春季证券授予当局总是空着回来

Question

我试图在Spring4.0.6应用程序中使用SpringSecurity3.2.4从Active收集用户权限。

一些细节：

• 身份验证有效。我可以得到当前的用户名。
• 预认证由JBoss 7.2使用JCIFS (NTLM)完成.
• LDAP服务器正常工作，所以主机和端口都是正确的。
• 域是正确的。

SecurityConfig.java

@Configuration
@EnableWebMvcSecurity
@PropertySource( "classpath:/resources/ldap-config.properties" )
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Value( "${domain}" )
    private String strDomain;

    @Value( "${ldap.host}" )
    private String strHost;

    @Value( "${ldap.basedn}" )
    private String strBaseDn;

    @Value( "${ldap.userdn}" )
    private String strUserDn;

    @Value( "${ldap.userdn.password}" )
    private String strUserDnPassword;

    @Bean
    public static PropertySourcesPlaceholderConfigurer propertySourcesPlaceholderConfigurer() {
        return new PropertySourcesPlaceholderConfigurer();
    }

    @Bean 
    public ActiveDirectoryGrantedAuthoritiesMapper grantedAuthoritiesMapper() {
        return new ActiveDirectoryGrantedAuthoritiesMapper();
    }

    @Bean
    public ActiveDirectoryLdapAuthenticationProvider activeDirectoryLdapAuthenticationProvider() {

        ActiveDirectoryLdapAuthenticationProvider activeDirectoryLdapAuthenticationProvider = new ActiveDirectoryLdapAuthenticationProvider(strDomain, strHost);
        activeDirectoryLdapAuthenticationProvider.setUseAuthenticationRequestCredentials(true);
        activeDirectoryLdapAuthenticationProvider.setConvertSubErrorCodesToExceptions(true);

        activeDirectoryLdapAuthenticationProvider.setAuthoritiesMapper(this.grantedAuthoritiesMapper());

        return activeDirectoryLdapAuthenticationProvider;
    }

    @Override
    public void configure(AuthenticationManagerBuilder authenticationManagerBuilder) throws Exception {

        authenticationManagerBuilder
        .authenticationProvider(this.activeDirectoryLdapAuthenticationProvider());
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {

        http
            .authorizeRequests()
                .anyRequest().authenticated()
            .and()
            .jee();
    }
}

ActiveDirectoryGrantedAuthoritiesMapper.java

public class ActiveDirectoryGrantedAuthoritiesMapper implements GrantedAuthoritiesMapper {

    // Constants for group defined in LDAP
    private final String ROLE_ADMIN = "A_SPECIFIC_ADMIN_GROUP_IN_AD";
    private final String ROLE_USER = "A_SPECIFIC_GROUP_IN_AD";

    public ActiveDirectoryGrantedAuthoritiesMapper() {
    }

    @Override
    public Collection<? extends GrantedAuthority> mapAuthorities(final Collection<? extends GrantedAuthority> authorities) {

        Set<SecurityContextAuthority> roles = EnumSet.noneOf(SecurityContextAuthority.class);

        for (GrantedAuthority authority : authorities) {

            System.out.println("GrantedAuthority : " + authority.getAuthority());

            if (ROLE_ADMIN.equals(authority.getAuthority())) {
                roles.add(SecurityContextAuthority.ROLE_ADMIN);
            }

            if (ROLE_USER.equals(authority.getAuthority())) {
                roles.add(SecurityContextAuthority.ROLE_USER);
            }
        }

        return roles;
    }

}

SecurityContextAuthority.java

public enum SecurityContextAuthority implements GrantedAuthority {

    ROLE_ADMIN, ROLE_USER;

    @Override
    public String getAuthority() {
        return name();
    }
}

我在我的控制台里得到的：

2014-10-14 14:04:02,557 INFO  [stdout] (http-localhost/127.0.0.1:8080-2) MY_DOMAIN\MY_USERNAME
2014-10-14 14:04:02,557 INFO  [stdout] (http-localhost/127.0.0.1:8080-2) Authorities: []
2014-10-14 14:04:02,557 INFO  [stdout] (http-localhost/127.0.0.1:8080-2) Auth Type: NTLM
2014-10-14 14:04:02,557 INFO  [stdout] (http-localhost/127.0.0.1:8080-2) Is Authenticated: true

在打开调试之后，我获得了以下额外的详细信息：

2014-10-16 11:10:50,959 DEBUG [org.springframework.security.web.authentication.preauth.j2ee.J2eePreAuthenticatedProcessingFilter] (http-localhost/127.0.0.1:8080-1) Checking secure context token: null
2014-10-16 11:10:50,959 DEBUG [org.springframework.security.web.authentication.preauth.j2ee.J2eePreAuthenticatedProcessingFilter] (http-localhost/127.0.0.1:8080-1) PreAuthenticated J2EE principal: MY_DOMAIN\MY_USERNAME
2014-10-16 11:10:50,959 DEBUG [org.springframework.security.web.authentication.preauth.j2ee.J2eePreAuthenticatedProcessingFilter] (http-localhost/127.0.0.1:8080-1) preAuthenticatedPrincipal = MY_DOMAIN\MY_USERNAME, trying to authenticate
2014-10-16 11:10:50,959 DEBUG [org.springframework.security.web.authentication.preauth.j2ee.J2eeBasedPreAuthenticatedWebAuthenticationDetailsSource] (http-localhost/127.0.0.1:8080-1) J2EE roles [[]] mapped to Granted Authorities: [[]]
2014-10-16 11:10:50,960 DEBUG [org.springframework.security.authentication.ProviderManager] (http-localhost/127.0.0.1:8080-1) Authentication attempt using org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationProvider
2014-10-16 11:10:50,960 DEBUG [org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationProvider] (http-localhost/127.0.0.1:8080-1) PreAuthenticated authentication request: org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationToken@f99efc97: Principal: MY_DOMAIN\MY_USERNAME; Credentials: [PROTECTED]; Authenticated: false; Details: org.springframework.security.web.authentication.preauth.PreAuthenticatedGrantedAuthoritiesWebAuthenticationDetails@380f4: RemoteIpAddress: 127.0.0.1; SessionId: FaMwocWCdZawHD1GvwUcNg8S; []; Not granted any authorities
2014-10-16 11:10:50,960 DEBUG [org.springframework.security.web.authentication.preauth.j2ee.J2eePreAuthenticatedProcessingFilter] (http-localhost/127.0.0.1:8080-1) Authentication success: org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationToken@661034c: Principal: org.springframework.security.core.userdetails.User@f99c56bc: Username: MY_DOMAIN\MY_USERNAME; Password: [PROTECTED]; Enabled: true; AccountNonExpired: true; credentialsNonExpired: true; AccountNonLocked: true; Not granted any authorities; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.preauth.PreAuthenticatedGrantedAuthoritiesWebAuthenticationDetails@380f4: RemoteIpAddress: 127.0.0.1; SessionId: FaMwocWCdZawHD1GvwUcNg8S; []; Not granted any authorities

其他调试信息：

• 当局总是空荡荡的
• mapAuthorities和getAuthority似乎从未被调用过。添加断点根本不起任何作用。

任何帮助都将不胜感激。

Answer 1

我不知道你是否解决了你的问题。然而，你的描述帮助我解决了我的问题。我几乎基于您的代码实现了权限映射器，它运行得很好。我看到唯一可能导致空权限字段的是，当调用映射器时字段是空的，或者参数映射中定义为ROLE_USER和ROLE_ADMIN的AD角色中没有权限。