弹簧安全jsf在成功登录后不会重定向

我已经看到类似这样的问题，但我还没有看到针对特定问题的答案。弹簧安全jsf在成功登录后不会重定向

我正在使用spring security 2.1和jsf 2.1。我有一个自定义的jsf登录控制器，我开发它来处理来自xhtml文件的登录。

这里是登录方法：

public String login() throws ServletException, IOException { 

    ExternalContext context = FacesContext.getCurrentInstance() 
      .getExternalContext(); 

    RequestDispatcher dispatcher = ((ServletRequest) context.getRequest()) 
      .getRequestDispatcher("/j_spring_security_check"); 

    dispatcher.forward((ServletRequest) context.getRequest(), 
      (ServletResponse) context.getResponse()); 

    FacesContext.getCurrentInstance().responseComplete(); 

    Exception e = (Exception) FacesContext.getCurrentInstance(). 
       getExternalContext().getSessionMap().get(WebAttributes.AUTHENTICATION_EXCEPTION); 




    // It's OK to return null here because Faces is just going to exit. 
    return null; 

}

我把示例代码从另一个交。

这里是我的Spring配置：

<http use-expressions="true" auto-config="true"> 
    <!-- <intercept-url pattern="/signin.xhtml" access="permitAll" /> --> 

    <intercept-url pattern="/internal/private/**" access="hasRole('USER')" /> 
    <!-- <intercept-url pattern="/scheduling/internal/private/**" access="hasAnyRole('ADMIN','USER')" 
     /> --> 
    <!--<intercept-url pattern="/javax.faces.resource/**" access="permitAll"/> 
     <intercept-url pattern="/**" access="permitAll" /> --> 

    <form-login default-target-url="/internal/private/landing.xhtml" 
     login-page="/signin.xhtml" /> 
</http>

正如你可以看到我的默认的目标URL是 “/internal/private/landing.xhtml”。我打开了调试，可以看到身份验证已通过，但从未重定向到默认页面。

下面是一个从显示了从春天重定向呼叫日志剪断：

08:58:03,701 DEBUG [org.springframework.security.web.authentication.session.SessionFixationProtectionStrategy] (http-localhost-127.0.0.1-8080-2) Invalidating session with Id 'qPg2MdmRgSpTcV6CVT7cb-9M.undefined' and migrating attributes. 
08:58:03,703 DEBUG [org.springframework.security.web.authentication.session.SessionFixationProtectionStrategy] (http-localhost-127.0.0.1-8080-2) Started new session: GFoQyvUtbd+lmZiNw0QKRrI-.undefined 
08:58:03,705 DEBUG [org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter] (http-localhost-127.0.0.1-8080-2) Authentication success. Updating SecurityContextHolder to contain: org.springframew[email protected]d9fa0ad7: Principal: [email protected]: Username: roland.jones; Password: [PROTECTED]; Enabled: true; AccountNonExpired: true; credentialsNonExpired: true; AccountNonLocked: true; Granted Authorities: ADMIN,USER; Credentials: [PROTECTED]; Authenticated: true; Details: org.sprin[email protected]fffe3f86: RemoteIpAddress: 127.0.0.1; SessionId: qPg2MdmRgSpTcV6CVT7cb-9M.undefined; Granted Authorities: ADMIN, USER 
08:58:03,714 DEBUG [org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler] (http-localhost-127.0.0.1-8080-2) Using default Url: /internal/private/landing.html 
08:58:03,716 DEBUG [org.springframework.security.web.DefaultRedirectStrategy] (http-localhost-127.0.0.1-8080-2) Redirecting to '/scheduling/internal/private/landing.html' 
08:58:03,718 DEBUG [org.springframework.security.web.context.HttpSessionSecurityContextRepository] (http-localhost-127.0.0.1-8080-2) SecurityContext stored to HttpSession: '[email protected]fa0ad7: Authentication: org.springframew[email protected]d9fa0ad7: Principal: [email protected]: Username: roland.jones; Password: [PROTECTED]; Enabled: true; AccountNonExpired: true; credentialsNonExpired: true; AccountNonLocked: true; Granted Authorities: ADMIN,USER; Credentials: [PROTECTED]; Authenticated: true; Details: org.sprin[email protected]fffe3f86: RemoteIpAddress: 127.0.0.1; SessionId: qPg2MdmRgSpTcV6CVT7cb-9M.undefined; Granted Authorities: ADMIN, USER' 
08:58:03,727 DEBUG [org.springframework.security.web.context.HttpSessionSecurityContextRepository] (http-localhost-127.0.0.1-8080-2) SecurityContext stored to HttpSession: '[email protected]fa0ad7: Authentication: org.springframew[email protected]d9fa0ad7: Principal: [email protected]: Username: roland.jones; Password: [PROTECTED]; Enabled: true; AccountNonExpired: true; credentialsNonExpired: true; AccountNonLocked: true; Granted Authorities: ADMIN,USER; Credentials: [PROTECTED]; Authenticated: true; Details: org.sprin[email protected]fffe3f86: RemoteIpAddress: 127.0.0.1; SessionId: qPg2MdmRgSpTcV6CVT7cb-9M.undefined; Granted Authorities: ADMIN, USER' 
08:58:05,156 DEBUG [org.springframework.security.web.access.ExceptionTranslationFilter] (http-localhost-127.0.0.1-8080-2) Chain processed normally

后，我尝试登录，如果我在地址默认网址键入它去那里没有任何问题，所以我知道验证通过。

请帮忙。谢谢！

来源

2013-08-23 braveheart1996

在Spring Security 3.x中，您可以使用authentication handler来实现它，它允许您编写自定义servlet代码来管理成功的身份验证。我知道你在使用Spring Security 2，但如果升级是一个选项，你可以考虑它。

我首先声明访问的登录表单并使其可供每个用户使用。 APPART从，我假限制URL的其余部分：

<http use-expressions="true"> 
    <intercept-url pattern="/login**" access="permitAll()" /> 
    <intercept-url pattern="/**" access="isAuthenticated()" /> 
    <form-login login-page="/login" default-target-url="/home" 
     always-use-default-target="false" 
     authentication-success-handler-ref="authenticationSuccessHandler" 
     authentication-failure-handler-ref="authenticationFailureHandler" /> 
    <logout logout-success-url="/login" invalidate-session="true" /> 
</http>

通知我声明了两个认证处理中，成功和失败的。在那之后，我有自己的SystemAuthenticationSuccessHandler实施，这为我提供了执行servlet代码的能力，一旦认证成功完成：

<beans:bean id="authenticationSuccessHandler" 
    class="com.mycompany.security.SystemAuthenticationSuccessHandler" />

随着我能够进行重定向，如果认证成功permormed：

import org.springframework.security.web.authentication.AuthenticationSuccessHandler; 

public class SystemAuthenticationSuccessHandler implements AuthenticationSuccessHandler { 

    @Override 
    public void onAuthenticationSuccess(HttpServletRequest req, 
     HttpServletResponse res, Authentication auth) 
     throws IOException, ServletException { 
      res.sendRedirect(req.getContextPath() + "/home"); 
    } 

}

来源

2013-08-23 14:00:46

所以我实际上使用Spring Security 3.1，并且我创建了一个像上面那样的自定义成功处理程序，但仍然没有重定向。是否有我需要做的另一个配置。 – braveheart1996

感谢您的帮助，但我明白了。我使用的是Primefaces按钮，由于某种原因，Spring不喜欢这样。当我更改为常规的jsf按钮时，它工作正常。我可以就此向春季提出一个问题。 – braveheart1996

@ braveheart1996您只需要设置属性“ajax = false”。

<p:commandButton action="#{controller.login()}" 
        value="Login" icon="fa fa-sign-in" 
        process="@this formLogin" 
        update="formLogin" 
        ajax="false"/>

来源

2017-06-08 22:41:01

弹簧安全jsf在成功登录后不会重定向

回答

相关问题