因此,我正在尝试构建一个将使用LDAP身份验证的REST API。基本上,当我使用了登录端点时,我希望它使用httpBasic身份验证来检测凭据,然后将这些凭据用于LDAP服务器。我还想考虑用户角色,保护端点,以便只有具有适当角色的某些用户才能访问所述端点。
是否有可能做到这一点?到目前为止,在我的阅读材料中,我还没有看到清楚说明如何实现此目标的教程或文章。
*更新:我设法将其配置为能够使用httpBasic接受凭据。现在,我想知道如何使用基于LDAP组的用户角色(例如经理,开发人员)为特定端点设置权限。
实际上,使用Spring Boot可以非常简洁地完成此操作。
pom.xml
<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
<modelVersion>4.0.0</modelVersion>
<parent>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-parent</artifactId>
<version>2.3.3.RELEASE</version>
<relativePath/> <!-- lookup parent from repository -->
</parent>
<groupId>com.so</groupId>
<artifactId>rest-ldap</artifactId>
<version>1.0.1</version>
<name>rest-ldap</name>
<description>SO REST LDAP Solution</description>
<properties>
<java.version>11</java.version>
</properties>
<dependencies>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-security</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-ldap</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-web</artifactId>
</dependency>
</dependencies>
<build>
<plugins>
<plugin>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-maven-plugin</artifactId>
</plugin>
</plugins>
</build>
</project>
App.java
package com.so;
import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;
@EnableWebSecurity
@RestController
@SpringBootApplication
public class App extends WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity httpSecurity) throws Exception {
httpSecurity
.httpBasic()
.and()
.authorizeRequests()
.anyRequest()
.authenticated()
.and()
.csrf()
.disable();
}
@Override
protected void configure(AuthenticationManagerBuilder authenticationManagerBuilder) throws Exception {
authenticationManagerBuilder
.ldapAuthentication()
.contextSource()
.url("ldap://ldap-server.com:3268")
.managerDn("CN=MGR_USERNAME")
.managerPassword("MGR_PASSWORD")
.and()
.userSearchFilter("CN={0}");
}
@RequestMapping
public Authentication getAuth() {
return SecurityContextHolder.getContext().getAuthentication();
}
public static void main(String[] args) {
SpringApplication.run(com.so.App.class, args);
}
}
发送请求 http://USERNAME:PASSWORD@localhost:8080
收到(成功)回复
HTTP/1.1 200
Set-Cookie: JSESSIONID=COOKIE-VALUE; Path=/; HttpOnly
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
Content-Type: application/json
Transfer-Encoding: chunked
Date: Mon, 01 Jan 1970 00:00:00 GMT
{
"authorities": [],
"details": {
"remoteAddress": "127.0.0.1",
"sessionId": null
},
"authenticated": true,
"principal": {
"dn": "cn=USERNAME",
"password": null,
"username": "USERNAME",
"authorities": [],
"accountNonExpired": true,
"accountNonLocked": true,
"credentialsNonExpired": true,
"enabled": true,
"timeBeforeExpiration": 2147483647,
"graceLoginsRemaining": 2147483647
},
"credentials": null,
"name": "USERNAME"
}
请享用!
本文收集自互联网,转载请注明来源。
如有侵权,请联系 [email protected] 删除。
我来说两句