如何在Spring Security中定義多個<security：form-login>？

Question

我正在使用Spring Security來實現系統登錄功能。系統中有多個登錄頁面，如果登錄時出現錯誤，頁面將重定向到xxx？error = true。我已經配置了一個<security:form-login>成功如下的XML文件：

<!-- Default security config --> 
<security:http disable-url-rewriting="true"> 
    <security:anonymous username="anonymous" granted-authority="ROLE_ANONYMOUS" /> 

    <!-- session stealing is prevented by using secure GUID cookie --> 
    <security:session-management session-fixation-protection="none" /> 

    <security:intercept-url pattern="/login" requires-channel="https" /> 
    <security:intercept-url pattern="/login/**" requires-channel="https" /> 

    <security:form-login 
      login-page="/login" 
      authentication-failure-handler-ref="loginAuthenticationFailureHandler" 
      authentication-success-handler-ref="loginGuidAuthenticationSuccessHandler" 
      always-use-default-target="false" 
      default-target-url="/" /> 

    <security:logout logout-url="/logout" invalidate-session="true" success-handler-ref="logoutSuccessHandler"/> 

    <security:port-mappings> 
     <security:port-mapping http="#{configurationService.configuration.getProperty('tomcat.http.port')}" 
      https="#{configurationService.configuration.getProperty('tomcat.ssl.port')}" /> 
     <security:port-mapping http="80" https="443" /> 

    </security:port-mappings> 

    <security:request-cache ref="httpSessionRequestCache" /> 

</security:http> 

<bean id="loginAuthenticationFailureHandler" class="com.xxx.xxx.xxx.xxx.LoginAuthenticationFailureHandler"> 
    <property name="defaultFailureUrl" value="/login?error=true"/> 
</bean> 

但有一個名爲的Facebook登錄，如何定義的另一個<security:form-login/>意識到的另一登錄頁面，如果有在錯誤/ facebook-登錄，頁面將重定向到/facebook-login？error = true？ （我只希望通過我的XML代碼段配置XML文件的基礎來實現它，而不是通過註釋）

Answer 1

你應該追加在XML新<security:http>代碼，並使用pattern="/facebook-login/**"過濾你的登錄頁面。在標籤<security:form-login>登錄處理的URL不能同時「/ j_spring_security_check」，你可以使用「/ Facebook的登錄/ j_spring_security_check」。例如：

<!-- Security config for Facebook login - it has its own login page --> 
<security:http disable-url-rewriting="true" pattern="/facebook-login/**"> 
    <security:anonymous username="anonymous" granted-authority="ROLE_ANONYMOUS" /> 

    <!-- session stealing is prevented by using secure GUID cookie --> 
    <security:session-management session-fixation-protection="none" /> 

    <!-- SSL/AUTHENTICATED pages --> 
    <security:intercept-url pattern="/facebook-login*" requires-channel="https" /> 
    <security:intercept-url pattern="/facebook-login/**" requires-channel="https" /> 

    <security:form-login 
      login-page="/facebook-login" 
      login-processing-url="/facebook-login/j_spring_security_check" 
      authentication-failure-handler-ref="loginFacebookAuthenticationFailureHandler" 
      authentication-success-handler-ref="loginGuidAuthenticationSuccessHandler" 
      always-use-default-target="false" 
      default-target-url="/" /> 

    <security:logout logout-url="/logout" invalidate-session="true" success-handler-ref="logoutSuccessHandler"/> 

    <security:port-mappings> 
     <security:port-mapping http="#{configurationService.configuration.getProperty('tomcat.http.port')}" 
      https="#{configurationService.configuration.getProperty('tomcat.ssl.port')}" /> 
      <security:port-mapping http="80" https="443" /> 
    </security:port-mappings> 

    <security:request-cache ref="httpSessionRequestCache" /> 

</security:http> 

<bean id="loginFacebookAuthenticationFailureHandler" class="com.xxx.xxx.xxx.xxx.LoginAuthenticationFailureHandler"> 
    <property name="defaultFailureUrl" value="/facebook-link?error=true"/> 
</bean>