Аутентификация JWT с загрузкой Spring, поскольку отдельный jar не перенаправляет на контроллер Rest в других приложениях весенней загрузки - PullRequest
0 голосов
/ 07 февраля 2020

Я реализовал аутентификацию токена Jwt в приложении весенней загрузки, которое работает нормально. Он будет перенаправлен на указанный c rest api. Когда я сделал Rest API в качестве отдельного jar-файла и пытался использовать JWt-аутентификацию jar в другом загрузочном приложении Spring, он не перенаправляет на остальные API-адреса в restcontroller после аутентификации. Вот код


@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)

public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

   @Autowired
   private JwtAuthenticationEntryPoint jwtAuthenticationEntryPoint;

   @Autowired
   private UserDetailsService jwtUserDetailsService;

   @Autowired
   private JwtRequestFilter jwtRequestFilter;

   @Value("${jwt.get.token.uri}")
   private String authenticationPath;

   @Autowired
   public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
       // configure AuthenticationManager so that it knows from where to load
       // user for matching credentials
       // Use BCryptPasswordEncoder
       auth.userDetailsService(jwtUserDetailsService).passwordEncoder(passwordEncoder());
   }

   @Bean
   public PasswordEncoder passwordEncoder() {
       return new BCryptPasswordEncoder();
   }

   @Bean
   @Override
   public AuthenticationManager authenticationManagerBean() throws Exception {
       return super.authenticationManagerBean();
   }

   @Override
   protected void configure(HttpSecurity httpSecurity) throws Exception {
       // We don't need CSRF for this example

       httpSecurity.csrf().disable()
               // dont authenticate this particular request
               .authorizeRequests().antMatchers("/authenticate").permitAll().
               // all other requests need to be authenticated
                       anyRequest().authenticated().and().
               // make sure we use stateless session; session won't be used to
               // store user's state.
                       exceptionHandling().authenticationEntryPoint(jwtAuthenticationEntryPoint).and().sessionManagement()
               .sessionCreationPolicy(SessionCreationPolicy.STATELESS);

       // Add a filter to validate the tokens with every request

       httpSecurity.addFilterBefore(jwtRequestFilter, UsernamePasswordAuthenticationFilter.class);


   }


}

   JwtRequestFilter.java


@Component
public class JwtRequestFilter extends OncePerRequestFilter {

    @Autowired
    private JwtUserDetailsService jwtUserDetailsService;

    @Autowired
    private JwtTokenUtil jwtTokenUtil;

  private static final Logger LOGGER = LoggerFactory.getLogger(JwtRequestFilter.class);


    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
            throws ServletException, IOException {

        final String requestTokenHeader = request.getHeader("Authorization");

        String username = null;
        String jwtToken = null;
        // JWT Token is in the form "Bearer token". Remove Bearer word and get only the Token
        if (requestTokenHeader != null && requestTokenHeader.startsWith("Bearer ")) {
            jwtToken = requestTokenHeader.substring(7);


            try {
                username = jwtTokenUtil.getUsernameFromToken(jwtToken);
      //  LOGGER.debug("UserEmailId extracted from token"+ username);

                } catch (IllegalArgumentException e) {
                System.out.println("Unable to get JWT Token");
            } catch (ExpiredJwtException | CertificateException e) {
                System.out.println("JWT Token has expired");
            } catch (JSONException e) {
                // TODO Auto-generated catch block
                e.printStackTrace();
            }
        } else {
            logger.warn("JWT Token does not begin with Bearer String");
        }


        //Once we get the token validate it.
        if (SecurityContextHolder.getContext().getAuthentication() == null) {

            UserDetails userDetails = this.jwtUserDetailsService.loadUserByUsername(username);




            // if token is valid configure Spring Security to manually set authentication
            try {
                if (jwtTokenUtil.validateToken(jwtToken,userDetails)) {

                    UsernamePasswordAuthenticationToken usernamePasswordAuthenticationToken = new UsernamePasswordAuthenticationToken(
                            userDetails, null,userDetails.getAuthorities());
                    usernamePasswordAuthenticationToken
                            .setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
                    // After setting the Authentication in the context, we specify
                    // that the current user is authenticated. So it passes the Spring Security Configurations successfully.
                    SecurityContextHolder.getContext().setAuthentication(usernamePasswordAuthenticationToken);


                //  SecurityContextHolder.getContext().setAuthentication(usernamePasswordAuthenticationToken);


                }
            } catch (CertificateException e) {
            LOGGER.error(e.getMessage());
            } catch (JSONException e) {
        LOGGER.error(e.getMessage());
            }
        }
        System.out.println("redirecturl"+request.getRequestURI());
        chain.doFilter(request, response);
    }

}


@Component
public class JwtAuthenticationEntryPoint implements AuthenticationEntryPoint, Serializable {

    private static final long serialVersionUID = -7858869558953243875L;

    @Override
    public void commence(HttpServletRequest request, HttpServletResponse response,
                         AuthenticationException authException) throws IOException {

        response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Unauthorized");
    }
}

@RestController
public class Empcontroller {



    @GetMapping(value= "/welcome")
    public ResponseEntity<String> welcome()
    {
        return new ResponseEntity<String>("Welcome User!", HttpStatus.OK);
    }
}

Любая помощь приветствуется.

Добро пожаловать на сайт PullRequest, где вы можете задавать вопросы и получать ответы от других членов сообщества.
...