Spring Boot 1.4：Principal必須爲空例外

自從Spring引導發佈以來，我遇到以下問題1.4 我有一個自定義身份驗證提供程序，它管理Spring Security的JWT令牌解析。基本上，當令牌無效或過期時，我會拋出一個BadCredentialsException。我也有一個與JSONSpring Boot 1.4：Principal必須爲空例外

@Override 
public void commence(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, AuthenticationException e) throws IOException, ServletException 
{ 
    httpServletResponse.setContentType("application/json"); 
    httpServletResponse.setStatus(HttpServletResponse.SC_UNAUTHORIZED); 
    httpServletResponse.getOutputStream().println("{ \"error\": \"" + e.getMessage() + "\" }"); 

}

這裏一個未經授權的HttpServlet響應重新格式化消息AutenticationEntryPoint是管理身份驗證提供

@Override 
protected void doFilterInternal(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, FilterChain filterChain) throws ServletException, IOException 

{ 

    String authToken = httpServletRequest.getHeader("Authorization"); 



    JwtToken token = new JwtToken(authToken); 
    try 
    { 
     Authentication auth = authenticationManager.authenticate(token); 
     SecurityContextHolder.getContext().setAuthentication(auth); 
     filterChain.doFilter(httpServletRequest, httpServletResponse); 

    } 
    catch(AuthenticationException ae) 
    { 
     SecurityContextHolder.clearContext(); 
     unauthorizedHandler.commence(httpServletRequest, httpServletResponse, ae); 
    }

這是在春季啓動1.3做工精細的異常過濾器0.6 現在我收到以下錯誤

java.lang.IllegalArgumentException異常：主要經營不能爲空堆棧跟蹤：

java.lang.IllegalArgumentException: Principal must not be null 
at org.springframework.util.Assert.notNull(Assert.java:115) ~[spring-core-4.3.2.RELEASE.jar:4.3.2.RELEASE] 
at org.springframework.boot.actuate.audit.AuditEvent.<init>(AuditEvent.java:83) ~[spring-boot-actuator-1.4.0.RELEASE.jar:1.4.0.RELEASE] 
at org.springframework.boot.actuate.audit.AuditEvent.<init>(AuditEvent.java:59) ~[spring-boot-actuator-1.4.0.RELEASE.jar:1.4.0.RELEASE] 
at org.springframework.boot.actuate.security.AuthenticationAuditListener.onAuthenticationFailureEvent(AuthenticationAuditListener.java:67) ~[spring-boot-actuator-1.4.0.RELEASE.jar:1.4.0.RELEASE] 
at org.springframework.boot.actuate.security.AuthenticationAuditListener.onApplicationEvent(AuthenticationAuditListener.java:50) ~[spring-boot-actuator-1.4.0.RELEASE.jar:1.4.0.RELEASE] 
at org.springframework.boot.actuate.security.AuthenticationAuditListener.onApplicationEvent(AuthenticationAuditListener.java:34) ~[spring-boot-actuator-1.4.0.RELEASE.jar:1.4.0.RELEASE] 
at org.springframework.context.event.SimpleApplicationEventMulticaster.invokeListener(SimpleApplicationEventMulticaster.java:166) ~[spring-context-4.3.2.RELEASE.jar:4.3.2.RELEASE] 
at org.springframework.context.event.SimpleApplicationEventMulticaster.multicastEvent(SimpleApplicationEventMulticaster.java:138) ~[spring-context-4.3.2.RELEASE.jar:4.3.2.RELEASE] 
at org.springframework.context.support.AbstractApplicationContext.publishEvent(AbstractApplicationContext.java:382) ~[spring-context-4.3.2.RELEASE.jar:4.3.2.RELEASE] 
at org.springframework.context.support.AbstractApplicationContext.publishEvent(AbstractApplicationContext.java:336) ~[spring-context-4.3.2.RELEASE.jar:4.3.2.RELEASE] 
at org.springframework.security.authentication.DefaultAuthenticationEventPublisher.publishAuthenticationFailure(DefaultAuthenticationEventPublisher.java:124) ~[spring-security-core-4.1.1.RELEASE.jar:4.1.1.RELEASE] 
at org.springframework.security.authentication.ProviderManager.prepareException(ProviderManager.java:240) ~[spring-security-core-4.1.1.RELEASE.jar:4.1.1.RELEASE] 
at org.springframework.security.authentication.ProviderManager.authenticate(ProviderManager.java:233) ~[spring-security-core-4.1.1.RELEASE.jar:4.1.1.RELEASE] 
at org.springframework.security.authentication.ProviderManager.authenticate(ProviderManager.java:199) ~[spring-security-core-4.1.1.RELEASE.jar:4.1.1.RELEASE] 
at org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter$AuthenticationManagerDelegator.authenticate(WebSecurityConfigurerAdapter.java:454) ~[spring-security-config-4.1.1.RELEASE.jar:4.1.1.RELEASE] 
at com.icentia.tracking.security.JwtFilter.doFilterInternal(JwtFilter.java:49) ~[classes/:na]

這是來自Spring Boot Actuator。如果我刪除它，它就像以前一樣工作？！？

似乎有在這裏列出的錯誤，但不一樣的： https://github.com/spring-projects/spring-boot/issues/6447

我想有致動器的生產，任何解決辦法，我可以用這個？

謝謝

來源

2016-08-15 Ali Dufour

嗨 - 你已經發布了一段時間，你解決了這個問題嗎？ –

問題在於，Acutator一旦添加到Spring Boot中就會跟蹤不成功的登錄（審計）。我改變了JWT檢查把一個BadCredential異常拋出到一個Nonce異常，這可能是因爲它沒有在這種情況下檢查getName形式的Principal（但我沒有驗證這一點） –

很高興知道，謝謝！埃斯特班也發佈了類似的答案。 –

確保從Principal接口getName()方法返回的JwtToken類非空值。

來源

2016-09-09 17:42:52 esteban

阿里，只需指出 - 這個問題可能與引用的開放式彈簧引導錯誤無關，因爲您擁有有效的身份驗證鏈。 Spring引導的問題是，即使您手動註冊了「@ WebSecurityConfiguration」，仍然會安裝默認的bean –

Spring Boot 1.4：Principal必須爲空例外

回答

相關問題