В проекте с Java 7 и Spring 3.1 есть несколько областей авторизации: одна для проверки логина и пароля, а также уровня доступа к тем или иным функциям. Вторая для API адресов, на которые накручивается базовая аутентификация.
public class TRUsernamePasswordAuthenticationToken extends UsernamePasswordAuthenticationToken {
private boolean anonymous;
private UserInfo.UserType userType;
private UserInfo.UserLanguage userLanguage;
private String userName = "";
private JSONObject jsonAuthorities;
private Long userId;
private Long selectedOrganizationId;
private Collection<OrganizationViewBean> organizations = new ArrayList<>();
public TRUsernamePasswordAuthenticationToken(Long currentOrganizationId, UserInfo.UserLanguage userLanguage) {
super(null, null);
anonymous = true;
this.selectedOrganizationId = currentOrganizationId;
this.userLanguage = userLanguage;
}
public TRUsernamePasswordAuthenticationToken(Long userId,
Object principal,
String userName,
UserInfo.UserType userType,
UserInfo.UserLanguage userLanguage,
Object credentials,
Collection<? extends GrantedAuthority> authorities,
Collection<OrganizationViewBean> organizations,
Long currentOrganizationId) {
super(principal, credentials, authorities);
this.userId = userId;
this.userName = userName;
this.userType = userType;
this.userLanguage = userLanguage;
jsonAuthorities = new JSONObject();
for (GrantedAuthority authority : authorities) {
jsonAuthorities.put(authority.getAuthority(), Boolean.TRUE);
}
for (final OrganizationViewBean organization : organizations) {
if (organization.getRemoved() == null || !organization.getRemoved()) {
this.organizations.add(organization);
}
}
this.selectedOrganizationId = currentOrganizationId;
}
CustomSessionAuthenticationStrategy
public class CustomSessionAuthenticationStrategy extends ConcurrentSessionControlStrategy {
/**
* @param sessionRegistry the session registry which should be updated when the authenticated session is changed.
*/
public CustomSessionAuthenticationStrategy(SessionRegistry sessionRegistry) {
super(sessionRegistry);
}
@Override
protected void onSessionChange(String originalSessionId, HttpSession newSession, Authentication auth) {
super.onSessionChange(originalSessionId, newSession, auth);
SessionsInfo sessionsInfo = WebApplicationContextUtils.getWebApplicationContext(newSession.getServletContext()).getBean(SessionsInfo.class);
sessionsInfo.replaceSessionId(originalSessionId, newSession.getId());
}
}
XMl-конфигурация:
<context:component-scan base-package="ru.data"/>
<context:component-scan base-package="ru.web"/>
<security:user-service id="apiUserDetailsService">
<security:user name="user" password="root" authorities="ADMIN" />
</security:user-service>
<security:authentication-manager alias="authenticationManager">
<security:authentication-provider user-service-ref="apiUserDetailsService"/>
</security:authentication-manager>
<security:http entry-point-ref="basicAuthEntryPoint" pattern="/api/**" use-expressions="true">
<security:intercept-url pattern="/api/*.htm" access="hasAnyAuthority('ADMIN')" />
<security:custom-filter ref="basicAuthenticationFilter" after="BASIC_AUTH_FILTER" />
</security:http>
<bean id="basicAuthEntryPoint" class="org.springframework.security.web.authentication.www.BasicAuthenticationEntryPoint">
<property name="realmName" value="REST Realm" />
</bean>
<bean id="basicAuthenticationFilter" class="org.springframework.security.web.authentication.www.BasicAuthenticationFilter">
<property name="authenticationManager" ref="authenticationManager"/>
<property name="authenticationEntryPoint" ref="basicAuthEntryPoint" />
</bean>
<bean id="customExpressionHandler" class="ru.berkana.crm.security.CustomWebExpressionHandler">
</bean>
<bean id="customMethodExpressionHandler" class="ru.berkana.crm.security.CustomMethodExpressionHandler">
</bean>
<security:global-method-security pre-post-annotations="enabled">
<security:expression-handler ref="customMethodExpressionHandler"/>
</security:global-method-security>
<security:http use-expressions="true" create-session="always">
<security:intercept-url pattern="/**" access="isAuthenticatedIfRequired()"/>
<security:form-login login-page="/login" default-target-url="/index.htm" username-parameter="login" always-use-default-target="true"
password-parameter="password" authentication-failure-url="/login"/>
<security:logout invalidate-session="true" logout-success-url="/login" logout-url="/logout.htm"/>
<security:session-management session-authentication-strategy-ref="customAuthenticationStrategy"/>
</security:http>
<bean id="customAuthenticationStrategy" class="ru.security.CustomSessionAuthenticationStrategy">
<constructor-arg ref="sessionRegistry"/>
</bean>
<bean id="sessionRegistry"
class="org.springframework.security.core.session.SessionRegistryImpl" />
<bean id="customAuthProvider" class="ru.security.CustomAuthenticationProvider">
</bean>
Проблема в том, что эти две области конфликтуют друг с другом. После базовой аутентификации получаю ошибку. Только начинаю работать с spring, поэтому буду рада любым советам
http-apr-8080-exec-8 01/16/2021 10:18:25 ERROR [AnnotationMethodHandlerExceptionResolver] - Invoking request method resulted in exception : public java.lang.Object ru.CommonController.handleException(java.lang.Exception,javax.servlet.http.HttpServletRequest,javax.servlet.http.HttpServletResponse) throws java.io.IOException java.lang.ClassCastException: org.springframework.security.authentication.UsernamePasswordAuthenticationToken cannot be cast to ru.security.TRUsernamePasswordAuthenticationToken
Update: похоже, причина в этом методе:
public static TRUsernamePasswordAuthenticationToken getCurrentUserInfo(HttpServletRequest request) {
TRUsernamePasswordAuthenticationToken principal = ((TRUsernamePasswordAuthenticationToken) request.getUserPrincipal());
if (principal == null){
HttpSession session = request.getSession(true);
principal = (TRUsernamePasswordAuthenticationToken) session.getAttribute("currentAnonymous");
if (principal == null){
SettingsInfo settingsInfo = WebApplicationContextUtils.getRequiredWebApplicationContext(request.getSession().getServletContext()).getBean(SettingsInfo.class);
principal = new TRUsernamePasswordAuthenticationToken(settingsInfo.getCurrentOrganizationId(), settingsInfo.getCurrentLanguage());
principal.setOrganizations(settingsInfo.getOrganizations());
session.setAttribute("currentAnonymous", principal);
}
}
return principal;
}
Controller:
@RequestMapping(method = RequestMethod.POST, value = "/index.htm", params = "method=refreshTestsWithoutSubscriptionClients")
@ResponseBody
@ResponseStatus(HttpStatus.OK)
public Object refreshTestsWithoutSubscriptionClients(HttpServletRequest request, @RequestParam Map<String, Object> pageListParams) {
TRUsernamePasswordAuthenticationToken userInfo = Constants.getCurrentUserInfo(request);
return familyDao.findTestsWithoutSubscriptionClients(pageListParams, userInfo.getSelectedOrganizationId());
}
@RequestMapping(method = RequestMethod.POST, value = "/index.htm", params = "method=refreshNotPaidLessons")
@ResponseBody
@ResponseStatus(HttpStatus.OK)
public Object refreshNotPaidLessons(HttpServletRequest request, @RequestParam Map<String, Object> pageListParams) {
TRUsernamePasswordAuthenticationToken userInfo = Constants.getCurrentUserInfo(request);
return familyDao.findNotPaidLessons(pageListParams, userInfo.getSelectedOrganizationId());
}
Ошибку я получаю после того, как перехожу с API-url в обычные разделы программы. То есть она появляется, поскольку система запрашивает логин и права аутентификации для приложения, а получает информацию для API.