Azure的Spring Boot - 請求頭中的客戶端證書

我們目前在Spring Boot應用程序中實現了相互認證，需要在Azure中進行部署。 Azure的負載均衡器將請求標頭字段「X-ARR-ClientCert」中的客戶端證書（Base64編碼）重定向，Spring無法在其中找到它。 =>認證失敗Azure的Spring Boot - 請求頭中的客戶端證書

Microsoft文檔顯示瞭如何在.NET應用程序處理這個問題：https://docs.microsoft.com/en-gb/azure/app-service-web/app-service-web-configure-tls-mutual-auth

我試圖提取從報頭中的證書中的OncePerRequestFilter並將其設置爲這樣的要求：

public class AzureCertificateFilter extends OncePerRequestFilter { 
    private static final Logger LOG = LoggerFactory.getLogger(AzureCertifacteFilter.class); 
    private static final String AZURE_CLIENT_CERTIFICATE_HEADER = "X-ARR-ClientCert"; 
    private static final String JAVAX_SERVLET_REQUEST_X509_CERTIFICATE = "javax.servlet.request.X509Certificate"; 
    private static final String BEGIN_CERT = "-----BEGIN CERTIFICATE-----\n"; 
    private static final String END_CERT = "\n-----END CERTIFICATE-----"; 

    @Override 
    protected void doFilterInternal(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, FilterChain filterChain) throws ServletException, IOException { 
     X509Certificate x509Certificate = extractClientCertificate(httpServletRequest); 

     // azure redirects the certificate in a header field 
     if (x509Certificate == null && StringUtils.isNotBlank(httpServletRequest.getHeader(AZURE_CLIENT_CERTIFICATE_HEADER))) { 
      String x509CertHeader = BEGIN_CERT + httpServletRequest.getHeader(AZURE_CLIENT_CERTIFICATE_HEADER) + END_CERT; 

      try (ByteArrayInputStream certificateStream = new ByteArrayInputStream(x509CertHeader.getBytes())) { 
       X509Certificate certificate = (X509Certificate) CertificateFactory.getInstance("X.509").generateCertificate(certificateStream); 
       httpServletRequest.setAttribute(JAVAX_SERVLET_REQUEST_X509_CERTIFICATE, certificate); 
      } catch (CertificateException e) { 
       LOG.error("X.509 certificate could not be created out of the header field {}. Exception: {}", AZURE_CLIENT_CERTIFICATE_HEADER, e.getMessage()); 
      } 
     } 

     filterChain.doFilter(httpServletRequest, httpServletResponse); 
    } 

    private X509Certificate extractClientCertificate(HttpServletRequest request) { 
     X509Certificate[] certs = (X509Certificate[]) request.getAttribute(JAVAX_SERVLET_REQUEST_X509_CERTIFICATE); 

     if (certs != null && certs.length > 0) { 
      LOG.debug("X.509 client authentication certificate:" + certs[0]); 
      return certs[0]; 
     } 

     LOG.debug("No client certificate found in request."); 
     return null; 
    } 
}

但這後來失敗的彈簧過濾器鏈以下異常：

sun.security.x509.X509CertImpl cannot be cast to [Ljava.security.cert.X509Certificate; /oaa/v1/spaces

的配置是這樣的：

@Override 
public void configure(HttpSecurity http) throws Exception { 
    http.authorizeRequests() 
     .antMatchers("**/docs/restapi/**").permitAll() 
     .anyRequest().authenticated() 
     .and() 
     .httpBasic() 
     .disable() 
     .addFilterBefore(new AzureCertificateFilter(), X509AuthenticationFilter.class) 
     .x509() 
     .subjectPrincipalRegex("CN=(.*?)(?:,|$)") 
     .userDetailsService(userDetailsService()); 
}

來源

2017-08-02 Stefan Dupke

我應該讀異常更仔細：

sun.security.x509.X509CertImpl cannot be cast to [Ljava.security.cert.X509Certificate; /oaa/v1/spaces

我必須設置證書的一個這樣的數組：

httpServletRequest.setAttribute(JAVAX_SERVLET_REQUEST_X509_CERTIFICATE, new X509Certificate[]{x509Certificate});

來源

2017-08-03 12:53:35

Azure的Spring Boot - 請求頭中的客戶端證書

回答

相關問題