spring-security 具有自定义登录的Spring授权服务器

kzipqqlq  于 2022-11-11  发布在  Spring
关注(0)|答案(1)|浏览(200)

我在尝试新的Spring框架

<artifactId>spring-security-oauth2-authorization-server</artifactId>

我从baeldung得到了完美的POC工作,但是当我尝试比默认配置更远的时候,我没有设法让东西工作。
我尝试配置一个自定义登录页面,使用一个自定义路径来发布用户信息,登录页面显示良好,但在发布表单(用户名/密码)后,我得到一个404(未找到)
以下是我的配置:

@Bean
    @Order(Ordered.HIGHEST_PRECEDENCE)
    public SecurityFilterChain authServerSecurityFilterChain(HttpSecurity http) throws Exception {
// Authorization server Oauth2 default config commented
//        OAuth2AuthorizationServerConfiguration.applyDefaultSecurity(http);
//Extracted from Oauth2 default config
        OAuth2AuthorizationServerConfigurer<HttpSecurity> authorizationServerConfigurer = new OAuth2AuthorizationServerConfigurer();
        RequestMatcher endpointsMatcher = authorizationServerConfigurer.getEndpointsMatcher();
        http      
//Here is my custom form / post login config

                .antMatcher("/**")
                .formLogin()
                .loginPage("/home")
                .loginProcessingUrl("/mydomain/login")
                .usernameParameter("identifier")
                .permitAll()
                .and()
                .authenticationProvider(customAuthenticationProvider)
            .requestMatcher(endpointsMatcher)
                .authorizeRequests().antMatchers("/js/**","/assets/**", "/css/**","/home**", "/mydomain/**").permitAll()
                .and()
//Extracted from Oauth2 default config``
                .authorizeRequests((authorizeRequests) -> {
            ((ExpressionUrlAuthorizationConfigurer.AuthorizedUrl)authorizeRequests.anyRequest()).authenticated();
        })

                .csrf((csrf) -> {
            csrf.ignoringRequestMatchers(new RequestMatcher[]{endpointsMatcher});
        })
                .apply(authorizationServerConfigurer);
        return  http.build();

谢谢你的帮助!

roqulrg3

roqulrg31#

需要像这样实现Controller:

@GetMapping("/login")
    public String oauth2LoginPage(Model model,
                              @CurrentSecurityContext(expression = "authentication") Authentication authentication,
                              @Value("${spring.security.oauth2.server.login.captcha.enabled:true}") boolean enableCaptchaLogin,
                              @RequestAttribute(name = "org.springframework.security.web.csrf.CsrfToken", required = false) CsrfToken csrfToken) {

        if (!(authentication instanceof AnonymousAuthenticationToken)){
            return "redirect:/";
        }
        if (csrfToken != null) {
            model.addAttribute("_csrfToken", csrfToken);
        }
        SystemSettings systemSettings = new SystemSettings();
        model.addAttribute("enableCaptchaLogin",enableCaptchaLogin);
        model.addAttribute("systemSettings", systemSettings);
        return "oauth2_login";
    }

关于默认HTML表单,有几个要点:

  • 表单应执行到/login的发布
  • 该表格将需要包括一个CSRF令牌,该令牌由Thymeleaf自动包含。
  • 该表单应在名为username的参数中指定用户名
  • 表单应在名为password的参数中指定密码

如果发现HTTP参数错误,则表明用户未能提供有效的用户名/密码
如果找到HTTP参数logout,则表示用户已成功注销
参考链接:https://docs.spring.io/spring-security/reference/servlet/authentication/passwords/form.html

相关问题