spring-security - dove posso trovare l'elenco di TUTTI i filtri di sicurezza registrati quando utilizzo l'elemento <http>?

Question

Ci sono un set predefinito di filtri registrati quando utilizziamo l'elemento <http> nel nostro file xml. This menzioni l'ordinamento dei filtri (a seconda di quale si sceglie di applicare), e appena sopra che, si cita:

<bean id="filterChainProxy" class="org.springframework.security.web.FilterChainProxy"> 
    <constructor-arg> 
    <list> 
     <sec:filter-chain pattern="/restful/**" filters=" 
      securityContextPersistenceFilterWithASCFalse, 
      basicAuthenticationFilter, 
      exceptionTranslationFilter, 
      filterSecurityInterceptor" /> 
     <sec:filter-chain pattern="/**" filters=" 
      securityContextPersistenceFilterWithASCTrue, 
      formLoginFilter, 
      exceptionTranslationFilter, 
      filterSecurityInterceptor" /> 
    </list> 
    </constructor-arg> 
</bean> 

Se quanto sopra è la lista dei filtri predefiniti, poi durante il debug, ho scoperto che RequestCacheAwareFilter è anche chiamato . Da dove viene chiamato questo filtro e qual è la sua posizione nella catena di filtri? In quali condizioni è configurato AnonymousAuthenticationFilter nella catena?

Qual è la catena di filtri predefinita che è stata configurata per me?

Modifica: Ho applicationContext.xml e springSecurity.xml. Il seguente è il mio applicationContext.xml:

<?xml version="1.0" encoding="UTF-8"?> 
<beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
    xmlns:context="http://www.springframework.org/schema/context" xmlns:aop="http://www.springframework.org/schema/aop" 
    xsi:schemaLocation="http://www.springframework.org/schema/beans 
     http://www.springframework.org/schema/beans/spring-beans.xsd 
     http://www.springframework.org/schema/context 
     http://www.springframework.org/schema/context/spring-context.xsd 
     http://www.springframework.org/schema/aop 
     http://www.springframework.org/schema/aop/spring-aop.xsd"> 

    <context:annotation-config /> 
    <context:spring-configured /> 

    <!-- Make sure that the part of the file until "End of beans" is identical 
     to bean definitions in applicationContext.xml of the main application. --> 

    <bean id="adminService" class="org.daud.admin.server.AdminServiceImpl" /> 
    <bean id="feedbackService" class="org.daud.feedback.server.FeedbackServiceImpl" /> 
    <bean id="guideService" class="org.daud.guider.server.GuiderServiceImpl" /> 
    <bean id="messageService" class="org.daud.messages.server.MessageServiceImpl" /> 
    <bean id="wsService" class="org.daud.guider.server.WSServiceImpl" /> 

    <bean id="jabxUtil" class="org.daud.common.server.services.JAXBUtil" /> 
    <bean id="serviceAdvisor" class="org.daud.common.server.ServiceAdvisor" /> 

    <bean id="userPreferences" class="org.daud.preferences.server.UserPreferencesServiceImpl" /> 

    <bean id="dynamicClientFactory" class="org.apache.cxf.jaxws.endpoint.dynamic.JaxWsDynamicClientFactory" factory-method="newInstance" /> 

    <!-- End of beans. --> 

    <!-- For testing. --> 

    <bean id="guiderClientService" class="org.daud.guider.server.GuiderClientServiceImpl" /> 

    <bean id="entityManager" class="com.daud.jpa.DBUtil" factory-method="createEntityManager" lazy-init="true"> 
     <constructor-arg value="bb-test" /> 
    </bean> 

    <bean id="testUtil" class="com.daud.jpa.JPATestUtil" lazy-init="true"> 
     <constructor-arg ref="entityManager" /> 
     <constructor-arg value="org.daud" /> 
     <constructor-arg value="fixtures" /> 
    </bean> 

</beans> 

E questo è il mio springSecurity.xml

<beans:beans xmlns="http://www.springframework.org/schema/security" 
    xmlns:beans="http://www.springframework.org/schema/beans" 
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
    xmlns:p="http://www.springframework.org/schema/p" 
    xmlns:aop="http://www.springframework.org/schema/aop" 
    xsi:schemaLocation="http://www.springframework.org/schema/beans 
     http://www.springframework.org/schema/beans/spring-beans.xsd 
     http://www.springframework.org/schema/security 
     http://www.springframework.org/schema/security/spring-security.xsd 
     http://www.springframework.org/schema/aop 
     http://www.springframework.org/schema/aop/spring-aop.xsd"> 

    <aop:aspectj-autoproxy proxy-target-class="true" /> 
    <beans:bean class="com.gwt.ss.GwtExceptionTranslator" /> 

    <global-method-security secured-annotations="enabled" access-decision-manager-ref="methodSecurityAccessDecisionManager"/> 
    <http use-expressions="true" auto-config="false" disable-url-rewriting="true" access-decision-manager-ref="urlSecurityAccessDecisionManager"> 
     <intercept-url pattern="/favicon.ico" filters="none" /> 
     <intercept-url pattern="/login.jsp" filters="none" /> 

     <!-- Allow access only to admins and superadmins for the following 2 url patterns --> 
     <intercept-url pattern="/do/admin/*" access="hasAdminStatus(3,4)" /> 
     <intercept-url pattern="/admin/*" access="hasAdminStatus(3,4)" /> 

     <intercept-url pattern="/**/*.html" access="isAuthenticated()" /> <!-- access="isAuthenticated()"--> 
     <intercept-url pattern="/do/**" access="isAuthenticated()" /> 
     <intercept-url pattern="/**" access="isAuthenticated()" /> 
     <custom-filter after="FILTER_SECURITY_INTERCEPTOR" ref="switchUserProcessingFilter"/> 

     <form-login login-page="/login" login-processing-url="/do/login" authentication-failure-url="/login?authfailed=true" authentication-success-handler-ref="myAuthenticationSuccessHandler"/> 

     <!-- Using success-handler-ref instead of logout-success-url for asynchronous logout. --> 
     <logout invalidate-session="true" success-handler-ref="logoutSuccessHandler" logout-url="/do/logout" /> 
    </http> 

    <beans:bean id="urlSecurityAccessDecisionManager" class="org.springframework.security.access.vote.AffirmativeBased"> 
     <beans:property name="decisionVoters"> 
      <beans:list> 
       <beans:bean class="org.springframework.security.web.access.expression.WebExpressionVoter"> 
        <beans:property name="expressionHandler" ref="myWebSecurityExpressionHandler"/> 
       </beans:bean> 
      </beans:list> 
     </beans:property> 
    </beans:bean> 
    <beans:bean id="myWebSecurityExpressionHandler" class="org.daud.common.server.security.MyWebSecurityExpressionHandler"/> 
    <beans:bean id="myWebSecurityExpressionRoot" class="org.daud.common.server.security.MyWebSecurityExpressionRoot" scope="prototype"/> 
    <!-- For asynchronous login --> 

    <beans:bean id="methodSecurityAccessDecisionManager" 
     class="org.springframework.security.access.vote.AffirmativeBased"> 
     <beans:property name="decisionVoters"> 
      <beans:list> 
       <beans:bean class="org.springframework.security.access.vote.RoleVoter" p:rolePrefix="" /> 
       <beans:bean class="org.springframework.security.access.vote.AuthenticatedVoter" /> 
       <beans:bean class="org.daud.common.server.security.AllowPrivilegedRolesVoter"> 
        <beans:property name="privilegedRoleTypes"> 
         <beans:set> 
          <beans:value>ROOT</beans:value> 
         </beans:set> 
        </beans:property> 
       </beans:bean> 
      </beans:list> 
     </beans:property> 
    </beans:bean> 

    <beans:bean class="com.gwt.ss.GwtUsernamePasswordAuthority"> 
     <beans:property name="authenticationManager" ref="authenticationManager" /> 
    </beans:bean> 
    <beans:bean id="myAuthenticationSuccessHandler" class="org.daud.common.server.security.myAuthenticationSuccessHandler"> 
     <!-- If redirection after logging in is to URLs containing these strings, the redirection will instead be to '/' --> 
     <beans:property name="partialURLsRequiringRedirection"> 
      <beans:list> 
       <beans:value>/do/</beans:value> 
       <beans:value>/exitUser</beans:value> 
      </beans:list> 
     </beans:property> 
    </beans:bean> 
    <beans:bean id="userSwitchSuccessHandler" class="org.daud.common.server.security.myUserSwitchSuccessHandler"/> 
    <beans:bean id="userServices" class="org.daud.common.server.security.myUserServices"/> 

    <beans:bean id="switchUserProcessingFilter" class="org.springframework.security.web.authentication.switchuser.SwitchUserFilter"> 
     <beans:property name="userDetailsService" ref="userServices" /> 
     <beans:property name="switchUserUrl" value="/admin/switchUser" /> 
     <beans:property name="exitUserUrl" value="/admin/exitUser" /> 
     <beans:property name="successHandler" ref="userSwitchSuccessHandler"></beans:property> 
    </beans:bean> 

    <!-- For asynchronous logout --> 

    <beans:bean id="logoutSuccessHandler" class="com.gwt.ss.GwtLogoutSuccessHandler" p:logoutSuccessUrl="/login" /> 

    <beans:bean id="myAuthenticationProvider" class="org.daud.common.server.security.myAuthenticationProvider" /> 
    <authentication-manager alias="authenticationManager"> 
     <authentication-provider ref="myAuthenticationProvider" /> 
    </authentication-manager> 

</beans:beans> 

Answer 1

Se si attiva la registrazione di debug per org.springframework.security.web.FilterChainProxy vedrete, per ogni richiesta, ogni filtro che passa attraverso.

Ad esempio (Sto utilizzando anche Spring Security OAuth).

11:18:39.123 FilterChainProxy - /user/login at position 1 of 17 in additional filter chain; firing Filter: 'BasicUserApprovalFilter' 
11:18:39.123 FilterChainProxy - /user/login at position 2 of 17 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter' 
11:18:39.124 FilterChainProxy - /user/login at position 3 of 17 in additional filter chain; firing Filter: 'LogoutFilter' 
11:18:39.124 FilterChainProxy - /user/login at position 4 of 17 in additional filter chain; firing Filter: 'UsernamePasswordAuthenticationFilter' 
11:18:39.124 FilterChainProxy - /user/login at position 5 of 17 in additional filter chain; firing Filter: 'BasicAuthenticationFilter' 
11:18:39.124 FilterChainProxy - /user/login at position 6 of 17 in additional filter chain; firing Filter: 'RequestCacheAwareFilter' 
11:18:39.124 FilterChainProxy - /user/login at position 7 of 17 in additional filter chain; firing Filter: 'SecurityContextHolderAwareRequestFilter' 
11:18:39.124 FilterChainProxy - /user/login at position 8 of 17 in additional filter chain; firing Filter: 'RememberMeAuthenticationFilter' 
11:18:39.125 FilterChainProxy - /user/login at position 9 of 17 in additional filter chain; firing Filter: 'ForgotPasswordAuthenticationFilter' 
11:18:39.125 FilterChainProxy - /user/login at position 10 of 17 in additional filter chain; firing Filter: 'AnonymousAuthenticationFilter' 
11:18:39.125 FilterChainProxy - /user/login at position 11 of 17 in additional filter chain; firing Filter: 'SessionManagementFilter' 
11:18:39.125 FilterChainProxy - /user/login at position 12 of 17 in additional filter chain; firing Filter: 'ExceptionTranslationFilter' 
11:18:39.125 FilterChainProxy - /user/login at position 13 of 17 in additional filter chain; firing Filter: 'OAuth2ExceptionHandlerFilter' 
11:18:39.125 FilterChainProxy - /user/login at position 14 of 17 in additional filter chain; firing Filter: 'VerificationCodeFilter' 
11:18:39.125 FilterChainProxy - /user/login at position 15 of 17 in additional filter chain; firing Filter: 'OAuth2AuthorizationFilter' 
11:18:39.125 FilterChainProxy - /user/login at position 16 of 17 in additional filter chain; firing Filter: 'OAuth2ProtectedResourceFilter' 
11:18:39.125 FilterChainProxy - /user/login at position 17 of 17 in additional filter chain; firing Filter: 'FilterSecurityInterceptor' 

Se si desidera ottenere i filtri a livello di codice è possibile iniettare il FilterChainProxy e ottenere i valori s' il filterChainMap.

Ad esempio:

@Autowired var filterChainProxy: FilterChainProxy = _ 
//... 
val filterChains = filterChainProxy.getFilterChainMap.values 

Se solo desidera visualizzare i filtri che <http> aggiunge allora si dovrebbe guardare alla fonte per HttpSecurityBeanDefinitionParser.

Answer 2

lista quasi completa di filtro tipi di primavera di sicurezzais here, anche se ad avere tutto è possibile visualizzare tutti Le sottoclassi di GenericFilterBean in SEC e leggi chapters 8-13 of Spring Security reference manual perché, ad esempio, è possibile scegliere una delle poche implementazioni AbstractPreAuthenticatedProcessingFilter (e aggiungerne l'estensione estendendo i filtri esistenti o GenericFilterBean).

Esempio avete qui utilizza la configurazione di fagioli di FilterChainProxy via filter-chain elemento e non è una catena di default - è necessario definire in modo esplicito le proprie catene, al fine di applicare filtri alle richieste.

---

D'altra parte si stanno chiedendo circa <http> elemento: ha auto-config attribute che esegue le seguenti operazioni:

<http> 
    <form-login /> 
    <http-basic /> 
    <logout /> 
    </http> 

che è creazione di form-login, l'autenticazione di base e il logout servizi di assistenza, rispettivamente .

---

RequestCacheAwareFilter è chiamato perché è probabilmente presente nella catena dei filtri della domanda - la vostra context.xml sarebbe utile qui.

AnonymousAuthenticationFilter (e qualsiasi altro filtro) viene aggiunto a catena se si aggiunge il fagiolo via <sec:filter-chain> elemento e configurare fagioli con dato id (di solito è il nome della classe che inizia con la lettera in minuscolo cioè anonymousAuthenticationFilter). Per esempio:

<bean id="filterChainProxy" class="org.springframework.security.web.FilterChainProxy"> 
    <constructor-arg> 
    <list> 
     <sec:filter-chain pattern="/anonym/**" filters=" 
      anonymousAuthenticationFilter" /> 
     <sec:filter-chain pattern="/**" filters="none" /> 
    </list> 
    </constructor-arg> 
</bean> 

<bean id="anonymousAuthenticationFilter" 
    class="org.springframework.security.web.authentication.AnonymousAuthenticationFilter"> 
    <property name="key" value="foobar"/> 
    <property name="userAttribute" value="anonymousUser,ROLE_ANONYMOUS"/> 
</bean> 

<bean id="authenticationManager" 
    class="org.springframework.security.authentication.ProviderManager"> 
    <property name="providers"> 
    <list> 
     <ref local="anonymousAuthenticationProvider"/> 
    </list> 
    </property> 
</bean> 

<bean id="anonymousAuthenticationProvider" 
    class="org.springframework.security.authentication.AnonymousAuthenticationProvider"> 
    <property name="key" value="foobar"/> 
</bean> 

Answer 3

Un'altra cosa si può fare in primavera Security 3.1 è aggiungere

<sec:debug /> 

o

@EnableWebSecurity(debug = true)

al contesto di applicazione. Questo aggiunge un filtro aggiuntivo che (tra le altre cose) riporta l'elenco dei filtri di sicurezza che verranno applicati a ciascuna richiesta.