Java EE 控制器上的 Spring 安全身份驗證

Question

我有一個 webServer，它有一個 web 界面，用戶使用 Spring security 進行身份驗證，但我需要使用相同的引擎來驗證來自我的移動應用程序的登錄請求的用戶，我需要對它們進行身份驗證，我一直在看身份驗證類，但我似乎無法在我第一次這樣做時把它們弄對，我希望有人能幫我解決這個問題，因為我有點迷茫

@Post
@Path("/mobile/session")
public void login(String username, String password) {
    Usuario usuario = usuarioService.loadByUserName(username);
    UsernamePasswordAuthenticationToken usernamePassAuthToken = new UsernamePasswordAuthenticationToken(usuario,EncriptarMD5.encriptar(password));
    Authentication auth = authenticationManager.authenticate(usernamePassAuthToken);
    if(auth.isAuthenticated()){
        result.use(Results.json()).from(RequestContextHolder.currentRequestAttributes().getSessionId().toString(), "token").serialize();
        
    } else {
        result.use(Results.http()).setStatusCode(401);
    }
}

我收到以下異常

br.com.caelum.vraptor.InterceptionException：引發異常，請檢查根本原因以獲取詳細信息：org.springframework.security.authentication.BadCredentialsException：br.com.caelum.vraptor.interceptor.ExecuteMethodInterceptor.intercept(ExecuteMethodInterceptor.java: 96) 在 br.com.caelum.vraptor.core.ToInstantiateInterceptorHandler.execute(ToInstantiateInterceptorHandler.java:54) 在 br.com.caelum.vraptor.core.DefaultInterceptorStack.next(DefaultInterceptorStack.java:54) 在 br.com.caelum .vraptor.core.LazyInterceptorHandler.execute(LazyInterceptorHandler.java:61) at br.com.caelum.vraptor.core.DefaultInterceptorStack.next(DefaultInterceptorStack.java:54) at br.com.caelum.vraptor.interceptor.ParametersInstantiatorInterceptor.interceptor (ParametersInstantiatorInterceptor.java:93) at br.com.caelum.vraptor.core.LazyInterceptorHandler.execute(LazyInterceptorHandler.java:59) at br.com.caelum.vraptor.core.DefaultInterceptorStack.next(DefaultInterceptorStack.java:54) at br.com.otgmobile .trackgoweb.util.CustomInterceptor.intercept(CustomInterceptor.java:24) 在 br.com.caelum.vraptor.core.ToInstantiateInterceptorHandler.execute(ToInstantiateInterceptorHandler.java:54) 在 br.com.caelum.vraptor.core.DefaultInterceptorStack.next (DefaultInterceptorStack.java:54) at br.com.caelum.vraptor.core.ToInstantiateInterceptorHandler.execute(ToInstantiateInterceptorHandler.java:56) at br.com.caelum.vraptor.core.DefaultInterceptorStack.next(DefaultInterceptorStack.java:54) at br.com.caelum.vraptor.interceptor.FlashInterceptor.intercept(FlashInterceptor.java:83) 在 br.com.caelum.vraptor.core.ToInstantiateInterceptorHandler.execute(ToInstantiateInterceptorHandler.java:54) 在 br.com.caelum.vraptor。 core.DefaultInterceptorStack.next(DefaultInterceptorStack.java:54) at br.com.caelum.vraptor.interceptor.ExceptionHandlerInterceptor.intercept(ExceptionHandlerInterceptor.java:71) at br.com.caelum.vraptor.core.ToInstantiateInterceptorHandler.execute(ToInstantiateInterceptorHandler. java:54) 在 br。 com.caelum.vraptor.core.DefaultInterceptorStack.next(DefaultInterceptorStack.java:54) at br.com.caelum.vraptor.interceptor.InstantiateInterceptor.intercept(InstantiateInterceptor.java:48) at br.com.caelum.vraptor.core。 ToInstantiateInterceptorHandler.execute(ToInstantiateInterceptorHandler.java:54) at br.com.caelum.vraptor.core.DefaultInterceptorStack.next(DefaultInterceptorStack.java:54) at br.com.caelum.vraptor.interceptor.ResourceLookupInterceptor.intercept(ResourceLookupInterceptor. 69) 在 br.com.caelum.vraptor.core.ToInstantiateInterceptorHandler.execute(ToInstantiateInterceptorHandler.java:54) 在 br.com.caelum.vraptor.core.DefaultInterceptorStack.next(DefaultInterceptorStack.java:54) 在 br.com.caelum .vraptor.core.EnhancedRequestExecution.execute(EnhancedRequestExecution.java:44) at br.com.caelum.vraptor.VRaptor$1.insideRequest(VRaptor.java:91) at br.com.caelum.vraptor.ioc.spring.SpringProvider。 br.com.caelum.vraptor.VRaptor.doFilter( VRaptor.java:88) 在 org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:243) 在 org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210) 在 org.sitemesh.webapp .contentfilter.ContentBufferingFilter.bufferAndPostProcess(ContentBufferingFilter.java:169) at org.sitemesh.webapp.contentfilter.ContentBufferingFilter.doFilter(ContentBufferingFilter.java:126) at org.sitemesh.config.ConfigurableSiteMeshFilter.doFilter(ConfigurableSiteMeshFilter.java:163) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:243) 在 org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210) 在 org.springframework.orm.jpa.support.OpenEntityManagerInViewFilter。 doFilterInternal(OpenEntityManagerInViewFilter.java:147) 在 org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:76) 在 org.apache.catalina.core.ApplicationFilterChain.internalDoFi 過濾器（ApplicationFilterChain.java:243）在 org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210) 在 org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:186) 在 org.springframework .security.web.FilterChainProxy.doFilter(FilterChainProxy.java:160) 在 org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:346) 在 org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java :259) 在 org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:243) 在 org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210) 在 org.apache.catalina.core。 StandardWrapperValve.invoke(StandardWrapperValve.java:222) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:123) at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase).java .apache.catalina.co re.StandardHostValve.invoke(StandardHostValve.java:171) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:99) at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:93)在 org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:118) 在 org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:407) 在 org.apache.coyote.http11.AbstractHttp11Processor.process (AbstractHttp11Processor.java:1004) at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:589) at org.apache.tomcat.util.net.JioEndpoint$SocketProcessor.run(JioEndpoint.java:310) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1110) 在 java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:603) 在 java.lang.Thread.run(Thread.java:722)引起：org.springframework.security.authentication.BadCredentialsException：憑證錯誤

Answer 1

我認為您缺少的一件是在您通過身份驗證將身份驗證傳遞給 SecurityContextHolder 以將其附加到線程之后。

SecurityContextHolder.getContext().setAuthentication(authentication);

此外，在進行身份驗證時，不要將加密值傳遞給 Auth 令牌。

UsernamePasswordAuthenticationToken usernamePassAuthToken = new UsernamePasswordAuthenticationToken(usuario,password);

身份驗證管理器將負責為您加密。