Блог

Я пытаюсь перехватить и настроить исключение аутентификации, созданное в настраиваемом фильтре аутентификации, но как только генерируется исключение, оно всегда переходит к классу provider manager и отправляет ответ об ошибке spring API по умолчанию.

1. Класс конфигурации WebSecurity

 @Configuration

public static class RestAPISecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Autowired
    AuthenticationEntry authenticationEntryPoint;

    @Autowired
    BasicAuthenticationProvider customAuthProvider;

    @Autowired
    AuthenticationFailureHandler accessDeniedHandler;

    private final RequestMatcher PROTECTED_URLS = new OrRequestMatcher(
            new AntPathRequestMatcher(API_PATH_IDENTIFIER));

    @Value("${username}")
    private String userName;

    @Value("${password}")
    private String password;

    @Override
    public void configure(AuthenticationManagerBuilder auth) throws Exception {

        auth.authenticationProvider(customAuthProvider);
        auth.inMemoryAuthentication().withUser("abcd").password(passwordEncoder().encode("sample@123"))
                .roles("USER");
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.httpBasic().and().authorizeRequests().antMatchers("/api")
                .authenticated().and().exceptionHandling().authenticationEntryPoint(authenticationEntryPoint).and()
                .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
    
    @Override
    public void configure(WebSecurity web) {
        web.ignoring().antMatchers(SECURITY_EXCLUDED_PATHS);
    }

}
 

Класс AuthenticationProvider:

 
@Component
public class BasicAuthenticationProvider implements AuthenticationProvider {
    
    @Autowired
    @Qualifier("handlerExceptionResolver")
    private HandlerExceptionResolver resolver;
    
    @Override
    public Authentication authenticate(Authentication auth) throws UserAuthenticationException
      {
        String username = auth.getName();
        String password = auth.getCredentials()
            .toString();
        AuthenticationException exception = null;
        
        
        try {

        if ("abcd".equals(username) amp;amp; "Sample@123".equals(password)) {
            return new UsernamePasswordAuthenticationToken
              (username, password, Collections.emptyList());
        } else {
            
           throw new BadCredentialsException("invalid user");
           
        }
        
        
    }catch(AuthenticationException e)
        {
         exception = e;

         throw exception;
         
        }
      }

    @Override
    public boolean supports(Class<?> auth) {
        return auth.equals(UsernamePasswordAuthenticationToken.class);
    }

    
}
 

Класс AuthenticationEntryPoint:

 
/**
 *
 * Authentication entry point to handle security exceptions
 *
 */
@Component
public class AuthenticationEntry implements AuthenticationEntryPoint{
    
    @Autowired
    @Qualifier("handlerExceptionResolver")
    private HandlerExceptionResolver resolver;
    
    /**
     *This handles security exceptions and redirects it to exception handler
     */
    @Override
    public void commence(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, AuthenticationException e) throws UserAuthenticationException {
        httpServletResponse.setStatus(HttpStatus.UNAUTHORIZED.value());
        resolver.resolveException(httpServletRequest, httpServletResponse, null, new UserAuthenticationException("Not Authorized"));
    }

}
 

вы можете создать исключение в цепочке фильтров