Spring安全性切换到Ldap身份验证和数据库权限

4 回答

• 0

  Spring Security已经支持LDAP开箱即用 . 它实际上有一个whole chapter .

  要使用和配置LDAP，请添加 spring-security-ldap 依赖项，然后使用AuthenticationManagerBuilder.ldapAuthentication进行配置 . LdapAuthenticationProviderConfigurer允许您设置所需的东西 .

  @Autowired
  public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
      auth.ldapAuthentication()
        .contextSource()
          .url(...)
          .port(...)
          .managerDn(...)
          .managerPassword(...)
        .and()
          .passwordEncoder(passwordEncoder())
          .userSearchBase(...)        
          .ldapAuthoritiesPopulator(new UserServiceLdapAuthoritiesPopulater(this.userService));      
  }
  

  这样的东西（它应该至少给你一个关于什么/如何配置东西的想法）有更多选项，但检查javadocs . 如果您不能按原样使用_1345570来检索角色（因为只有角色在数据库中），那么为此实现自己的LdapAuthoritiesPopulator .

  回复于 2024-05-09T03:46:42+08:00
• 7

  您需要创建一个 CustomAuthenticationProvider wich implements AuthenticationProvider 和 override authenticate 方法，例如：

  @Component
  public class CustomAuthenticationProvider
      implements AuthenticationProvider {
  
      @Override
      public Authentication authenticate(Authentication authentication) throws AuthenticationException {
          String username = authentication.getName();
          String password = authentication.getCredentials().toString();
  
          boolean authenticated = false;
          /**
           * Here implements the LDAP authentication
           * and return authenticated for example
           */
          if (authenticated) {
  
              String usernameInDB = "";
              /**
               * Here look for username in your database!
               * 
               */
              List<GrantedAuthority> grantedAuths = new ArrayList<>();
              grantedAuths.add(new     SimpleGrantedAuthority("ROLE_USER"));
              Authentication auth = new     UsernamePasswordAuthenticationToken(usernameInDB, password,     grantedAuths);
              return auth;
          } else {
              return null;
          }
      }
  
      @Override
      public boolean supports(Class<?> authentication) {
          return     authentication.equals(UsernamePasswordAuthenticationToken.class);
      }
  
  }
  

  然后，在 SecurityConfig 中，你需要 override the configure 那使用 AuthenticationManagerBuilder ：

  @Override
  public void configure(AuthenticationManagerBuilder auth) throws Exception {
      auth.authenticationProvider(this.authenticationProvider);
  }
  

  您可以自动装配CustomAuthenticationProvider执行此操作：

  @Autowired
  private CustomAuthenticationProvider authenticationProvider;
  

  执行此操作，您可以覆盖默认的身份验证行为 .

  回复于 2024-05-09T03:46:42+08:00
• 0

  我还发现了这一章Spring Docu Custom Authenicator并在LDAP和我的数据库用户之间 Build 了自己的切换 . 我可以毫不费力地在设置优先级的登录数据之间切换（在我的情况下 LDAP 获胜） .

  我已经为LDAP用户数据配置了一个带有yaml配置文件的LDAP，我在这里没有详细介绍 . 这可以通过Spring Docu LDAP Configuration轻松完成 .

  我从咔嗒声中删除了以下示例，例如logger / javadoc等，以突出显示重要部分 . @Order 注释确定使用登录数据的优先级 . 内存中的详细信息是硬编码的调试用户，仅用于开发目的 .

  SecurityWebConfiguration

  @Configuration
  @EnableWebSecurity
  public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
  
    @Inject
    private Environment env;
    @Inject
    private LdapConfiguration ldapConfiguration;
  
    @Inject
    private BaseLdapPathContextSource contextSource;
    @Inject
    private UserDetailsContextMapper userDetailsContextMapper;
  
    @Inject
    private DBAuthenticationProvider dbLogin;
  
    @Inject
    @Order(10) // the lowest number wins and is used first
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
      auth.userDetailsService(new InMemoryUserDetailsManager(getInMemoryUserDetails()));
    }
  
    @Inject
    @Order(11) // the lowest number wins and is used first
    public void configureLDAP(AuthenticationManagerBuilder auth) throws Exception {
      if (ldapConfiguration.isLdapEnabled()) {
        auth.ldapAuthentication().userSearchBase(ldapConfiguration.getUserSearchBase())
            .userSearchFilter(ldapConfiguration.getUserSearchFilter())
            .groupSearchBase(ldapConfiguration.getGroupSearchBase()).contextSource(contextSource)
            .userDetailsContextMapper(userDetailsContextMapper);
      }
    }
  
    @Inject
    @Order(12) // the lowest number wins and is used first
    public void configureDB(AuthenticationManagerBuilder auth) throws Exception {
      auth.authenticationProvider(dbLogin);
    }
  }
  

  DB Authenticator

  @Component
  public class DBAuthenticationProvider implements AuthenticationProvider {
  
    @Override
    public Authentication authenticate(Authentication authentication) throws AuthenticationException {
      String name = authentication.getName();
      String password = authentication.getCredentials().toString();
  
     // your code to compare to your DB
    }
  
    @Override
    public boolean supports(Class<?> authentication) {
      return authentication.equals(UsernamePasswordAuthenticationToken.class);
    }
  
    /**
     * @param original <i>mandatory</i> - input to be hashed with SHA256 and HEX encoding
     * @return the hashed input
     */
    private String sha256(String original) {
      MessageDigest md = null;
      try {
        md = MessageDigest.getInstance("SHA-256");
      } catch (NoSuchAlgorithmException e) {
        throw new AuthException("The processing of your password failed. Contact support.");
      }
  
      if (false == Strings.isNullOrEmpty(original)) {
        md.update(original.getBytes());
      }
  
      byte[] digest = md.digest();
      return new String(Hex.encodeHexString(digest));
    }
  
    private class AuthException extends AuthenticationException {
      public AuthException(final String msg) {
        super(msg);
      }
    }
  }
  

  随意询问细节 . 我希望这对其他人有用：D

  回复于 2024-05-09T03:46:42+08:00
• 1

  对于任何使用grails的人来说，它要简单得多 . 只需将其添加到您的配置：

  grails：plugin：springsecurity：ldap：authorities：retrieveDatabaseRoles：true

  回复于 2024-05-09T03:46:42+08:00