使用Spring Security + Web Services进行多次登录

Question

我正在使用spring-security 3.1来实现两个不同的登录。 我首先要拥有一个数据库，该数据库为我带来了CustomUserDetailService凭据datos.Este，该数据库也可供管理员访问。 第二个端口用于用户，但信息来自Web服务，我称呼他为一种验证用户的方法。 第二个端口存在问题，并为第二个AuthenticationManager（Web服务）开发了CustomAuthenticationProvider，但是当我尝试访问spring-security时，用户将我发送到错误页面login.html？ 错误= true是Furmulario管理员访问权限。 Esteb是我的配置文件：

<http pattern="../resources/**" security="none" />
 <http pattern="/login.html*" security="none" />
 <http pattern="/loginUser.html*" security="none" />

 <!-- USER -->

    <http auto-config="true" authentication-manager-ref="wsAuthenticationManager" use-expressions="true" pattern="/testUser/**">
            <intercept-url pattern="/loginUser.html" access="permitAll" />
            <intercept-url pattern="/testUser/**" access="hasRole('user')" />
            <access-denied-handler error-page="/403" />
  <form-login login-page="/loginUser.html"
   authentication-failure-url="/loginUser.html?login_error=true"
   default-target-url="/testUser" />
  <logout invalidate-session="true" logout-success-url="/logintUser.html" />

    </http>

    <beans:bean id="customAuthenticationProvider" class="net.universia.test.service.CustomAuthenticationProvider" />

    <!-- Acceso contra WS -->
    <authentication-manager id="wsAuthenticationManager">
           <authentication-provider ref="customAuthenticationProvider" />
    </authentication-manager> 


 <!--ADMIN -->

 <http auto-config="true" use-expressions="true" authentication-manager-ref="authenticationManager"  >

  <intercept-url pattern="/login.html" access="permitAll" />
  <intercept-url pattern="/test/**" access="hasRole('admin')" />
  <intercept-url pattern="/member/**" access="hasAnyRole('moderator','admin')" />
  <intercept-url pattern="/testUser/**" access="hasRole('admin')" />

  <access-denied-handler error-page="/403" />
  <form-login login-page="/login.html"
   authentication-failure-url="/login.html?login_error=true"
   username-parameter="j_username" password-parameter="j_password"/>
  <logout invalidate-session="true" logout-success-url="/loginUser.html" />
  <remember-me user-service-ref="customUserDetailsService" />
 </http>



 <beans:bean id="customUserDetailsService" class="net.universia.test.service.CustomUserDetailsService" />
 <beans:bean id="md5PasswordEncoder"
  class="org.springframework.security.authentication.encoding.Md5PasswordEncoder" />

 <!-- Acceso contra base de datos -->
 <authentication-manager alias="authenticationManager" id="authenticationManager">
  <authentication-provider user-service-ref="customUserDetailsService">
   <password-encoder hash="md5" />
  </authentication-provider>
 </authentication-manager>

</beans:beans>

CustomUserDetailService参数管理员：

@Service
@Transactional(readOnly=true)
public class CustomUserDetailsService implements UserDetailsService {

    @Autowired
    private HibernateTestAdminDaoImpl userDAO;   


     public UserDetails loadUserByUsername(String login)throws UsernameNotFoundException {

       TestAdmin userAdmin = null;
    try {
        userAdmin = userDAO.getTestAdmin(login);
    } catch (BussinessException e) {
        // TODO Auto-generated catch block
        e.printStackTrace();
    }


       boolean enabled = true;
        boolean accountNonExpired = true;
        boolean credentialsNonExpired = true;
        boolean accountNonLocked = true;

        return new User(
                userAdmin.getLoginAdmin(), 
                userAdmin.getPasswordAdmin(), 
                enabled, 
                accountNonExpired, 
                credentialsNonExpired, 
                accountNonLocked,
                getAuthorities(userAdmin.getRole().getIdRole())
        );

        }




        public Collection<? extends GrantedAuthority> getAuthorities(Integer role) {
            List<GrantedAuthority> authList = getGrantedAuthorities(getRoles(role));
            return authList;

        }




        public List<String> getRoles(Integer role) {

            List<String> roles = new ArrayList<String>();

            if (role.intValue() == 1) {
                roles.add("admin");
                roles.add("moderator");

            } else if (role.intValue() == 2) {
                roles.add("moderator");
            }
            return roles;

        }



        public static List<GrantedAuthority> getGrantedAuthorities(List<String> roles) {
            List<GrantedAuthority> authorities = new ArrayList<GrantedAuthority>();

            for (String role : roles) {
                authorities.add(new SimpleGrantedAuthority(role));
            }
            return authorities;
        }
}

CustomAuthenticationProvider用户：

@Component
public class CustomAuthenticationProvider implements AuthenticationProvider {

    @Autowired
    private HibernateTestUsuarioDaoImpl userDAO;   
    UniversiaUser usw;


     public CustomAuthenticationProvider() {
            super();
        }

        // Retorna credenciales del usuario web service

        public Authentication authenticate(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException {
            /*
            final String loginUser = authentication.getName();
            final String password = authentication.getCredentials().toString();
            try {
                usw = userDAO.loginUserWS(loginUser, password);
            }  catch (UserRegistryWSException e) {
                String errorCode = e.getLocalizedMessage();
                System.out.print(errorCode);
            } catch (Exception e) {
                UsuarioUniversiaException ee = new UsuarioUniversiaException(
                        UsuarioUniversiaException.FERIA_VIRTUAL_USER_ERROR_LOGIN,
                        e);
                ee.setLogin(loginUser);
                throw ee;
            }


            if (usw.getEmail().equals("loginUser")) {

                final List<GrantedAuthority> grantedAuths = new ArrayList<>();
                grantedAuths.add(new SimpleGrantedAuthority("user"));
                final UserDetails principal = new User(loginUser, password, grantedAuths);
                final Authentication auth = new UsernamePasswordAuthenticationToken(principal, password, grantedAuths);
                return auth;
            } else {
                return null;
            }
        */
              //Test parameters

              final String loginUser = request.getParameter("username");
              final String password = request.getParameter("password");

              if (loginUser.equals("admin") && password.equals("system")) {
                  final List<GrantedAuthority> grantedAuths = new ArrayList<>();
                  grantedAuths.add(new SimpleGrantedAuthority("user"));
                  final UserDetails principal = new User(loginUser, password, grantedAuths);
                  final Authentication auth = new UsernamePasswordAuthenticationToken(principal, password, grantedAuths);
                  return auth;
              } else {
                  return null;
              }
        }

        @Override
        public boolean supports(final Class<?> authentication) {
            return authentication.equals(UsernamePasswordAuthenticationToken.class);
        }

        @Override
        public Authentication authenticate(Authentication authentication)
                throws AuthenticationException {
            // TODO Auto-generated method stub
            return null;
        }
}

在customautheticationprovider中讨论来自Web服务的内容并发送测试参数谢谢，欢迎任何帮助

Answer 1

现在我有两个正在跑步！ 一个customAuthenticationProvider用户和一个用于管理员的customAuthenticationDetailService，并实现每个过滤器