ログインしているユーザーごとに 1 つの LoginController Bean を作成するにはどうすればよいですか。問題は、新しいユーザーがログインした瞬間に同じログイン コントローラーが使用され、現在のユーザーだけが変更されることです。
彼は私の LoginController Bean です。
@ManagedBean(name = "loginController")
@SessionScoped
@Controller
public class LoginController implements Serializable {
private static final long serialVersionUID = 1L;
@Autowired
IUserService userService;
@Autowired
@Qualifier("authenticationManager")
protected AuthenticationManager authenticationManager;
// save the current user after login to be able to inject it in other places
// as needed
private User currentUser;
private RequestCache requestCache = new HttpSessionRequestCache();
// inject error message strings
@Value("${loginError.title}")
private String loginErrorTitle;
@Value("${loginError.noAccount}")
private String loginErrorNoAccount;
@Value("${loginError.badCredentials}")
private String loginErrorBadCredentials;
@Value("${loginError.accountLocked}")
private String loginErrorAccountLocked;
@Value("${loginError.accountLocked}")
private String loginErrorAccountDisabled;
/**
* @return the userService
*/
public IUserService getUserService() {
return userService;
}
/**
* @param userService
* the userService to set
*/
public void setUserService(IUserService userService) {
this.userService = userService;
}
/**
* @return the currentUser
*/
public User getCurrentUser() {
return currentUser;
}
/**
* @param currentUser
* the currentUser to set
*/
public void setCurrentUser(User currentUser) {
this.currentUser = currentUser;
}
/**
* This action logs the user in and returns to the secure area.
*
* @return String path to secure area
*/
public void loginUsingSpringAuthenticationManager() {
// get backing bean for simple redirect form
LoginFormBackingBean loginFormBean = (LoginFormBackingBean) FacesUtils
.getBackingBean("loginFormBean");
try {
// check if we have the user with the specified username in the DB
// if we do, authenticate him
User user = userService.getUserByUsername(loginFormBean
.getUserName().trim());
if (null != user) {
// simple token holder
Authentication authenticationRequestToken = createAuthenticationToken(loginFormBean);
Authentication authenticationResponseToken = authenticationManager
.authenticate(authenticationRequestToken);
Authentication authCopy = null;
final Object principal = authenticationResponseToken
.getPrincipal();
if (principal instanceof LdapUserDetailsImpl) {
LdapUserDetailsImpl userImpl = (LdapUserDetailsImpl) principal;
userImpl.getUsername();
// set the obtained user as the current user
setCurrentUser(user);
List<GrantedAuthority> grAuth = new ArrayList<GrantedAuthority>();
// after this, do the role authority stuff
// here loop through user roles if he has more and
// get the highest role for the user and set it as authority
Role role = userService.getMaxRoleForUser(currentUser);
grAuth.add(new SimpleGrantedAuthority(role.getName()));
authCopy = new UsernamePasswordAuthenticationToken(
authenticationResponseToken.getPrincipal(),
authenticationResponseToken.getCredentials(),
grAuth);
}
SecurityContextHolder.getContext().setAuthentication(authCopy);
// ok, test if authenticated, if yes reroute
if (authenticationResponseToken.isAuthenticated()) {
// if authentication is successful, get the redirect URL and
// go to that page;
// if redirect URL is null -> go to index.xhtml
HttpServletRequest request = (HttpServletRequest) FacesContext
.getCurrentInstance().getExternalContext()
.getRequest();
HttpServletResponse response = (HttpServletResponse) FacesContext
.getCurrentInstance().getExternalContext()
.getResponse();
SavedRequest savedRequest = requestCache.getRequest(
request, response);
String savedRedirectUrl = savedRequest != null ? savedRequest
.getRedirectUrl() : null;
FacesContext
.getCurrentInstance()
.getExternalContext()
.redirect(
savedRedirectUrl != null ? savedRedirectUrl
: "index.xhtml");
}
} else {
// we have no user with this username yet, show message
FacesContext.getCurrentInstance().addMessage(
null,
new FacesMessage(FacesMessage.SEVERITY_ERROR,
loginErrorTitle, loginErrorNoAccount));
}
} catch (BadCredentialsException badCredentialsException) {
FacesContext.getCurrentInstance().addMessage(
null,
new FacesMessage(FacesMessage.SEVERITY_ERROR,
loginErrorTitle, loginErrorBadCredentials));
} catch (LockedException lockedException) {
FacesContext.getCurrentInstance().addMessage(
null,
new FacesMessage(FacesMessage.SEVERITY_ERROR,
loginErrorTitle, loginErrorAccountLocked));
} catch (DisabledException disabledException) {
FacesContext.getCurrentInstance().addMessage(
null,
new FacesMessage(FacesMessage.SEVERITY_ERROR,
loginErrorTitle, loginErrorAccountDisabled));
} catch (IOException e) {
FacesContext.getCurrentInstance().addMessage(
null,
new FacesMessage(FacesMessage.SEVERITY_ERROR,
loginErrorTitle, e.getStackTrace().toString()));
}
}
/**
* Creates an authentication token from the username and password collected
* from the login form.
*
* @param loginFormBean
* @return
*/
private Authentication createAuthenticationToken(
LoginFormBackingBean loginFormBean) {
UsernamePasswordAuthenticationToken usernamePasswordAuthenticationToken = new UsernamePasswordAuthenticationToken(
loginFormBean.getUserName(), loginFormBean.getPassword());
return usernamePasswordAuthenticationToken;
}
}
編集：
ご回答ありがとうございます。ログインしている 2 人のユーザーに固有の 2 つの loginController のハッシュ コードを確認しましたが、それらは同じであるため、logginController は 1 つだけ作成されます。JSF と Spring についての私の理解は非常に貧弱です。私が投稿したコードは、別の開発者によって実装されています。構成は次のとおりです。
<!-- This is where we configure Spring-Security -->
<security:http pattern="/javax.faces.resource/**" security="none"/>
<security:http auto-config="true">
<security:intercept-url pattern="/login.xhtml" access="IS_AUTHENTICATED_ANONYMOUSLY"/>
<security:intercept-url pattern="/**" access="ROLE_EMPLOYEE, ROLE_TEAM_LEADER, ROLE_MANAGER"/>
<security:intercept-url pattern="/pages/management/" access="ROLE_MANAGER"/>
<security:intercept-url pattern="/pages/requests/" access="ROLE_EMPLOYEE, ROLE_TEAM_LEADER, ROLE_MANAGER"/>
<security:form-login login-page="/login.xhtml"
default-target-url="/index.xhtml"
always-use-default-target="false" />
<security:logout logout-url="/j_spring_security_logout"
logout-success-url="/login.xhtml"
invalidate-session="true"/>
</security:http>
<security:authentication-manager alias="authenticationManager">
<security:authentication-provider ref = "authProvider"/>
</security:authentication-manager>
<bean id="authProvider"
class="org.springframework.security.ldap.authentication.ad.ActiveDirectoryLdapAuthenticationProvider">
<constructor-arg value="infobest.tm" />
<constructor-arg value="ldap://192.168.1.6:389"/>
</bean>
私を助けることができる提案や有用な資料はありますか？
私の下手な英語でごめんなさい。