将 Spring Security 3 与 Jersey Rest API 结合起来
我有一个场景，我尝试将 spring security 与 jersey 结合起来用于我的 REST API。
我的需求相当复杂（我认为），如下所示：
Spring security 用于拦截 url 并强制进行基本身份验证，以便访问 REST 资源。这似乎没问题，因为我正在使用 http 客户端来测试它。
然而，我想要做的是以某种方式访问加载的 User 对象，以检查挂起用户的一些附加权限（带有布尔标志的映射对象，用于指示对象属性是否可见）。执行加载的代码有效，但是在 spring 验证之后，我如何访问实际 REST 资源方法本身中的 User 对象？这可能吗？
所以步骤是：
1) 客户端进行 REST API 调用 2）Spring拦截URL检查http标头中提供的用户名和密码 3）如果存在有效凭据，则访问其余资源方法
但在步骤 3 之前，我想以某种方式将加载的 User 对象传递给实际的 Resource 方法本身，以便我可以进一步应用一些逻辑来限制用户可以看到的内容关于我已加载的权限？？？这可能吗？我想我在某处看到了一些代码，这些代码在使用 Spring 和 REST 访问方法之前检查用户角色，但如果有人有任何链接或想法那就太好了。
如果可以的话请帮忙。太感谢了。
I have a scenario where I am trying to combine spring security with jersey for my REST API.
My need is rather complicated (I think) and it is as follows:
Spring security is being used to intercept urls and forcing basic authentication in order to access a REST resource. This seems to be ok as I am using http client to test this.
However what I want to do is somehow access the User object that is loaded to check some additional permissions that hang off the user (a map object with boolean flags to indicate if object properties are visible or not). The code that does the loading works, but after spring authenticates how do I then access the User object in the actual REST Resource method itself?? Is this possible?
So the steps are:
1) Client makes a REST API call
2) Spring intercepts URL checks username and password supplied in the http header
3) The rest resource method is then accessed if valid credentials are present
But before step 3, I want to somehow pass on the loaded User object to the actual Resource method itself so I can further apply some logic to restrict what the user can see based on the permissions that I have loaded??? Is this possible? I think I have seen some code somewhere that checks for User Roles before a method is accessed using Spring and REST but if anyone has any links or ideas that would be excellent.
Please help if you can. thank you so much.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
我通过使用由 bean 工厂构建的请求范围代理解决了这个问题。
这允许您简单地将当前经过身份验证的用户注入到任何 spring 托管 bean 中，在我的例子中，我的 Jersey 资源属于该类别。我将我的用户注入到资源下面的层，但都是一样的。
其他人在此处优雅地发布了完整的解决方案。
I solved this by using a request-scoped proxy which was constructed by a bean factory.
This allows you to simply inject your currently authenticated user into any spring managed bean, and in my case my Jersey Resources fell into that category. I injected my user into the tier below the resources, but it's all the same.
Someone else elegantly blogged the full solution here.