Digest auth avec Spring Security à l'aide de javaconfig

Question

Donc j'essaye de créer un ressort d'authentification digest suivant le documentation essayant de traduire les "conditions" du xml dans les conditions de Java.

Disons que nous avons le xml comme dans les docs:

<bean id="digestFilter" class= 
    "org.springframework.security.web.authentication.www.DigestAuthenticationFilter"> 
    <property name="userDetailsService" ref="jdbcDaoImpl"/> 
    <property name="authenticationEntryPoint" ref="digestEntryPoint"/> 
    <property name="userCache" ref="userCache"/> 
</bean> 

<bean id="digestEntryPoint" class= 
    "org.springframework.security.web.authentication.www.DigestAuthenticationEntryPoint"> 
    <property name="realmName" value="Contacts Realm via Digest Authentication"/> 
    <property name="key" value="acegi"/> 
    <property name="nonceValiditySeconds" value="10"/> 
</bean> 

Ceci est mon javaconfig actuelle:

@Configuration 
@Profile({"integration", "release"}) 
@EnableWebSecurity 
public class SecurityConfiguration extends WebSecurityConfigurerAdapter 
{ 

    @Resource(authenticationType = Resource.AuthenticationType.CONTAINER, mappedName = "jdbc/db") 
    private DataSource datasource; 

    @Override 
    protected void registerAuthentication (AuthenticationManagerBuilder auth) throws Exception 
    { 
    auth.jdbcAuthentication().dataSource(datasource) 
     .usersByUsernameQuery("SELECT ID_USER, PASSWORD, ACTIVE FROM USERS WHERE ID_USER = ?;") 
     .authoritiesByUsernameQuery("SELECT ID_USER, ID_ROLE FROM USER_ROLES WHERE ID_USER = ?"); 
    } 

    @Bean 
    public BasicAuthenticationEntryPoint entryPoint() 
    { 

    BasicAuthenticationEntryPoint basicAuthenticationEntryPoint = new BasicAuthenticationEntryPoint(); 
    basicAuthenticationEntryPoint.setRealmName("Basic WF Realm"); 
    return basicAuthenticationEntryPoint; 
    } 

    @Bean 
    public DigestAuthenticationEntryPoint digestEntryPoint() 
    { 
    DigestAuthenticationEntryPoint digestAuthenticationEntryPoint = new DigestAuthenticationEntryPoint(); 
    digestAuthenticationEntryPoint.setKey("mykey"); 
    digestAuthenticationEntryPoint.setRealmName("Digest WF Realm"); 
    return digestAuthenticationEntryPoint; 
    } 

    public DigestAuthenticationFilter digestAuthenticationFilter (
     DigestAuthenticationEntryPoint digestAuthenticationEntryPoint) 
    { 
    DigestAuthenticationFilter digestAuthenticationFilter = new DigestAuthenticationFilter(); 
    digestAuthenticationFilter.setAuthenticationEntryPoint(digestEntryPoint()); 
// digestAuthenticationFilter.setAuthenticationDetailsSource(authenticationDetailsSource); 
    return digestAuthenticationFilter; 
    } 

    @Override 
    protected void configure (HttpSecurity http) throws Exception 
    { 
     // basic auth - it works! 
     // http.exceptionHandling().authenticationEntryPoint(entryPoint()).and() 
    http    
    .authorizeUrls().antMatchers("/firstres/*").permitAll() 
     .antMatchers("/secondres/*").permitAll() 
     .antMatchers("/resources/*").permitAll() 
     .antMatchers("/**").hasAnyAuthority("first_role", "second_role").and()//.httpBasic(); 
    .addFilter(digestAuthenticationFilter(digestEntryPoint())); 
    } 

} 

Je viens d'obtenir un 403 - Accès refusé. Avec httpBasic fonctionnait. Pouvez-vous dire ce que je manque?

Answer 1

Je ne sais pas quand vous obtenez le 403 Accès refusé, mais si cela se produit lorsque vous demandez une ressource protégée avant d'avoir authentifié alors vous avez besoin ceci:

@Override 
protected void configure (HttpSecurity http) throws Exception 
{ 
    http 
     .exceptionHandling() 
      // this entry point handles when you request a protected page and 
      // you are not yet authenticated 
      .authenticationEntryPoint(digestEntryPoint()) 
      .and() 
     .authorizeUrls() 
      .antMatchers("/firstres/*").permitAll() 
      .antMatchers("/secondres/*").permitAll() 
      .antMatchers("/resources/*").permitAll() 
      .antMatchers("/**").hasAnyAuthority("first_role", "second_role").and() 
     // the entry point on digest filter is used for failed authentication attempts 
     .addFilter(digestAuthenticationFilter(digestEntryPoint())); 
} 

@Override 
@Bean 
public UserDetailsService userDetailsServiceBean() { 
    return super.userDetailsServiceBean(); 
} 

public DigestAuthenticationFilter digestAuthenticationFilter (
    DigestAuthenticationEntryPoint digestAuthenticationEntryPoint) 
{ 
    DigestAuthenticationFilter digestAuthenticationFilter = new DigestAuthenticationFilter(); 
    digestAuthenticationFilter.setAuthenticationEntryPoint(digestEntryPoint()); 
    digestAuthenticationFilter.setUserDetailsService(userDetailsServiceBean()); 
    return digestAuthenticationFilter; 
}