将Spring Security 3.x配置为具有多个入口点

Question

我一直在使用Spring Security 3.x来为我的项目处理用户身份验证，到目前为止，它已经完美地工作了。

我最近收到了一个新项目的要求。在此项目中，需要两套用户身份验证：一套用于根据LDAP验证员工，另一套用于根据数据库验证客户。我对如何在Spring Security中进行配置感到有些困惑。

我最初的想法是创建一个具有以下字段的登录屏幕：

单选按钮字段-供用户选择是员工还是客户。

j_username 用户字段。

j_password 密码字段。

如果用户选择“雇员”，那么我希望Spring Security根据LDAP对他们进行身份验证，否则，将根据数据库对凭据进行身份验证。但是，问题在于表单将被提交到，/j_spring_security_check并且我无法将单选按钮字段发送给实现的自定义身份验证提供程序。我最初的想法是，我可能需要两个表单提交URL，而不是依赖默认URL /j_spring_security_check。每个URL将由不同的身份验证提供程序处理，但是我不确定如何在Spring Security中进行配置。

我知道在Spring Security中，我可以配置回退身份验证，例如，如果LDAP身份验证失败，则它将回退至数据库身份验证，但这不是我在这个新项目中要解决的问题。

有人可以分享我在Spring Security 3.x中应该如何配置它吗？

谢谢。

Answer 1

好的，我设法使@Ritesh的方法非常接近我想要的工作。我有一个单选按钮，可让用户选择他们是客户还是员工。看来这种方法运作良好，有一个问题...如果员工使用正确的凭据登录，则可以在...中按预期工作。如果员工使用错误的凭据登录，则不允许他们在...中工作。如果客户使用正确的凭据登录，则可以在...中按预期工作。如果顾客有错凭据登录，认证回落到员工的认证...... 不起作用。这是有风险的，因为如果我选择客户身份验证并将其打入员工证书，它将也允许用户进入，这不是我想要的。&nbsp; &nbsp; <sec:http auto-config="false" entry-point-ref="loginUrlAuthenticationEntryPoint">&nbsp; &nbsp; &nbsp; &nbsp; <sec:logout logout-success-url="/login.jsp"/>&nbsp; &nbsp; &nbsp; &nbsp; <sec:intercept-url pattern="/employee/**" access="ROLE_EMPLOYEE"/>&nbsp; &nbsp; &nbsp; &nbsp; <sec:intercept-url pattern="/customer/**" access="ROLE_CUSTOMER"/>&nbsp; &nbsp; &nbsp; &nbsp; <sec:intercept-url pattern="/**" access="IS_AUTHENTICATED_ANONYMOUSLY"/>&nbsp; &nbsp; &nbsp; &nbsp; <sec:custom-filter position="FORM_LOGIN_FILTER" ref="myAuthenticationFilter"/>&nbsp; &nbsp; </sec:http>&nbsp; &nbsp; <bean id="myAuthenticationFilter" class="ss.MyAuthenticationFilter">&nbsp; &nbsp; &nbsp; &nbsp; <property name="authenticationManager" ref="authenticationManager"/>&nbsp; &nbsp; &nbsp; &nbsp; <property name="authenticationFailureHandler" ref="failureHandler"/>&nbsp; &nbsp; &nbsp; &nbsp; <property name="authenticationSuccessHandler" ref="successHandler"/>&nbsp; &nbsp; </bean>&nbsp; &nbsp; <bean id="loginUrlAuthenticationEntryPoint"&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint">&nbsp; &nbsp; &nbsp; &nbsp; <property name="loginFormUrl" value="/login.jsp"/>&nbsp; &nbsp; </bean>&nbsp; &nbsp; <bean id="successHandler"&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; class="org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler">&nbsp; &nbsp; &nbsp; &nbsp; <property name="defaultTargetUrl" value="/welcome.jsp"/>&nbsp; &nbsp; &nbsp; &nbsp; <property name="alwaysUseDefaultTargetUrl" value="true"/>&nbsp; &nbsp; </bean>&nbsp; &nbsp; <bean id="failureHandler"&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; class="org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler">&nbsp; &nbsp; &nbsp; &nbsp; <property name="defaultFailureUrl" value="/login.jsp?login_error=1"/>&nbsp; &nbsp; </bean>&nbsp; &nbsp; <bean id="employeeCustomAuthenticationProvider" class="ss.EmployeeCustomAuthenticationProvider">&nbsp; &nbsp; &nbsp; &nbsp; <property name="userDetailsService">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <bean class="ss.EmployeeUserDetailsService"/>&nbsp; &nbsp; &nbsp; &nbsp; </property>&nbsp; &nbsp; </bean>&nbsp; &nbsp; <bean id="customerCustomAuthenticationProvider" class="ss.CustomerCustomAuthenticationProvider">&nbsp; &nbsp; &nbsp; &nbsp; <property name="userDetailsService">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <bean class="ss.CustomerUserDetailsService"/>&nbsp; &nbsp; &nbsp; &nbsp; </property>&nbsp; &nbsp; </bean>&nbsp; &nbsp; <sec:authentication-manager alias="authenticationManager">&nbsp; &nbsp; &nbsp; &nbsp; <sec:authentication-provider ref="customerCustomAuthenticationProvider"/>&nbsp; &nbsp; &nbsp; &nbsp; <sec:authentication-provider ref="employeeCustomAuthenticationProvider"/>&nbsp; &nbsp; </sec:authentication-manager></beans>这是我更新的配置。我必须做一些非常小的调整，以防止身份验证回退，但我现在似乎无法弄清楚。谢谢。

Answer 2

好吧，我想我已经解决了这个问题。无需EmployeeCustomAuthenticationProvider依赖默认值UsernamePasswordAuthenticationToken，我EmployeeUsernamePasswordAuthenticationToken为它创建了它，就像为它创建CustomerUsernamePasswordAuthenticationToken的那样CustomerCustomAuthenticationProvider。这些提供者将覆盖supports()：-CustomerCustomAuthenticationProvider类@Overridepublic boolean supports(Class<? extends Object> authentication) {&nbsp; &nbsp; return (CustomerUsernamePasswordAuthenticationToken.class.isAssignableFrom(authentication));}EmployeeCustomAuthenticationProvider类@Overridepublic boolean supports(Class<? extends Object> authentication) {&nbsp; &nbsp; return (EmployeeUsernamePasswordAuthenticationToken.class.isAssignableFrom(authentication));}MyAuthenticationFilter类public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException {&nbsp; &nbsp; ...&nbsp; &nbsp; UsernamePasswordAuthenticationToken authRequest = null;&nbsp; &nbsp; if ("customer".equals(request.getParameter("radioAuthenticationType"))) {&nbsp; &nbsp; &nbsp; &nbsp; authRequest = new CustomerUsernamePasswordAuthenticationToken(username, password);&nbsp; &nbsp; }&nbsp; &nbsp; else {&nbsp; &nbsp; &nbsp; &nbsp; authRequest = new EmployeeUsernamePasswordAuthenticationToken(username, password);&nbsp; &nbsp; }&nbsp; &nbsp; setDetails(request, authRequest);&nbsp; &nbsp; return super.getAuthenticationManager().authenticate(authRequest);}...还有WALAA！经过几天的挫败，它现在可以正常工作！希望这篇文章能够对与我在这里做同样事情的人有所帮助。