TAM Webseal +彈簧預認證

Question

有沒有人使用TAM Web-seal進行彈簧預認證？ 你能分享一下配置細節嗎？

Answer 1

如果WebSEAL轉發與iv-user頭的用戶名的要求，那麼它是相對簡單的配置Spring安全：

<security:http auto-config="false" use-expressions="true" entry-point-ref="authenticationEntryPoint" access-decision-manager-ref="httpAccessDecisionManager"> 

    <security:custom-filter ref="webSealPreAuthFilter" position="PRE_AUTH_FILTER"/> 
    ... 
</security:http> 


<bean id="webSealPreAuthFilter" class="org.springframework.security.web.authentication.preauth.RequestHeaderAuthenticationFilter"> 
    <property name="authenticationManager" ref="authenticationManager"/> 
    <property name="principalRequestHeader" value="iv-user"/> 

    <!-- exceptionIfHeaderMissing AND checkForPrincipalChanges needs to be enable to check that each request needs a "iv-user" header --> 
    <property name="checkForPrincipalChanges" value="true"/> 
    <property name="exceptionIfHeaderMissing" value="true"/> 
</bean> 


<alias name="authenticationManager" alias="org.springframework.security.authenticationManager"/> 
<bean id="authenticationManager" class="org.springframework.security.authentication.ProviderManager"> 
    <property name="authenticationEventPublisher"> 
     <bean class="org.springframework.security.authentication.DefaultAuthenticationEventPublisher"/> 
    </property> 
    <constructor-arg name="providers"> 
     <list> 
      <ref local="preAuthenticatedAuthenticationProvider"/> 
     </list> 
    </constructor-arg> 
</bean> 

<bean id="preAuthenticatedAuthenticationProvider" 
     class="org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationProvider"> 
    <property name="preAuthenticatedUserDetailsService"> 
     <bean class="org.springframework.security.core.userdetails.UserDetailsByNameServiceWrapper"> 
      <constructor-arg name="userDetailsService" ref="userDetailsService"/> 
     </bean> 
    </property> 
</bean> 

<bean id="authenticationEntryPoint" class="org.springframework.security.web.authentication.Http403ForbiddenEntryPoint"/> 

你需要一個userDetailsService但是這是非常dependend放在你應用程序的工作。