Spring Security自定義身份驗證並記住我

Question

我使用本教程http://krams915.blogspot.de/2010/12/spring-security-mvc-integration-using_26.html來實現自定義身份驗證管理器。登錄和註銷工作正常。

現在我想用spring安全記住我的身份驗證。就我所知，我記得我需要一個userDetailService。所以我實現了一個自定義的userDetailService。在登錄頁面上，我添加一個名爲_spring_security_remember_me的複選框。但記住我不行。記住我的cookie不會在成功登錄後設置。我認爲這是一個配置問題，或者我必須實現一個自定義記住我使用自定義身份驗證？

<input type="checkbox" name="_spring_security_remember_me">stay signed in 

我的春天-security.xml文件：

<?xml version="1.0" encoding="UTF-8"?> 
<beans xmlns="http://www.springframework.org/schema/beans" 
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
    xmlns:security="http://www.springframework.org/schema/security" 
    xmlns:p="http://www.springframework.org/schema/p" 
    xmlns:jee="http://www.springframework.org/schema/jee" 
    xsi:schemaLocation="http://www.springframework.org/schema/beans 
      http://www.springframework.org/schema/beans/spring-beans-3.0.xsd 
      http://www.springframework.org/schema/security 
      http://www.springframework.org/schema/security/spring-security-3.0.xsd 
      http://www.springframework.org/schema/jee http://www.springframework.org/schema/jee/spring-jee-3.0.xsd"> 

    <security:http auto-config="false" use-expressions="true" access-denied-page="/login?error=true" 
      entry-point-ref="authenticationEntryPoint" > 

     <!-- Zugriff auf /login für alle erlauben --> 
     <security:intercept-url pattern="/login" access="permitAll"/> 
     <!-- resources --> 
     <security:intercept-url pattern="/resources/**" access="permitAll"/> 
     <!--<security:intercept-url pattern="/**" access="permitAll"/> --> 
     <security:intercept-url pattern="/**" access="hasRole('ROLE_USER')"/> 
     <!-- Zugriff auf /admin/** einschränken --> 
     <security:intercept-url pattern="/admin/**" access="hasRole('ROLE_ADMIN')"/> 


     <security:logout 
       invalidate-session="true" 
       logout-success-url="/login?logout=true" 
       logout-url="/j_spring_security_logout"/> 

     <security:custom-filter ref="blacklistFilter" before="FILTER_SECURITY_INTERCEPTOR"/> 
     <security:custom-filter ref="authenticationFilter" position="FORM_LOGIN_FILTER"/> 

     <!-- Session Timeout Seite setzen und 
      Session Fixation Attack Protection einschalten --> 
     <security:session-management invalid-session-url="/login?timeout=true" 
      session-fixation-protection="migrateSession"> 

      <!-- Maxmale Anzahl von Session per User (Doppelanmeldung) --> 
      <security:concurrency-control max-sessions="3" 
       error-if-maximum-exceeded="false" /> 
     </security:session-management> 
     <security:remember-me key="myAppKey" token-validity-seconds="864000" user-service-ref="customUserDetailService"/> 
    </security:http> 

    <!-- custom user service --> 
    <bean id="customUserDetailService" class="com.stefan.app.security.CustomUserDetailsService"> 
     <property name="userBean" ref="userBean" /> 
    </bean> 

    <!-- Custom filter to deny unwanted users even though registered --> 
    <bean id="blacklistFilter" class="com.stefan.app.security.filter.BlacklistFilter" /> 

    <!-- Custom filter for username and password. The real customization is done in the customAthenticationManager --> 
    <bean id="authenticationFilter" class="org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter" 
     p:authenticationManager-ref="customAuthenticationManager" 
     p:authenticationFailureHandler-ref="customAuthenticationFailureHandler" 
     p:authenticationSuccessHandler-ref="customAuthenticationSuccessHandler" /> 

    <!-- Custom authentication manager. In order to authenticate, username and password must not be the same --> 
    <bean id="customAuthenticationManager" class="com.stefan.app.security.CustomAuthenticationManager"> 
     <property name="userBean" ref="userBean" /> 
    </bean> 

    <jee:local-slsb id="userBean" jndi-name="java:global/com.stefan.auctionnsiper-ear/app.ejb/UserBean!com.stefan.app.user.UserBeanLocal" 
       business-interface="com.stefan.app.user.UserBeanLocal"/> 

    <!-- We just actually need to set the default failure url here --> 
    <bean id="customAuthenticationFailureHandler" class="org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler" 
     p:defaultFailureUrl="/login?error=true" /> 

    <!-- We just actually need to set the default target url here --> 
    <bean id="customAuthenticationSuccessHandler" class="org.springframework.security.web.authentication.SimpleUrlAuthenticationSuccessHandler" 
     p:defaultTargetUrl="/products" /> 

    <!-- The AuthenticationEntryPoint is responsible for redirecting the user to a particular page, like a login page, 
      whenever the server sends back a response requiring authentication --> 
    <!-- See Spring-Security Reference 5.4.1 for more info --> 
    <bean id="authenticationEntryPoint" class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint" 
     p:loginFormUrl="/login"/> 

    <!-- The tag below has no use but Spring Security needs it to autowire the parent property of 
      org.springframework.security.authentication.ProviderManager. Otherwise we get an error 
      A probable bug. This is still under investigation--> 
    <security:authentication-manager/> 
</beans> 

Answer 1

檢查：

• https://stackoverflow.com/questions/8815277/spring-security-tokenbasedremembermeservices-cookiename-ignored
• http://forum.springsource.org/showthread.php?130600-Spring-security-remember-me-cookie-configuration-example

---

試試這個：

<security:http> 
    ... 
    <security:remember-me services-ref="rememberMeServices" /> 
</security:http> 

<bean id="rememberMeServices" class="org.springframework.security.web.authentication.rememberme.TokenBasedRememberMeServices"> 
    <property name="userDetailsService" ref="customUserDetailService"/> 
    <property name="tokenValiditySeconds" value="864000"/> 
    <property name="cookieName" value="SPRING_RM"/> 
    <property name="key" value="myAppKey"/> 
</bean> 

Answer 2

再說什麼JOGO說，不要忘記設置你的 「authenticationFilter」 中的 「RememberMeServices的」 屬性，即：

<bean id="authenticationFilter" class="org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter" 
    p:authenticationManager-ref="customAuthenticationManager" 
    p:authenticationFailureHandler-ref="customAuthenticationFailureHandler" 
    p:authenticationSuccessHandler-ref="customAuthenticationSuccessHandler" 
    p:rememberMeServices-ref="rememberMeServices" /> 

另外你可能需要當用戶註銷時刪除記住我cookie，所以他不會自動登錄：

<security:logout 
    invalidate-session="true" 
    logout-success-url="/login?logout=true" 
    logout-url="/j_spring_security_logout" 
    delete-cookies="SPRING_RM"  
    /> 

我希望這可以幫助。