ServletRequestListener - userprincipal을 얻으면 null이 반환됩니다.

Question

HTTP- 기본 인증으로 보안 된 웹 응용 프로그램이 있습니다. 또한 ServletRequestListener 인터페이스를 사용하여 필터를 구현했습니다. 이제 필터가 requestInitialized 메서드를 호출하면 요청의 getUserPrincipal-Method는 null을 반환합니다. 그러나 요청 헤더를 검사 할 때 authorization-header는 암호화 된 값으로 설정됩니다. 코드는 다음과 같습니다.

@Override 
public void requestInitialized(ServletRequestEvent e) { 

    HttpServletRequest request = (HttpServletRequest) e.getServletRequest(); 

    //p is null 
    Principal p = request.getUserPrincipal(); 

    Enumeration<String> enH = request.getHeaders("Authorization"); 
    while (enH.hasMoreElements()) { 
    String s = enH.nextElement(); 
    System.out.println(s); 
    //prints. 
    //Basic c3RhY2tvdmVyZmxvdzpteXBhc3N3b3Jk 
    } 
} 

userprincipal이 초기화되지 않은 이유는 무엇입니까?

Answer 1

임베디드 부두에 필요한 보안 계층을 설정하지 않은 것 같습니다.

Jetty embedded examples source tree에있는 example입니다.

package org.eclipse.jetty.embedded; 

import java.util.Collections; 
import java.util.HashSet; 
import java.util.Set; 

import org.eclipse.jetty.security.ConstraintMapping; 
import org.eclipse.jetty.security.ConstraintSecurityHandler; 
import org.eclipse.jetty.security.HashLoginService; 
import org.eclipse.jetty.security.LoginService; 
import org.eclipse.jetty.security.authentication.BasicAuthenticator; 
import org.eclipse.jetty.server.Server; 
import org.eclipse.jetty.util.security.Constraint; 

public class SecuredHelloHandler 
{ 
    public static void main(String[] args) throws Exception 
    { 
     Server server = new Server(8080); 

     LoginService loginService = new HashLoginService("MyRealm","src/test/resources/realm.properties"); 
     server.addBean(loginService); 

     ConstraintSecurityHandler security = new ConstraintSecurityHandler(); 
     server.setHandler(security); 

     Constraint constraint = new Constraint(); 
     constraint.setName("auth"); 
     constraint.setAuthenticate(true); 
     constraint.setRoles(new String[]{"user", "admin"}); 

     ConstraintMapping mapping = new ConstraintMapping(); 
     mapping.setPathSpec("/*"); 
     mapping.setConstraint(constraint); 

     Set<String> knownRoles = new HashSet<String>(); 
     knownRoles.add("user"); 
     knownRoles.add("admin"); 

     security.setConstraintMappings(Collections.singletonList(mapping), knownRoles); 
     security.setAuthenticator(new BasicAuthenticator()); 
     security.setLoginService(loginService); 
     security.setStrict(false); 

     // Your Handler (or Servlet) that should be secured 
     HelloHandler hh = new HelloHandler(); 

     security.setHandler(hh); 

     server.start(); 
     server.join(); 
    } 
} 

Answer 2

나는

@WebFilter(urlPatterns = { "/*" }) 
public class RequestFilter implements Filter { 

@Override 
public void doFilter(ServletRequest req, ServletResponse res, 
     FilterChain fChain) throws IOException, ServletException { 
    HttpServletRequest hReq = (HttpServletRequest) req; 
    //p is not null anymore 
    Principal p = hReq.getUserPrincipal(); 
    fChain.doFilter(hReq, res); 
} 

@Override 
public void destroy() { 
} 

@Override 
public void init(FilterConfig config) throws ServletException { 
} 
}