Rediriger pour modifier la page de passe pour les utilisateurs dont le mot de passe a expiré

Question

J'ai une application web avec sécurité de printemps. Maintenant j'essaye de forcer l'utilisateur à changer le mot de passe expiré.

Ma config de sécurité

@Configuration 
@EnableWebSecurity 
public class SecurityConfig extends WebSecurityConfigurerAdapter { 

    @Autowired 
    UserService service; 
    CustomAuthenticationHandler customAuthenticationHandler; 

    @Override 
    protected void configure(HttpSecurity http) throws Exception { 
     http 
     .authorizeRequests() 
      .antMatchers("/s/**").permitAll() 
      .antMatchers("/changePassword").permitAll() 
      .anyRequest().authenticated() 
      .and() 
     .formLogin() 
      .loginPage("/login") 
      .permitAll() 
      .failureHandler(customAuthenticationHandler) 
      .and() 
     .logout() 
      .logoutRequestMatcher(new AntPathRequestMatcher("/logout")) 
      .permitAll(); 
    } 

    @Override 
    protected void configure(AuthenticationManagerBuilder auth) 
      throws Exception { 
     auth 
     .authenticationProvider(authProvider()); 
    } 

    @Override 
    public void configure(WebSecurity web) throws Exception { 
     web.ignoring().antMatchers("/s/**"); 
    } 

    // Beans  

    @Bean 
    CustomAuthenticationHandler authenticationHandler() { 
     return new CustomAuthenticationHandler(); 
    } 

    @Bean 
    public PasswordEncoder encoder() { 
     return new BCryptPasswordEncoder(11); 
    } 

    @Bean 
    public DaoAuthenticationProvider authProvider() { 
     DaoAuthenticationProvider authProvider = new DaoAuthenticationProvider(); 
     authProvider.setUserDetailsService(new UserDetailServiceImpl(service)); 
     authProvider.setPasswordEncoder(encoder()); 
     return authProvider; 
    } 
} 

Mon CustomAuthenticationHandler:

public class CustomAuthenticationHandler extends SimpleUrlAuthenticationFailureHandler implements AuthenticationFailureHandler { 

    @Override 
    public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response, AuthenticationException exception) throws IOException, ServletException { 

     // later do some logic here.. to handle CredentialsExpiredException 
     // for now all failure login should go to /changePassword 
     getRedirectStrategy().sendRedirect(request, response, "/changePassword"); 

    } 
} 

Je pense aller à/changePassword après la connexion a échoué, mais je vais quand même/login erreur?. Pouvez-vous suggérer un exemple pour cette tâche avec java config ou expliquer ce que je fais de mal? Toute aide appréciée

Answer 1

Je ne sais pas comment bonne ou mauvaise cette solution, mais ça marche pour moi

Config Sécurité:

@Configuration 
@EnableWebSecurity 
public class SecurityConfig extends WebSecurityConfigurerAdapter { 

    @Autowired 
    UserService service; 
    CustomAuthenticationHandler customAuthenticationHandler; 

    @Override 
    protected void configure(HttpSecurity http) throws Exception { 
     http 
     .authorizeRequests() 
      .antMatchers("/s/**").permitAll() 
      .antMatchers("/changePassword").permitAll() 
      .anyRequest().authenticated() 
      .and() 
     .formLogin() 
      .loginPage("/login") 
      .permitAll() 
      .failureHandler(customAuthenticationHandler) 
      .and() 
     .logout() 
      .logoutRequestMatcher(new AntPathRequestMatcher("/logout")) 
      .permitAll(); 
    } 

    @Override 
    protected void configure(AuthenticationManagerBuilder auth) 
      throws Exception { 
     auth 
     .authenticationProvider(authProvider()); 
    } 

    @Override 
    public void configure(WebSecurity web) throws Exception { 
     web.ignoring().antMatchers("/s/**"); 
    } 

    // Beans  

    @Bean 
    CustomAuthenticationHandler authenticationHandler() { 
     return new CustomAuthenticationHandler(); 
    } 

    @Bean 
    public PasswordEncoder encoder() { 
     return new BCryptPasswordEncoder(11); 
    } 

    @Bean 
    public DaoAuthenticationProvider authProvider() { 
     DaoAuthenticationProvider authProvider = new DaoAuthenticationProvider(); 
     authProvider.setUserDetailsService(new UserDetailServiceImpl(service)); 
     authProvider.setPasswordEncoder(encoder()); 
     return authProvider; 
    } 
} 

Mon CustomAuthenticationHandler:

@Component 
public class CustomAuthenticationHandler extends SimpleUrlAuthenticationFailureHandler implements AuthenticationFailureHandler { 

    @Override 
    public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response, AuthenticationException exception) throws IOException, ServletException { 
     setUseForward(true); 
     saveException(request, exception); 
     if (exception.getClass().equals(CredentialsExpiredException.class)){ 
      setDefaultFailureUrl("/changePassword");     
     } else { 
      setDefaultFailureUrl("/login?error"); 
     } 
     super.onAuthenticationFailure(request, response, exception); 
    } 

}