. Maybe I'm missing something.
I'll report all involved classes and my security context.
security-context.xml
<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:context="http://www.springframework.org/schema/context"
xmlns:security="http://www.springframework.org/schema/security"
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd">
<!-- Nessuna sicurezza per avere i CSS e JS -->
<security:http pattern="/css/**" security="none"/>
<security:http pattern="/DataTables-1.9.4/**" security="none"/>
<security:http pattern="/images/**" security="none"/>
<security:http pattern="/jquery-ui-1.10.3/**" security="none"/>
<security:http pattern="/json/**" security="none"/>
<security:http pattern="/jstree-v.pre1.0/**" security="none"/>
<security:http pattern="/ol213/**" security="none"/>
<security:http pattern="/sld/**" security="none"/>
<!-- Configurazione sicurezza -->
<security:http use-expressions="true" disable-url-rewriting="true"
entry-point-ref="webSealEntryPoint" request-matcher-ref="webSealReqMatcher">
<security:custom-filter ref="webSealAuthFilter" position="FIRST"/>
<security:intercept-url pattern="/comiajax/pages/*" access="hasAnyRole('OMNIA_ADMIN','DOMAIN_ADMIN','OMNIA_GUEST', 'DOMAIN_GUEST')"/>
<security:session-management>
<security:concurrency-control error-if-maximum-exceeded="true" max-sessions="1"/>
</security:session-management>
</security:http>
<security:authentication-manager alias="authenticationManager">
<security:authentication-provider ref="webSealAuthProvider" />
</security:authentication-manager>
<bean id="webSealAuthFilter" class="it.angelo.spring.web.security.auth.filter.WebSealAuthenticationFilter">
<constructor-arg ref="webSealReqMatcher"/>
<property name="authenticationManager" ref="authenticationManager"/>
<property name="authenticationDetailsSource">
<bean class="it.angelo.spring.web.security.auth.ServiceAuthenticationDetailsSource"/>
</property>
</bean>
<bean id="webSealEntryPoint" class="it.angelo.spring.web.security.entrypoint.WebSealEntryPoint">
<property name="usernameHeaderParam" value="iv-user" />
</bean>
<bean id="webSealAuthProvider" class="it.angelo.spring.web.security.auth.providers.WcmSealAuthProvider">
<property name="authenticationUserDetailsService" ref="wcmSecurityUserSvc"/>
</bean>
<security:user-service id="userService">
<security:user name="angelo" password="angelo" authorities="OMNIA_ADMIN,"/>
<security:user name="gina" password="gina" authorities="DOMAIN_ADMIN"/>
<security:user name="costa" password="costa" authorities="OMNIA_GUEST"/>
<security:user name="marianna" password="marianna" authorities="DOMAIN_GUEST"/>
</security:user-service>
<bean id="webSealReqMatcher" class="it.angelo.spring.web.security.auth.requestmatchers.WebSealRequestMatcher"/>
<bean id="wcmSecurityUserSvc" class="it.angelo.spring.web.security.userdetails.GrantedFromIvUsernameAttributesUserDetailsService"/>
</beans>
My custom filter
public class WebSealAuthenticationFilter extends AbstractAuthenticationProcessingFilter
{
protected WebSealAuthenticationFilter(RequestMatcher requiresAuthenticationRequestMatcher)
{
super(requiresAuthenticationRequestMatcher);
}
private static final Log logger = LogFactory.getLog(WebSealAuthenticationFilter.class.getName());
@Override
public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException, IOException, ServletException
{
WebSealIvUserNameAuthenticationToken auth = new WebSealIvUserNameAuthenticationToken(request.getHeader(WebSealRequestMatcher.DEFAULT_HEADER_PARAM));
auth.setDetails(this.authenticationDetailsSource.buildDetails(request));
return this.getAuthenticationManager().authenticate(auth);
}
@Override
protected final void successfulAuthentication(HttpServletRequest request, HttpServletResponse response, FilterChain chain, Authentication authResult) throws IOException, ServletException
{
if (logger.isDebugEnabled()) {
logger.debug("Authentication success. Updating SecurityContextHolder to contain: " + authResult);
}
SecurityContextHolder.getContext().setAuthentication(authResult);
// Propaga l'evento
if (this.eventPublisher != null) {
eventPublisher.publishEvent(new InteractiveAuthenticationSuccessEvent(authResult, this.getClass()));
}
request.getSession().setAttribute("autenticato", new Boolean(true));
chain.doFilter(request, response);
}
}
My request matcher (I know i can use the org.springframework.security.web.util.matcher.RequestHeaderRequestMatcher class and in future I'll use it)
public class WebSealRequestMatcher implements RequestMatcher
{
public static final String DEFAULT_HEADER_PARAM = "iv-user";
@Override
public boolean matches(HttpServletRequest request)
{
String headerParam = request.getHeader(DEFAULT_HEADER_PARAM);
return !StringUtils.hasText(headerParam);
}
}
My AuthenticationProvider
public class WcmSealAuthProvider implements AuthenticationProvider
{
private static final Log logger = LogFactory.getLog(WcmSealAuthProvider.class.getName());
private GrantedAuthoritiesMapper authoritiesMapper = new NullAuthoritiesMapper();
private AuthenticationUserDetailsService<WebSealIvUserNameAuthenticationToken> authenticationUserDetailsService;
public void setAuthenticationUserDetailsService(final AuthenticationUserDetailsService<WebSealIvUserNameAuthenticationToken> svc)
{
this.authenticationUserDetailsService = svc;
}
public AuthenticationUserDetailsService<WebSealIvUserNameAuthenticationToken> getAuthenticationUserDetailsService()
{
return authenticationUserDetailsService;
}
@Override
public Authentication authenticate(Authentication authentication) throws AuthenticationException
{
if( !supports(authentication.getClass()) )
{
if( logger.isInfoEnabled() )
{
logger.info("Classe "+authentication.getClass().getName()+" non supportata");
}
return null;
}
if( authentication instanceof WebSealIvUserNameAuthenticationToken )
{
return doAuthenticationNow(authentication);
}
return null;
}
@Override
public boolean supports(Class<?> authentication)
{
return WebSealIvUserNameAuthenticationToken.class.isAssignableFrom(authentication);
}
private WebSealAuthenticationToken doAuthenticationNow(final Authentication authentication)
{
try {
final String ivUserName = ((WebSealIvUserNameAuthenticationToken)authentication).getIvUserName();
UserDetails userDetails = loadUserByIvUserName(ivUserName);
return new WebSealAuthenticationToken(userDetails, userDetails.getAuthorities(),
this.authoritiesMapper.mapAuthorities(userDetails.getAuthorities()), userDetails, userDetails.getUsername());
} catch (final Exception e) {
throw new BadCredentialsException(e.getMessage(), e);
}
}
protected UserDetails loadUserByIvUserName( final String ivUserName )
{
return this.authenticationUserDetailsService.loadUserDetails(new WebSealIvUserNameAuthenticationToken(ivUserName));
}
}
My AuthenticationTokens
public class WebSealIvUserNameAuthenticationToken extends AbstractAuthenticationToken implements Serializable
{
private static final long serialVersionUID = SpringSecurityCoreVersion.SERIAL_VERSION_UID;
private String ivUserName;
public WebSealIvUserNameAuthenticationToken(String ivUserName)
{
super(new ArrayList<GrantedAuthority>());
this.ivUserName = ivUserName;
}
@Override
public Object getCredentials()
{
return null;
}
@Override
public Object getPrincipal()
{
return null;
}
public String getIvUserName()
{
return ivUserName;
}
}
public final class WebSealAuthenticationToken extends AbstractAuthenticationToken implements Serializable
{
private static final long serialVersionUID = SpringSecurityCoreVersion.SERIAL_VERSION_UID;
private final Object credentials;
private final Object principal;
private final UserDetails userDetails;
private String ivUserName;
public WebSealAuthenticationToken( final Object principal,
final Object credentials,
final Collection<? extends GrantedAuthority> authorities,
final UserDetails userDetails,
final String ivUserName)
{
super(authorities);
if (((principal == null) || "".equals(principal) || (credentials == null)
|| "".equals(credentials) || (authorities == null) || (userDetails == null)
|| !StringUtils.hasText(ivUserName))) {
throw new IllegalArgumentException("Cannot pass null or empty values to constructor");
}
this.principal = principal;
this.credentials = credentials;
this.userDetails = userDetails;
this.ivUserName = ivUserName;
setAuthenticated(true);
}
@Override
public Object getCredentials()
{
return this.credentials;
}
@Override
public Object getPrincipal()
{
return this.principal;
}
public UserDetails getUserDetails()
{
return userDetails;
}
public String getIvUserName()
{
return ivUserName;
}
@Override
public boolean equals(final Object obj) {
if (!super.equals(obj)) {
return false;
}
if (obj instanceof WebSealAuthenticationToken) {
WebSealAuthenticationToken test = (WebSealAuthenticationToken) obj;
if (!this.ivUserName.equals(test.getIvUserName())) {
return false;
}
return true;
}
return false;
}
}
My AuthenticationUserDetailsService
public abstract class AbstractUserDetailsService implements AuthenticationUserDetailsService<WebSealIvUserNameAuthenticationToken>
{
@Override
public UserDetails loadUserDetails(final WebSealIvUserNameAuthenticationToken token) throws UsernameNotFoundException
{
return loadUserDetails(token.getIvUserName());
}
protected abstract UserDetails loadUserDetails(String ivUserName);
}
public class GrantedFromIvUsernameAttributesUserDetailsService extends AbstractUserDetailsService
{
private static final String NON_EXISTENT_PASSWORD_VALUE = "NO_PASSWORD";
@Override
protected UserDetails loadUserDetails(String ivUserName)
{
// TODO Inserire il codice per recuperare l'utente da PUMA
final List<GrantedAuthority> grantedAuthorities = new ArrayList<GrantedAuthority>();
grantedAuthorities.add(new SimpleGrantedAuthority("OMNIA_ADMIN"));
grantedAuthorities.add(new SimpleGrantedAuthority("DOMAIN_ADMIN"));
grantedAuthorities.add(new SimpleGrantedAuthority("OMNIA_GUEST"));
grantedAuthorities.add(new SimpleGrantedAuthority("DOMAIN_GUEST"));
return new User("fromWebSeal", NON_EXISTENT_PASSWORD_VALUE, true, true, true, true, grantedAuthorities);
}
}
My AuthenticationDetailsSource
public class ServiceAuthenticationDetailsSource implements AuthenticationDetailsSource<HttpServletRequest, ServiceAuthenticationDetails>
{
@Override
public ServiceAuthenticationDetails buildDetails(HttpServletRequest request)
{
return new DefaultServiceAuthenticationDetails(request);
}
}
public class DefaultServiceAuthenticationDetails extends WebAuthenticationDetails implements ServiceAuthenticationDetails
{
private static final long serialVersionUID = 6056034551086630421L;
private String ivUserName;
public DefaultServiceAuthenticationDetails(HttpServletRequest request)
{
super(request);
String headerParam = request.getHeader(WebSealRequestMatcher.DEFAULT_HEADER_PARAM);
this.ivUserName = StringUtils.hasText(headerParam) ? headerParam : "nonValorizzato"+System.nanoTime();
}
@Override
public String getIvUserName()
{
return ivUserName;
}
@Override
public int hashCode() {
final int prime = 31;
int result = super.hashCode();
result = prime * result + ivUserName.hashCode();
return result;
}
@Override
public boolean equals(Object obj) {
if (this == obj) {
return true;
}
if (!super.equals(obj) || !(obj instanceof DefaultServiceAuthenticationDetails)) {
return false;
}
ServiceAuthenticationDetails that = (ServiceAuthenticationDetails) obj;
return ivUserName.equals(that.getIvUserName());
}
}
public interface ServiceAuthenticationDetails extends Serializable
{
public String getIvUserName();
}
It seems to me to be all correct; anyway when I try to access to the page http://myHost:myPort/media/comiajax/pages/uploadmedia I have a loop and the page can't be loaded..... Can anybod help me?
Any tips is welcome
Thank you
Angelo
1 answers
solution1
0 2014-06-07 08:51:50
I just realized that I did some mistakes in my code :) Not all works pretty good; first of all I modified my EntryPoint in this way:
public class WebSealEntryPoint implements AuthenticationEntryPoint, InitializingBean
{
private String webSealUrl;
@Override
public void afterPropertiesSet() throws Exception
{
Assert.hasLength(this.webSealUrl, "Indicare l'URL del WebSeal");
}
@Override
public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException authExp) throws IOException, ServletException
{
String url = webSealUrl+"?service="+request.getRequestURL();
response.sendRedirect(url);
}
public String getWebSealUrl()
{
return webSealUrl;
}
public void setWebSealUrl(String webSealUrl)
{
this.webSealUrl = webSealUrl;
}
}
As yuo can see, I added a redirect very similar to the one added by CAS; then I modified my security-context.xml in this way:
<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:context="http://www.springframework.org/schema/context"
xmlns:security="http://www.springframework.org/schema/security"
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd">
<security:http use-expressions="true" disable-url-rewriting="true"
entry-point-ref="webSealEntryPoint" request-matcher-ref="webSealReqMatcher">
<security:intercept-url pattern="/css/**" access="permitAll"/>
<security:intercept-url pattern="/DataTables-1.9.4/**" access="permitAll"/>
<security:intercept-url pattern="/images/**" access="permitAll"/>
<security:intercept-url pattern="/jquery-ui-1.10.3/**" access="permitAll"/>
<security:intercept-url pattern="/json/**" access="permitAll"/>
<security:intercept-url pattern="/jstree-v.pre1.0/**" access="permitAll"/>
<security:intercept-url pattern="/ol213/**" access="permitAll"/>
<security:intercept-url pattern="/sld/**" access="permitAll"/>
<security:intercept-url pattern="/comiajax/pages/*" access="hasAnyRole('OMNIA_ADMIN','DOMAIN_ADMIN','OMNIA_GUEST', 'DOMAIN_GUEST')"/>
<security:session-management>
<security:concurrency-control error-if-maximum-exceeded="true" max-sessions="1"/>
</security:session-management>
<security:custom-filter ref="webSealAuthFilter" position="LAST"/>
</security:http>
<security:authentication-manager alias="authenticationManager">
<security:authentication-provider ref="webSealAuthProvider" />
</security:authentication-manager>
<bean id="webSealAuthFilter" class="it.angelo.spring.web.security.auth.filter.WebSealAuthenticationFilter">
<constructor-arg ref="webSealReqMatcher"/>
<property name="authenticationManager" ref="authenticationManager"/>
<property name="authenticationDetailsSource">
<bean class="it.angelo.spring.web.security.auth.ServiceAuthenticationDetailsSource"/>
</property>
</bean>
<bean id="webSealEntryPoint" class="it.angelo.spring.web.security.entrypoint.WebSealEntryPoint">
<property name="webSealUrl" value="http://localhost:8380/WebSeal" />
</bean>
<bean id="webSealAuthProvider" class="it.angelo.spring.web.security.auth.providers.WcmSealAuthProvider">
<property name="authenticationUserDetailsService" ref="wcmSecurityUserSvc"/>
</bean>
<security:user-service id="userService">
<security:user name="angelo" password="angelo" authorities="OMNIA_ADMIN,"/>
<security:user name="gina" password="gina" authorities="DOMAIN_ADMIN"/>
<security:user name="costa" password="costa" authorities="OMNIA_GUEST"/>
<security:user name="marianna" password="marianna" authorities="DOMAIN_GUEST"/>
</security:user-service>
<bean id="webSealReqMatcher" class="it.angelo.spring.web.security.auth.requestmatchers.WebSealRequestMatcher"/>
<bean id="wcmSecurityUserSvc" class="it.angelo.spring.web.security.userdetails.GrantedFromIvUsernameAttributesUserDetailsService"/>
</beans>
Thank you
Angelo
The technical post webpages of this site follow the CC BY-SA 4.0 protocol. If you need to reprint, please indicate the site URL or the original address.Any question please contact:yoyou2525@163.com.
Related Question
Spring Security custom filter
Spring security custom filter initialization
Custom filter position in spring security
Spring security custom token filter
spring security - custom filter positioning
Spring Security custom filter exemption
Custom Spring Security Logout Filter
Spring Security Custom Filter (Change Password)
Spring Security 3 Custom Filter and URL Patterns
Spring Security custom filter registration with Java config
Related Tags