如何在公共页面上使用permitAll（）共享弹簧安全OAuth2

Question

我们使用OAuth [LDAP /社交登录]在Spring引导下开发了SSO应用程序。应用程序有一些公共页面和一些受保护的页面要求是我们希望基于经过验证的用户在公共页面上显示一些内容。一旦我们在一个应用程序中登录并访问其他应用程序的公共页面，则用户主体在公共页面上不可用，除非我们访问同一应用程序的受保护页面之一。任何建议/样本来实现这一点，在这里会有所帮助。以下是我的资源服务器代码。

public class SocialApplication extends WebSecurityConfigurerAdapter { 
@Autowired 
CustomLdapAuthoritiesPopulator ldapAuthoritiesPopulator; 

@Autowired 
CustomLogoutSuccessHandler customLogoutSuccessHandler; 

@RequestMapping({ "/user", "/me" }) 
public Map<String, String> user(Principal principal) { 
    Map<String, String> map = new LinkedHashMap<>(); 
    map.put("name", principal.getName()); 
    return map; 
} 

@Override 
public void configure(WebSecurity web) throws Exception { 
    web.ignoring().antMatchers("/page1Prv"); 
} 

@Override 
protected void configure(HttpSecurity http) throws Exception { 

    http.antMatcher("/**").authorizeRequests().antMatchers("/login", "/index**", "/webjars/**").permitAll() 
      .anyRequest().authenticated().and().authorizeRequests().anyRequest().fullyAuthenticated().and() 
      .formLogin().loginPage("/login").defaultSuccessUrl("/").and().logout() 
      .logoutSuccessHandler(customLogoutSuccessHandler).permitAll().and().csrf() 
      .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse()).and() 
      .addFilterBefore(ssoFilter(), BasicAuthenticationFilter.class); 
      //.userDetailsService(userDetailsService); 

    http.httpBasic().and().authorizeRequests().anyRequest().authenticated().and().csrf().disable(); 
} 

@Override 
protected void configure(AuthenticationManagerBuilder authenticationManagerBuilder) throws Exception { 
    authenticationManagerBuilder.ldapAuthentication() 
    .contextSource() 
      .url("ldap://localhost:10389/dc=example,dc=com").managerDn("uid=admin,ou=system") 
      .managerPassword("secret").and() 
      .ldapAuthoritiesPopulator(ldapAuthoritiesPopulator) 
      .userSearchBase("ou=users").userSearchFilter("(cn={0})"); 
} 


@Configuration 
@EnableResourceServer 
protected static class ResourceServerConfiguration extends ResourceServerConfigurerAdapter { 
    @Override 
    public void configure(HttpSecurity http) throws Exception { 
     http.antMatcher("/me").authorizeRequests().anyRequest().authenticated(); 
    } 
} 

public static void main(String[] args) { 
    SpringApplication.run(SocialApplication.class, args); 
} 

}

Answer 1

我返回从用户Principal对象（）。看下面的代码，它解决了我的问题。 @RequestMapping({ "/user", "/me" }) public Principal user(Principal principal) { return principal; }