使用后端Spring Security Java EE Server和前端iOS Objective-C客户端进行身份验证

亲爱的

我忘了把这个老话题的解决方案放在下面，所以对于面临相同情况的开发人员来说，下面是一个可能的解决方案:

I forgot to put the solution of this old topic so below one possible solution for developers facing same situation :

• 在iOS客户端上通过HTTP进行登录的示例，后面带有Spring安全认证:

-(IBAction)connect:(UIButton *)发送器{

-(IBAction)connect:(UIButton *)sender {

        // Get login and password values
        NSString *login = self.loginTextField.text;
        NSString *password = self.passwordTextField.text;

        // Check if they are not empty before HTTP call
        if([login isEqualToString:@""] || [password isEqualToString:@""]) {
            self.loginResponse.text = @"Please select a login and a password before connect.";
            return;
        } else {
            self.userLogin = login;
            self.userPassword = password;
        }

        // Prepare request for login
        NSString *restRequest =[[NSString alloc] initWithFormat:@"%@/rest/%@",IP_SERVER,REST_LOGIN_OPERATION];
        NSMutableURLRequest *request =[NSMutableURLRequest requestWithURL:[NSURL URLWithString:restRequest]];
        [request setHTTPMethod:@"POST"];
        NSString *post =[[NSString alloc] initWithFormat:@"j_username=%@&j_password=%@&submit=Login",self.userLogin,self.userPassword];
        [request setHTTPBody:[post dataUsingEncoding:NSUTF8StringEncoding]];

        // start the animation if it's not already going
        [self.spinner startAnimating];

        dispatch_queue_t loginQ = dispatch_queue_create("endoServerLoginQueue", NULL);
        dispatch_async(loginQ, ^(){
            // call Web Service REST on EndoServer for login
            NSHTTPURLResponse *urlResponse = nil;
            NSError *err;
            NSData *urlData =[NSURLConnection sendSynchronousRequest:request returningResponse:&urlResponse error:&err];

            // Log async call request
            NSLog(@"[%@ %@] Request for customer login : %@",NSStringFromClass([self class]), NSStringFromSelector(_cmd), request);

            // When we have the results, use main queue to display them
            dispatch_async(dispatch_get_main_queue(), ^{

                // Parse data
                NSString *str=[[NSString alloc]initWithData:urlData encoding:NSUTF8StringEncoding];

                // Log async call response
                NSLog(@"[%@ %@] Response status code for doctor login : %d",NSStringFromClass([self class]), NSStringFromSelector(_cmd), urlResponse.statusCode);
                NSLog(@"[%@ %@] Response body for doctor login : (doctor id = %@)", NSStringFromClass([self class]), NSStringFromSelector(_cmd), str);
                NSLog(@"[%@ %@] Error code for doctor login : %d",NSStringFromClass([self class]), NSStringFromSelector(_cmd), err.code);

                if(urlResponse.statusCode == 200) {

                    [self.logoutButton setEnabled:YES];

                    NSLog(@"[%@ %@] Connection Success for Customer login (%@) and Password (%@).",NSStringFromClass([self class]), NSStringFromSelector(_cmd), self.userLogin,self.userPassword);


                    // Save login and password in user preferences
                    NSUserDefaults *userPreferences = [NSUserDefaults standardUserDefaults];
                    [userPreferences setObject:self.userLogin forKey:USER_LOGIN_KEY];
                    [userPreferences setObject:self.userPassword forKey:USER_PASSWORD_KEY];
                    [userPreferences setInteger:[str integerValue] forKey:USER_ID_KEY];
                    [userPreferences synchronize];

                    // Go to Home screen view
                    str = [NSString stringWithFormat:@"Welcome %@ ! ",self.userLogin];
                    [self performSegueWithIdentifier:@"goToHomePage" sender:self];
                }

                if(err.code == -1004) {
                    str = @"Server is shutdown, please try later or contact administrator.";
                    NSLog(@"[%@ %@] Error message : %@",NSStringFromClass([self class]), NSStringFromSelector(_cmd), str);
                }

                self.loginResponse.text = str; // makes UIKit calls, so must be main thread
                [self.spinner stopAnimating]; // stop the animation
            });
        });

}

• 带有自定义身份验证处理程序的spring安全配置示例:

• Sample of spring security configuration with custom authentication handler:

.....

<context:annotation-config />
<context:component-scan base-package="com....." />

....

<!-- 
    Add Rest API access for mobile devices
 -->
<http pattern="/rest/**" entry-point-ref="authenticationEntryPoint" use-expressions="true">
    <intercept-url pattern="/rest/login" access="hasRole('ROLE_CUSTOMER')" />
    <intercept-url pattern="/rest/customer/**" access="hasRole('ROLE_CUSTOMER')"/>
    <intercept-url pattern="/rest/logout" access="isAuthenticated()" />
    <form-login login-processing-url="/rest/login"
                authentication-success-handler-ref="customAuthenticationSuccessHandler"
                authentication-failure-handler-ref="customAuthenticationFailureHandler"/>
    <logout success-handler-ref="customLogoutSuccessHandler" logout-url="/rest/logout" invalidate-session="true"/>
</http>


....

和处理程序实现的示例:

and sample of handler implementation :

@Component(value = "customAuthenticationSuccessHandler")
public class CustomAuthenticationSuccessHandler extends SimpleUrlAuthenticationSuccessHandler {

    private static final Logger LOGGER = Logger.getLogger(CustomAuthenticationSuccessHandler.class);

    @Autowired
    private IUserRepository userRepository;

    @Override
    public void onAuthenticationSuccess(HttpServletRequest request,
            HttpServletResponse response, Authentication authentication)
                    throws IOException, ServletException {
        if (hasRoleCustomer(authentication)) {
            String username = authentication.getName();
            User user = userRepository.findByUsername(username);
            response.setStatus(HttpServletResponse.SC_OK);
            response.getWriter().print(user.getId());
            LOGGER.info("Authentication Success for customer : "+user.getUsername()+", with id : "+user.getId());
        } else {
            response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
            response.getWriter().print("Access Denied, please contact the administrator.");
            LOGGER.info("Access denied for customer : "+authentication.getName());
        }
        response.getWriter().flush();
    }

其他必需的处理程序应根据您的业务需求以相同的方式实现.

Others required handler should be implemented in the same way according to your business requirements.