在 Spring security 中使用 LDAP 身份验证返回 cookie 或令牌

问题描述

全部：

我有一个用于 LDAP 身份验证的基本程序，它返回一个“主要用户”

package com.bpm.cbl.premium.controller;

import java.security.Principal;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.boot.autoconfigure.security.SecurityProperties;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.annotation.Order;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.ldap.authentication.ad.ActiveDirectoryLdapAuthenticationProvider;
import org.springframework.security.web.csrf.CookieCsrftokenRepository;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.ResponseBody;
import org.springframework.web.bind.annotation.RestController;
import javax.annotation.postconstruct;


@RestController
@RequestMapping("custom")

public class LDAPAuthController {
    
    public static String domain;
    public static String URL;
    
    @Value("${activedirectory.domain}")
    private  String adDomain;
    
    @Value("${activedirectory.url}")
    private String adURL;
    
    @postconstruct
    public void init(){
        domain = adDomain;
        URL = adURL;
    }

  @GetMapping("/user-login")
  @ResponseBody
  public Principal user(Principal user) {
     return user;
  }

 
  @Configuration
  @Order(SecurityProperties.BASIC_AUTH_ORDER)
  protected static class SecurityConfiguration extends WebSecurityConfigurerAdapter {
      
  
    @Override
    protected void configure(HttpSecurity http) throws Exception {
      http
        .httpBasic().and()
        .logout().and()
        .authorizeRequests()
        .antMatchers("/index.html","/","/home","/login","/assets/**").permitAll()
        .anyRequest().authenticated()
        .and()
        .csrf()
        .csrftokenRepository(CookieCsrftokenRepository.withHttpOnlyFalse());
    }

    @Bean
    public ActiveDirectoryLdapAuthenticationProvider activeDirectoryLdapAuthenticationProvider() {
        ActiveDirectoryLdapAuthenticationProvider activeDirectoryLdapAuthenticationProvider = new
        ActiveDirectoryLdapAuthenticationProvider(domain,URL);
      return activeDirectoryLdapAuthenticationProvider;
    }

}
}

我不知道如何返回 cookie 或令牌而不是对象.. 我是 Spring Security 的新手..有人可以帮忙吗 我参考了另一篇文章，但不确定它是否有效how to achieve Ldap Authentication using spring security(spring boot)

有人可以提供一些输入吗

解决方法

好的，我找到了解决方案；为所有人的利益发帖..

互联网和许多论坛上有很多令人困惑的文章，但很简单

将上面@GetMapping("/user-login") 下的函数替换为在响应体中返回 cookie 的函数.. 将 httpserveletresponse 作为函数的参数以及所需的任何其他参数传递.. 这就是 cookie将在响应头中返回；