我有一个使用Spring Security的Spring MVC web应用程序。我想知道当前登录用户的用户名。我正在使用下面给出的代码片段。这是公认的方式吗?
我不喜欢在这个控制器中调用静态方法——恕我直言，这违背了Spring的全部目的。有没有一种方法来配置应用程序有当前的SecurityContext，或当前的认证，注入代替?
@RequestMapping(method = RequestMethod.GET)
public ModelAndView showResults(final HttpServletRequest request...) {
final String currentUser = SecurityContextHolder.getContext().getAuthentication().getName();
...
}
当前回答
为了让它只显示在JSP页面中，你可以使用Spring Security标签库:
http://static.springsource.org/spring-security/site/docs/3.0.x/reference/taglibs.html
要使用任何标记，必须在JSP中声明安全标记库:
<%@ taglib prefix="security" uri="http://www.springframework.org/security/tags" %>
然后在jsp页面中执行如下操作:
<security:authorize access="isAuthenticated()">
logged in as <security:authentication property="principal.username" />
</security:authorize>
<security:authorize access="! isAuthenticated()">
not logged in
</security:authorize>
注意:正如@SBerg413在评论中提到的，您需要添加
use-expressions = " true "
到security.xml配置中的“http”标签以使其工作。
其他回答
将Principal定义为控制器方法中的依赖项，spring将在调用时将当前已验证的用户注入到方法中。
我同意必须为当前用户查询SecurityContext很糟糕，这似乎是一种非常非spring的处理这个问题的方式。
我写了一个静态的“助手”类来处理这个问题;它是脏的，因为它是一个全局和静态的方法，但我认为如果我们改变任何与安全相关的东西，至少我只需要改变一个地方的细节:
/**
* Returns the domain User object for the currently logged in user, or null
* if no User is logged in.
*
* @return User object for the currently logged in user, or null if no User
* is logged in.
*/
public static User getCurrentUser() {
Object principal = SecurityContextHolder.getContext().getAuthentication().getPrincipal()
if (principal instanceof MyUserDetails) return ((MyUserDetails) principal).getUser();
// principal object is either null or represents anonymous user -
// neither of which our domain User object can represent - so return null
return null;
}
/**
* Utility method to determine if the current user is logged in /
* authenticated.
* <p>
* Equivalent of calling:
* <p>
* <code>getCurrentUser() != null</code>
*
* @return if user is logged in
*/
public static boolean isLoggedIn() {
return getCurrentUser() != null;
}
The only problem is that even after authenticating with Spring Security, the user/principal bean doesn't exist in the container, so dependency-injecting it will be difficult. Before we used Spring Security we would create a session-scoped bean that had the current Principal, inject that into an "AuthService" and then inject that Service into most of the other services in the Application. So those Services would simply call authService.getCurrentUser() to get the object. If you have a place in your code where you get a reference to the same Principal in the session, you can simply set it as a property on your session-scoped bean.
如果你正在使用Spring 3，最简单的方法是:
@RequestMapping(method = RequestMethod.GET)
public ModelAndView showResults(final HttpServletRequest request, Principal principal) {
final String currentUser = principal.getName();
}
如果您正在使用Spring Security ver >= 3.2，您可以使用@AuthenticationPrincipal注释:
@RequestMapping(method = RequestMethod.GET)
public ModelAndView showResults(@AuthenticationPrincipal CustomUser currentUser, HttpServletRequest request) {
String currentUsername = currentUser.getUsername();
// ...
}
这里，CustomUser是一个自定义对象，它实现了由自定义UserDetailsService返回的UserDetails。
更多信息可以在Spring Security参考文档的@AuthenticationPrincipal一章中找到。
