Spring认证与Security

Question

我的security-context中有以下配置

        <!-- web services-->
        <http use-expressions="true" pattern="/services/**"
            disable-url-rewriting="true" entry-point-ref="restAuthenticationEntryPoint">
            <intercept-url pattern="/services/**" access="isFullyAuthenticated()"
                requires-channel="https" />
            <form-login authentication-success-handler-ref="restSuccessHandler"
                authentication-failure-handler-ref="restAuthenticationFailureHandler" />
            <logout invalidate-session="true" delete-cookies="JSESSIONID" />
        </http>
        <!-- browser -->
        <http use-expressions="true"
            disable-url-rewriting="true">
            <intercept-url pattern="/signup*" access="permitAll"
                requires-channel="https" />
            <intercept-url pattern="/login*" access="permitAll"
                requires-channel="https" />
            <intercept-url pattern="/logout" access="permitAll"
                requires-channel="https" />
            <form-login authentication-success-handler-ref="myAuthenticationSuccessHandler"
                login-page="/login" authentication-failure-url="/loginFailed" />
            <intercept-url pattern="/**" access="isFullyAuthenticated()"
                requires-channel="https" />
            <session-management
                session-authentication-error-url="/loginFailed">
                <concurrency-control error-if-maximum-exceeded="true"
                    max-sessions="1" />
            </session-management>
            <logout invalidate-session="true" delete-cookies="JSESSIONID" />
        </http>

我的springSecurityFilterChain是

    <filter-mapping>
        <filter-name>springSecurityFilterChain</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

我无法使用

template.postForObject(targetURL + "services/j_spring_security_check", map,
                String.class);

每次我试一次都会给我一个错误

POST request for "https://localhost:8443/someapp/services/j_spring_security_check" resulted in 401 (Unauthorized);

如果我通过删除services来修改url，错误就会消失。但是我想区分rest登录(从移动登录)和普通登录(从浏览器)。对于rest登录，我想返回sessionID，而不是重定向到欢迎页面。我在这里做错了什么？

更新

我就是这样创建HTTP客户机的：

        System.setProperty("javax.net.ssl.trustStore", "d:/somekeystore");
        System.setProperty("javax.net.ssl.trustStorePassword", "1234");
        String targetURL = "https://localhost:8443/someapp/";
        // configure HTTPClient and RestTemplate
        HttpClient client = new HttpClient();
        CommonsClientHttpRequestFactory commons = new CommonsClientHttpRequestFactory(
                client);
        RestTemplate template = new RestTemplate(commons);
        MultiValueMap<String, String> map = new LinkedMultiValueMap<String, String>();
        map.add("j_username", "admin");
        map.add("j_password", "1234");
        map.add("rest", "true");
        template.postForObject(targetURL + "services/j_spring_security_check", map,
                String.class);

Answer 1

我修正了401 (Unauthorized)错误，在<form-login>中指定login-processing-url为

<form-login login-processing-url="/services/j_spring_security_check"
                authentication-success-handler-ref="restSuccessHandler"
                authentication-failure-handler-ref="restAuthenticationFailureHandler" />

Answer 2

我猜这是因为您有/services/**需要完全身份验证，但这也是您尝试提交登录的位置。

尝试使用permitAll添加登录页= "services/login“和”services/login“拦截-url，并将其用作登录名.ie：

<!-- web services-->
<http use-expressions="true" pattern="/services/**" disable-url-rewriting="true" entry-point-ref="restAuthenticationEntryPoint">
    <intercept-url pattern="/services/login*" access="permitAll" requires-channel="https" />
    <intercept-url pattern="/services/**" access="isFullyAuthenticated()" requires-channel="https" />
    <form-login login-page="/services/login" authentication-success-handler-ref="restSuccessHandler" authentication-failure-handler-ref="restAuthenticationFailureHandler" />
    <logout invalidate-session="true" delete-cookies="JSESSIONID" />
</http>