使用 Spring Security 在同一 URI 映射上支持基本身份验证和摘要身份验证
我有一个用于保护 RESTful 服务的用例，但我不确定它是否可以实现 - 本质上我希望同时设置基本和摘要身份验证。在链中设置两个过滤器应该相对容易，但我不确定如何处理入口点 - 据我所知，两种类型的身份验证有 2 个入口点，但它应该如何处理潜在的工作是调用正确的入口点，以防授权标头带有基本或摘要身份验证逻辑。
我知道在 Spring 3.1 中您可以拥有多个 elemenets，但我认为这在这种情况下没有帮助，因为这 2 个身份验证选项应该在同一映射上支持，并且映射似乎是这 2 个身份验证选项的唯一方法元素可以微分。
我也知道这个问题： Spring Security 3.x：如何同时启用 BASIC 和 DIGEST 身份验证？ 但这似乎并没有解决多个入口点的问题。
有什么我忽略的事情，或者可能没有完全理解的事情吗？ 任何帮助表示赞赏。 谢谢。 欧根.
I have a use case for securing a RESTful service and I'm not exactly sure it can be implemented or not - essentially I would like to have both Basic and Digest authentication set up. Setting up both filters in the chain should be relativelly easy, but I'm not sure on how to handle the entry point - as far as I can tell, there are 2 entry points for the 2 types of authentication, but the way it should potentially work is to call the correct entry point in case the Authorization header comes with either Basic or Digest authentication logic.
I am aware that in Spring 3.1 you can have multiple elemenets, but I don't think that can help in this case, as these 2 authentication options should be supported on the same mapping, and mapping seems to be the only way that the 2 elements can be differentiated.
I am also aware of the question:
Spring Security 3.x: How can I enable both BASIC and DIGEST authentication?
But that doesn't seem to address the question of multiple entry points.
Is there something that I am overlooking, or perhas not fully understanding?
Any help is appreciated.
Thanks.
Eugen.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
我已经解决了这个问题 - 我最终所做的是使用摘要身份验证（过滤器和入口点）并在链中的摘要过滤器之后添加基本过滤器。这样，对于具有身份验证凭据（基本或摘要）的请求，正确的过滤器将拾取它。对于匿名请求，摘要入口点将启动，并且将提示客户端输入摘要凭据。
I have solved the problem - what I ended up doing was using digest authentication (filter and entrypoint) and adding the basic filter just after the digest filter in the chain. That way, for a request with authentication credentials (either basic or digest), the correct filter would pick it up. For an anonymous request, the digest entry point will commence and the client will be prompted for digest credentials.