Java 类org.springframework.security.web.authentication.preauth.RequestHeaderAuthenticationFilter 实例源码

@SuppressWarnings("PMD.SignatureDeclareThrowsException")
private RequestHeaderAuthenticationFilter requestHeaderAuthenticationFilter() throws Exception {
    RequestHeaderAuthenticationFilter f = new RequestHeaderAuthenticationFilter();
    f.setPrincipalRequestHeader("X-Forwarded-User");
    f.setCredentialsRequestHeader("X-Forwarded-Access-Token");
    f.setAuthenticationManager(authenticationManager());
    f.setAuthenticationDetailsSource(
        (AuthenticationDetailsSource<HttpServletRequest, PreAuthenticatedGrantedAuthoritiesWebAuthenticationDetails>)
            (request) ->new PreAuthenticatedGrantedAuthoritiesWebAuthenticationDetails(
                request,
                AuthorityUtils.createAuthorityList("ROLE_AUTHENTICATED")
            )
    );
    f.setAuthenticationFailureHandler(new SimpleUrlAuthenticationFailureHandler());
    f.setExceptionIfHeaderMissing(false);
    return f;
}

@SuppressWarnings("PMD.SignatureDeclareThrowsException")
private RequestHeaderAuthenticationFilter requestHeaderAuthenticationFilter() throws Exception {
    RequestHeaderAuthenticationFilter f = new RequestHeaderAuthenticationFilter();
    f.setPrincipalRequestHeader("X-Forwarded-User");
    f.setCredentialsRequestHeader("X-Forwarded-Access-Token");
    f.setAuthenticationManager(authenticationManager());
    f.setAuthenticationDetailsSource(
        (AuthenticationDetailsSource<HttpServletRequest, PreAuthenticatedGrantedAuthoritiesWebAuthenticationDetails>)
            (request) ->new PreAuthenticatedGrantedAuthoritiesWebAuthenticationDetails(
                request,
                AuthorityUtils.createAuthorityList("ROLE_AUTHENTICATED")
            )
    );
    f.setAuthenticationFailureHandler(new SimpleUrlAuthenticationFailureHandler());
    f.setExceptionIfHeaderMissing(false);
    return f;
}

/**
 * Creates an iv-user header filter to get user id from TAM/Webseal.
 *
 * @return the request header authentication filter
 * @throws Exception
 *             the exception if something goes wrong
 */
private RequestHeaderAuthenticationFilter createIVUserHeaderFilter() {
    RequestHeaderAuthenticationFilter requestFilter = new RequestHeaderAuthenticationFilter();
    requestFilter.setPrincipalRequestHeader("iv-user");
    requestFilter.setExceptionIfHeaderMissing(false);
    requestFilter.setCheckForPrincipalChanges(true);
    try {
        requestFilter.setAuthenticationManager(this.authenticationManagerBean());
    } catch (Exception e) {
        LOG.error("Error during security setup", e);
        throw new InstantiationException("Error creating authentication manager", WebSecurityConfig.class, e);
    }
    return requestFilter;
}

@Override
protected void configure(HttpSecurity http) throws Exception {
    http
        .csrf().disable()
        .authorizeRequests()
            .expressionHandler(webExpressionHandler())
            // Some general filters for access, more specific ones are set at each method
            .antMatchers(HttpMethod.POST, "/x509/api/report-bug").permitAll()
            .antMatchers(HttpMethod.POST, "/x509/api/org/apply").permitAll()
            .antMatchers(HttpMethod.GET, "/x509/api/certificates/crl/*").permitAll()
            .antMatchers(HttpMethod.GET, "/x509/api/certificates/ocsp/**").permitAll()
            .antMatchers(HttpMethod.POST, "/x509/api/certificates/ocsp/*").permitAll()
            .antMatchers(HttpMethod.POST, "/x509/api/**").authenticated()
            .antMatchers(HttpMethod.PUT, "/x509/api/**").authenticated()
            .antMatchers(HttpMethod.DELETE, "/x509/api/**").authenticated()
            .antMatchers(HttpMethod.GET, "/x509/api/**").authenticated()
    ;

    if (!useStandardSSL) {
        // Create and setup the filter used to extract the client certificate from the header
        RequestHeaderAuthenticationFilter certFilter = new RequestHeaderAuthenticationFilter();
        certFilter.setAuthenticationManager(authenticationManager());
        certFilter.setPrincipalRequestHeader("X-Client-Certificate");
        certFilter.setExceptionIfHeaderMissing(false);
        http.addFilter(certFilter);
    } else {
        // Using this approach is not recommended since we don't extract all the information from
        // the certificate, as done in the approach above.
        http
            .x509()
                .subjectPrincipalRegex("(.*)") // Extract all and let it be handled by the X509UserDetailsService. "CN=(.*?)," for CommonName only
                .userDetailsService(x509UserDetailsService())
        ;
    }
}

@Override
protected void configure(final HttpSecurity http) throws Exception {

    final BasicAuthenticationEntryPoint basicAuthEntryPoint = new BasicAuthenticationEntryPoint();
    basicAuthEntryPoint.setRealmName(springSecurityProperties.getBasic().getRealm());

    HttpSecurity httpSec = http.regexMatcher("\\/rest.*|\\/system/admin.*").csrf().disable();
    if (springSecurityProperties.isRequireSsl()) {
        httpSec = httpSec.requiresChannel().anyRequest().requiresSecure().and();
    }

    httpSec.addFilterBefore(new Filter() {
        @Override
        public void init(final FilterConfig filterConfig) throws ServletException {
            userAuthenticationFilter.init(filterConfig);
        }

        @Override
        public void doFilter(final ServletRequest request, final ServletResponse response,
                final FilterChain chain) throws IOException, ServletException {
            userAuthenticationFilter.doFilter(request, response, chain);
        }

        @Override
        public void destroy() {
            userAuthenticationFilter.destroy();
        }
    }, RequestHeaderAuthenticationFilter.class)
            .addFilterAfter(new AuthenticationSuccessTenantMetadataCreationFilter(systemManagement,
                    systemSecurityContext), SessionManagementFilter.class)
            .authorizeRequests().anyRequest().authenticated()
            .antMatchers(MgmtRestConstants.BASE_SYSTEM_MAPPING + "/admin/**")
            .hasAnyAuthority(SpPermission.SYSTEM_ADMIN);

    httpSec.httpBasic().and().exceptionHandling().authenticationEntryPoint(basicAuthEntryPoint);
    httpSec.anonymous().disable();
    httpSec.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
}

@Profile("sso")
@Bean
public RequestHeaderAuthenticationFilter requestHeaderAuthenticationFilter(AuthenticationManager authenticationManager) {
    RequestHeaderAuthenticationFilter filter = new RequestHeaderAuthenticationFilter();
    filter.setPrincipalRequestHeader("SM_USER");
    filter.setAuthenticationManager(authenticationManager);

    return filter;
}

@Profile("sso")
@Bean
public RequestHeaderAuthenticationFilter requestHeaderAuthenticationFilter(AuthenticationManager authenticationManager) {
    RequestHeaderAuthenticationFilter filter = new RequestHeaderAuthenticationFilter();
    filter.setPrincipalRequestHeader("SM_USER");
    filter.setAuthenticationManager(authenticationManager);

    return filter;
}