스프링 보안 3 Active Directory 인증, 데이터베이스 인증

Question

AD 인증으로 내 애플리케이션에 액세스하고 내 DB에서 권한 부여 역할을 얻으려고합니다.

이

내가

<beans:constructor-arg> 
    <beans:bean class="org.springframework.security.ldap.populator.UserDetailsServiceLdapAuthoritiesPopulator"> 
     <beans:constructor-arg ref="myUserDetailsService"/> 
    </beans:bean> 
    </beans:constructor-arg> 

를 추가하는 시도했지만 작동하지 않았다 내 구성

<beans:bean id="activeDirectoryAuthenticationProvider" 
     class="org.springframework.security.ldap.authentication.ad.ActiveDirectoryLdapAuthenticationProvider"> 
    <beans:constructor-arg value="mydomain" /> 
    <beans:constructor-arg value="ldap://my URL :389" /> 
    <beans:property name="convertSubErrorCodesToExceptions" value="true"/> 
</beans:bean> 

입니다. 어떤 도움이 필요합니까?

많은 감사합니다.

Answer 1

ActiveDirectoryLdapAuthenticationProvider은 LdapAuthoritiesPopulator (생성자에 대한 API 확인)을 사용하지 않습니다.

당신은 당신이 공급자 포장 위임 모델을 사용하고이를 포함하는 새로운 토큰을 반환하기 전에, 별도로 당국을로드 할 수

public class MyAuthoritySupplementingProvider implements AuthenticationProvider { 
    private AuthenticationProvider delegate; 

    public MyAuthoritySupplementingProvider(AuthenticationProvider delegate) { 
     this.delegate = delegate; 
    } 

    public Authentication authenticate(Authentication authentication) { 
     final Authentication a = delegate.authenticate(authentication); 

     // Load additional authorities and create an Authentication object 
     final List<GrantedAuthority> authorities = loadRolesFromDatabaseHere(a.getName()); 

     return new AbstractAuthenticationToken(authorities) { 
      public Object getCredentials() { 
       throw new UnsupportedOperationException(); 
      } 

      public Object getPrincipal() { 
       return a.getPrincipal(); 
      } 
     }; 
    } 

    @Override 
    public boolean supports(Class<?> authentication) { 
     return delegate.supports(authentication); 
    } 
} 

클래스 인해 활성의 내 오히려 기본 지식 주로 최종 디렉토리 및 사람들이 그것을 사용하고자하는 다양한 방법.

Answer 2

필요. 첫 번째는 스프링 보안 xml 구성이고 두 번째 부분은 스프링 보안이 제공하는 UserContextMapper를 재정의합니다.

보안 XML 구성은

<bean id="adAuthenticationProvider" 
    class="org.springframework.security.ldap.authentication.ad.ActiveDirectoryLdapAuthenticationProvider"> 
    <constructor-arg value="my.domain.com" /> 
    <constructor-arg value="ldap://<adhostserver>:<port>/" /> 
    <property name="convertSubErrorCodesToExceptions" value="true" /> 
    <property name="userDetailsContextMapper" ref="myUserDetailsContextMapper" /> 
</bean> 

<bean id="myUserDetailsContextMapper" class="com.mycompany.sme.workflow.controller.MyDbAuthorizationFetcher"> 
<property name="dataSource" ref="dataSource" /> 

MyDbAuthorizationFetcher 당신이 DB

에서

public class MyDbAuthorizationFetcher implements UserDetailsContextMapper { 

private JdbcTemplate jdbcTemplate; 
@Autowired 
private DataSource dataSource; 

public JdbcTemplate getJdbcTemplate() { 
    return jdbcTemplate; 
} 

public void setJdbcTemplate(JdbcTemplate jdbcTemplate) { 
    this.jdbcTemplate = jdbcTemplate; 
} 

public DataSource getDataSource() { 
    return dataSource; 
} 

public void setDataSource(DataSource dataSource) { 
    this.dataSource = dataSource; 
} 

// populating roles assigned to the user from AUTHORITIES table in DB 
private List<SimpleGrantedAuthority> loadRolesFromDatabase(String username) { 

    DbRole role = new DbRole(); 
    String sql = "select * from user where user_id = ?"; 
    jdbcTemplate = new JdbcTemplate(getDataSource()); 
    role = jdbcTemplate.queryForObject(sql, new Object[] { username }, new DbRoleMapper()); 


    try { 
     dataSource.getConnection().setAutoCommit(true); 
    } catch (SQLException e) { 

    } 
    List<SimpleGrantedAuthority> authoritiess = new ArrayList<SimpleGrantedAuthority>(); 
    SimpleGrantedAuthority auth = new SimpleGrantedAuthority(String.valueOf(role.getRoleId())); 
    authoritiess.add(auth); 
    return authoritiess; 

    } 

@Override 
public UserDetails mapUserFromContext(DirContextOperations ctx, 
     String username, Collection<? extends GrantedAuthority> authorities) { 

    List<SimpleGrantedAuthority> allAuthorities = new ArrayList<SimpleGrantedAuthority>(); 
     for (GrantedAuthority auth : authorities) { 
     if (auth != null && !auth.getAuthority().isEmpty()) { 
      allAuthorities.add((SimpleGrantedAuthority) auth); 
     } 
     } 
     // add additional roles from the database table 
     allAuthorities.addAll(loadRolesFromDatabase(username)); 
     return new User(username, "", true, true, true, true, allAuthorities); 
} 

@Override 
public void mapUserToContext(UserDetails user, DirContextAdapter ctx) { 
    // TODO Auto-generated method stub 
} 

} 

Answer 3

2 개 부분으로 이것을 깰 수 있습니다 성공으로하지 않는 한, AbstractAuthenticationToken에 참으로 인증 된 플래그를 설정하는