在 PreAuthenticationProvider 中处理 UserNotFoundException

发布于 2024-12-10 07:56:04 字数 684 浏览 0 评论 0原文

我有两个身份验证提供商。一个检查数据库，另一个是 SAML 断言的预验证提供商。

用户信息及其各自的角色保存在数据库中。因此，当用户使用 SAML 点击应用程序时，我们会在数据库中插入一行并分配一个默认角色，然后将用户重定向到注册页面，我们在其中捕获一些用户特定信息。

使用 PreAuthenticatedProvider，我捕获 UserNotFoundException，问题是如何从我的身份验证方法将用户重定向到注册页面？

    @Override
    public Authentication authenticate(Authentication authentication) 
            throws AuthenticationException {
        try {
           // custom code
        } catch (UsernameNotFoundException e) {
           // Redirect user to a view
        }
    }

有没有更好的方法来处理此类案件？

编辑：我对处理来自 AuthenticationProviders 特别是 PreAuthenticationProviders 的 AuthenticationExceptions 感兴趣。

原文

I have two authentication providers. One checks against the database and the other is a pre-authenticated provider for SAML assertion.

User information and their respective roles are persisted in a DB. So when the user hits application with SAML, we insert a row in the database and assign a default role after which redirect the user to a registration page where we capture some user specific information.

With PreAuthenticatedProvider I am catching UserNotFoundException and the question is how do I redirect the user to registration page from my authenticate method?

    @Override
    public Authentication authenticate(Authentication authentication) 
            throws AuthenticationException {
        try {
           // custom code
        } catch (UsernameNotFoundException e) {
           // Redirect user to a view
        }
    }

Is there a better way of handling such cases?

EDIT: I am interested in handling AuthenticationExceptions coming from AuthenticationProviders particularly PreAuthenticationProviders.

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

千柳 2024-12-17 07:56:04

您可以编写自己的自定义ExceptionTranslationFilter并将其放在表单处理过滤器之前的过滤器链中，以捕获这些异常并进行正确处理。

application-context.xml 中类似的内容

    <bean id="customExceptionFilter" class="com.company.module.security.filters.CustomExceptionTranslationFilter">
        <constructor-arg ref="authenticationEntryPoint"/>
        <constructor-arg ref="savedRequestCache"></constructor-arg>
        <property name="accessDeniedHandler" ref="customAccessDeniedHandler"/>
    </bean>

您的 ExceptionTransalationFilter 需要扩展 ExceptionTranslationFilter 并覆盖 doFilter 方法：

    @Override
    public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException,
            ServletException
    {
        try
        {
            super.doFilter(req, res, chain);
        }
        catch (Exception ex)
        {
                    // Handle the exception here
            logger.error("Exception - ", ex);
            HttpServletRequest request = (HttpServletRequest) req;
            HttpServletResponse response = (HttpServletResponse) res;
            if (SecurityHelper.isAjaxRequest(request))
            {
                writeFailedAjaxResponse(response, ErrorCode.INTERNAL_ERROR);
                return;
            }
            else
            {
                throw new ServletException(ex);
            }
        }
    }

在 8.2 下查看：

http://static.springsource.org/spring-security/site/docs/3.0.x/reference/core-web-filters.html

You can write your own Custom ExceptionTranslationFilter and put it in the filter chain before the form processin filter to catch these exceptions and handle properly.

Something like this in the application-context.xml

    <bean id="customExceptionFilter" class="com.company.module.security.filters.CustomExceptionTranslationFilter">
        <constructor-arg ref="authenticationEntryPoint"/>
        <constructor-arg ref="savedRequestCache"></constructor-arg>
        <property name="accessDeniedHandler" ref="customAccessDeniedHandler"/>
    </bean>

Your ExceptionTransalationFilter need to extend ExceptionTranslationFilter and Override the doFilter Method:

    @Override
    public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException,
            ServletException
    {
        try
        {
            super.doFilter(req, res, chain);
        }
        catch (Exception ex)
        {
                    // Handle the exception here
            logger.error("Exception - ", ex);
            HttpServletRequest request = (HttpServletRequest) req;
            HttpServletResponse response = (HttpServletResponse) res;
            if (SecurityHelper.isAjaxRequest(request))
            {
                writeFailedAjaxResponse(response, ErrorCode.INTERNAL_ERROR);
                return;
            }
            else
            {
                throw new ServletException(ex);
            }
        }
    }

Look under 8.2 Here:

http://static.springsource.org/spring-security/site/docs/3.0.x/reference/core-web-filters.html

回复收藏 0 原文

~没有更多了~