無法創建AuthenticationManagerbean

我們正在嘗試使用令牌身份驗證用戶 @PreAuthorize。

當我們嘗試使用 @PreAuthorize 時，SpringSecurity 會在呼叫 API 之前彈出登錄頁面。我們不需要該頁面，因為我們有自己的身份驗證程序。

為了跳過該頁面，我們在主類中添加了 @SpringBootApplication( exclude = { SecurityAutoConfiguration.class, ManagementWebSecurityAutoConfiguration.class }) 。

在此之后，登錄頁面被跳過，但是當我們觸發它們時，我們所有的 API 都給出了 Authentication 需要在背景關系中存在的錯誤。

為此，我們做了以下更改

@Configuration
public class MethodSecurityConfig extends WebSecurityConfigurerAdapter {

@Bean
    @Override
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }

    @Override
    public void configure(HttpSecurity http) throws Exception {

        http.csrf().disable().addFilter(new AuthFilter(authenticationManagerBean())).authorizeRequests().anyRequest().permitAll();
        
    }
    
}

@Component
public class AuthFilter implements Filter {

    
    private AuthenticationManager authenticationManager;

    
    public AuthFilter(AuthenticationManager authenticationManager) {
        this.authenticationManager = authenticationManager;
    }

    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain filterchain)
            throws IOException, ServletException {

        final String authorizationHeader = ((HttpServletRequest) request).getHeader("Authorization");
        System.out.println("===========Filter called================");

        final Authentication authentication = authenticationManager
                .authenticate(SecurityContextHolder.getContext().getAuthentication());

        System.out.println("===========Authentication================" authentication);
        
        if (authentication != null && !(authentication instanceof AnonymousAuthenticationToken)
                && authentication.isAuthenticated()) {

            // set authentication in security context holder
            SecurityContextHolder.getContext().setAuthentication(authentication);

        }
        filterchain.doFilter(request, response);
    }
}

現在，當我收到 AuthenticationManager 沒有 bean 的錯誤時。

我嘗試了許多其他方法仍然沒有將bean注入過濾器

你能對此發表評論嗎？

uj5u.com熱心網友回復：

@Configuration
public class MethodSecurityConfig extends WebSecurityConfigurerAdapter {

@Bean
@Override
public AuthenticationManager authenticationManagerBean() throws Exception    {
    return super.authenticationManagerBean();
}

@Override
public void configure(HttpSecurity http) throws Exception {

    http.csrf().disable().addFilter(new AuthFilter(authenticationManagerBean())).authorizeRequests().anyRequest().permitAll();
    
    }

}

@Component
public class AuthFilter implements Filter {

@Autowired //--->use this
private AuthenticationManager authenticationManager;


public AuthFilter(AuthenticationManager authenticationManager) {
    this.authenticationManager = authenticationManager;
}

@Override
public void doFilter(ServletRequest request, ServletResponse response, FilterChain filterchain)
        throws IOException, ServletException {

    final String authorizationHeader = ((HttpServletRequest) request).getHeader("Authorization");
    System.out.println("===========Filter called================");

    final Authentication authentication = authenticationManager
            .authenticate(SecurityContextHolder.getContext().getAuthentication());

    System.out.println("===========Authentication================" authentication);
    
    if (authentication != null && !(authentication instanceof AnonymousAuthenticationToken)
            && authentication.isAuthenticated()) {

        // set authentication in security context holder
        SecurityContextHolder.getContext().setAuthentication(authentication);

    }
    filterchain.doFilter(request, response);
}

}

uj5u.com熱心網友回復：

嘗試這樣的事情可能會有所幫助：

@Bean(name = BeanIds.AUTHENTICATION_MANAGER)
   @Override
   public AuthenticationManager authenticationManagerBean() throws Exception {
       return super.authenticationManagerBean();
   }

您還可以參考如何在自定義過濾器中使用 Java 配置注入 AuthenticationManager

uj5u.com熱心網友回復：

一旦像這樣嘗試

@Configuration
public class MethodSecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
     AuthFilter authFilter;

    @Bean
    @Override
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }

    @Override
    public void configure(HttpSecurity http) throws Exception {

        http.csrf().disable().addFilter(authFilter).authorizeRequests().anyRequest().permitAll();//change is here
        
    }
    
}

@Component
public class AuthFilter implements Filter {

    
    private AuthenticationManager authenticationManager;

    
    public AuthFilter(AuthenticationManager authenticationManager) {
        this.authenticationManager = authenticationManager;
    }

    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain filterchain)
            throws IOException, ServletException {

        final String authorizationHeader = ((HttpServletRequest) request).getHeader("Authorization");
        System.out.println("===========Filter called================");

        final Authentication authentication = authenticationManager
                .authenticate(SecurityContextHolder.getContext().getAuthentication());

        System.out.println("===========Authentication================" authentication);
        
        if (authentication != null && !(authentication instanceof AnonymousAuthenticationToken)
                && authentication.isAuthenticated()) {

            // set authentication in security context holder
            SecurityContextHolder.getContext().setAuthentication(authentication);

        }
        filterchain.doFilter(request, response);
    }
}

而不是創建身份驗證過濾器的Java物件，而是使用spring bean AuthFilter

標籤：爪哇春天弹簧靴弹簧MVC弹簧安全

上一篇：在SpringBootWeb上作業時的自定義例外

下一篇：我究竟需要在SpringBoot中實作自己以允許基于表單的身份驗證（使用SpringSecurity和MVC）？