將每個http塊映射到特定的身份驗證提供程序

Question

我想根據用戶的上下文路徑來配置我的Spring Security配置。如果用戶違反與http://path1/resource1的網址，我想引導他們到一個特定的身份驗證提供商。如果他們進來http://path2/resource2我想引導他們到不同的身份驗證提供程序。這些URL路徑是基於REST的Web服務調用，所以這就是爲什麼它們是無狀態的而不是來自表單。目前，所有身份驗證提供程序都已執這種情況的最佳方法是什麼？我正在使用spring-security 3.1.0.M1。

<http pattern="/path1/**" create-session="stateless"> 
     <intercept-url pattern="/**" access="ROLE_USER,ROLE_VAR,ROLE_ADMIN" /> 
     <http-basic />  
</http> 
<http pattern="/path2/**" create-session="stateless"> 
     <intercept-url pattern="/**" access="ROLE_USER,ROLE_VAR,ROLE_ADMIN" /> 
     <http-basic />  
</http> 

Answer 1

這個工作對我來說：

<security:authentication-manager alias="basicAuthenticationManager"> 
    <security:authentication-provider user-service-ref="accountService"> 
    <security:password-encoder hash="sha"/> 
    </security:authentication-provider> 
    <security:authentication-provider user-service-ref="accountService"/> 
</security:authentication-manager> 

<bean id="basicProcessingFilter" class="org.springframework.security.web.authentication.www.BasicAuthenticationFilter"> 
    <property name="authenticationManager"> 
     <ref bean="basicAuthenticationManager" /> 
    </property>  
    <property name="authenticationEntryPoint"> 
     <ref bean="basicProcessingEntryPoint" /> 
    </property> 
</bean> 

<bean id="basicProcessingEntryPoint" 
    class="com.yourpackage.web.util.CustomBasicAuthenticationEntryPoint"> 
    <property name="realmName" value="yourRealm" /> 
</bean> 

<!-- Stateless RESTful service using Basic authentication --> 
<security:http pattern="/rest/**" create-session="stateless" entry-point-ref="basicProcessingEntryPoint">  
    <security:custom-filter ref="basicProcessingFilter" position="BASIC_AUTH_FILTER" />  
    <security:intercept-url pattern="/rest/new" access="IS_AUTHENTICATED_ANONYMOUSLY" /> 
    <security:intercept-url pattern="/rest/**" access="ROLE_USER" /> 
</security:http> 

<!-- Additional filter chain for normal users, matching all other requests --> 
<security:http use-expressions="true"> 
    <security:intercept-url pattern="/index.jsp" access="permitAll" />  
    <security:intercept-url pattern="/**" access="hasRole('ROLE_USER')" /> 

    <security:form-login login-page="/signin" 
     authentication-failure-url="/signin?signin_error=1" 
     default-target-url="/" 
     always-use-default-target="true"/>  
    <security:logout /> 
</security:http> 

我實現了身份驗證入口點，因爲我需要在某些情況下發送一些特殊的錯誤代碼，但你並不需要這麼做。

Answer 2

您可以定義每個HTTP模塊的認證管理器參考：

<http pattern="/api/**" authentication-manager-ref="apiAccess"> 
    ... 
</http> 

<http auto-config = "true" authentication-manager-ref="webAccess"> 
    ... 
</http> 

<!-- Web authentication manager --> 
<authentication-manager id="webAccess"> 
    <authentication-provider 
     user-service-ref="userService"> 
    </authentication-provider> 
</authentication-manager> 

<!-- API authentication manager -->  
<authentication-manager id="apiAccess"> 
    <authentication-provider 
     user-service-ref="developerService"> 
    </authentication-provider> 
</authentication-manager> 

此功能已在春季安全3.1增加了。