spring - TAM Webseal + spring 预认证

Question

有没有人用 TAM Web-seal 做过 Spring 预认证？
你能分享一下配置细节吗？

Answer 1

如果 webseal 使用 iv-user 中的用户名转发请求header，那么配置spring-security就相对简单了:

<security:http auto-config="false" use-expressions="true" entry-point-ref="authenticationEntryPoint" access-decision-manager-ref="httpAccessDecisionManager">

    <security:custom-filter ref="webSealPreAuthFilter" position="PRE_AUTH_FILTER"/>
     ...
</security:http>


<bean id="webSealPreAuthFilter" class="org.springframework.security.web.authentication.preauth.RequestHeaderAuthenticationFilter">
    <property name="authenticationManager" ref="authenticationManager"/>
    <property name="principalRequestHeader" value="iv-user"/>

    <!-- exceptionIfHeaderMissing AND checkForPrincipalChanges needs to be enable to check that each request needs a "iv-user" header -->
    <property name="checkForPrincipalChanges" value="true"/>
    <property name="exceptionIfHeaderMissing" value="true"/>
</bean>


<alias name="authenticationManager" alias="org.springframework.security.authenticationManager"/>
<bean id="authenticationManager" class="org.springframework.security.authentication.ProviderManager">
    <property name="authenticationEventPublisher">
        <bean class="org.springframework.security.authentication.DefaultAuthenticationEventPublisher"/>
    </property>
    <constructor-arg name="providers">
        <list>
            <ref local="preAuthenticatedAuthenticationProvider"/>
        </list>
    </constructor-arg>
</bean>

<bean id="preAuthenticatedAuthenticationProvider"
        class="org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationProvider">
    <property name="preAuthenticatedUserDetailsService">
        <bean class="org.springframework.security.core.userdetails.UserDetailsByNameServiceWrapper">
            <constructor-arg name="userDetailsService" ref="userDetailsService"/>
        </bean>
    </property>
</bean>

<bean id="authenticationEntryPoint" class="org.springframework.security.web.authentication.Http403ForbiddenEntryPoint"/>

您需要一个 userDetailsService但这在很大程度上取决于您的应用程序的工作方式。