未调用自定义 AuthenticationProvider

我想要一个基本的受身份验证保护的 REST 应用程序。我遵循了一般指示http://www.baeldung.com/spring-security-authentication-provider为了让安全工作。

我最终创建了我的实现AuthenticationProvider，但 Spring 永远不会调用它。所有请求都以错误结束：

{"timestamp":1460199213227,"status":401,"error":"Unauthorized","message":"Full authentication is required to access this resource","path":"/test"}

AuthenticationProvider 没有做任何事情。

该应用程序是基于注释的，以下是相关部分：

安全设置

@Configuration
@Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)
public class ApplicationSecurity extends WebSecurityConfigurerAdapter {
    @Autowired
    CustomAuthenticationProvider authenticationProvider;

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.authenticationProvider(authenticationProvider);
    }

    @Override
    public void configure(HttpSecurity http) throws Exception {
        http
                .csrf().disable()
                .authenticationProvider(authenticationProvider)
                .authorizeRequests()
                .anyRequest().authenticated().and().httpBasic();
    }
}

认证提供者

@Component
public class CustomAuthenticationProvider implements AuthenticationProvider {
    @Autowired
    private UserDAO userDAO;
    @Autowired
    private Authenticator authenticator;

    @Override
    public Authentication authenticate(Authentication authentication) throws AuthenticationException {
        // This never gets called, I checked with debugger
        String username = authentication.getName();
        String password = authentication.getCredentials().toString();

        User user = userDAO.findByUsername(username);
        User authenticatedUser = authenticator.authenticate(user, password);
        if (authenticatedUser == null){
            throw new RESTAuthenticationException("Auth failed");
        }

        List<GrantedAuthority> authorityList = new ArrayList<>();
        return new UsernamePasswordAuthenticationToken(user, authorityList);
    }

    @Override
    public boolean supports(Class<?> aClass) {
        return aClass.equals(UsernamePasswordAuthenticationToken.class);
    }
}

控制器

@RestController
public class UserController {
    @RequestMapping(value = "/test")
    public ResponseEntity test(@AuthenticationPrincipal User user) {
        return ResponseEntity.ok().body(user);
    }
}

您收到状态代码 401 的响应。这是“未经授权”http 状态代码。这可能是由于您的请求中缺少/格式错误的授权标头引起的。

您正在使用Http-Basic：请求中需要以下标头：

Authorization: Basic QWxhZGRpbjpPcGVuU2VzYW1l

字符串在哪里QWxhZGRpbjpPcGVuU2VzYW1l是字符串<user>:<password>Base64 编码。