如何在Mule 3.8中验证Authorization: Bearer令牌？配置求助

看起来你已经搭好了自定义AuthenticationProvider的基础框架，但问题出在默认的HttpBasicAuthenticationFilter只会处理Basic Auth头，不会识别Bearer令牌。咱们直接替换掉这个默认过滤器，用自定义的Bearer令牌过滤器来搞定。

步骤1：编写自定义Bearer令牌HTTP安全过滤器 #

首先创建一个继承Mule Spring Security抽象类的过滤器，专门提取Bearer令牌并交给认证管理器处理：

package com.poc;

import org.mule.module.spring.security.filters.http.AbstractHttpSecurityFilter;
import org.springframework.security.authentication.AuthenticationCredentialsNotFoundException;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

public class BearerTokenAuthenticationFilter extends AbstractHttpSecurityFilter {

    private static final String AUTH_HEADER = "Authorization";
    private static final String BEARER_PREFIX = "Bearer ";

    @Override
    protected Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException {
        // 提取Authorization头
        String authHeader = request.getHeader(AUTH_HEADER);
        
        if (authHeader == null || !authHeader.startsWith(BEARER_PREFIX)) {
            throw new AuthenticationCredentialsNotFoundException("Missing or invalid Bearer token in Authorization header");
        }
        
        // 剥离Bearer前缀，获取纯令牌
        String token = authHeader.substring(BEARER_PREFIX.length()).trim();
        
        // 将令牌封装为Authentication对象，交给后续Provider验证
        Authentication authRequest = new UsernamePasswordAuthenticationToken(token, null);
        
        return getAuthenticationManager().authenticate(authRequest);
    }
}

步骤2：在Spring配置中注册过滤器和认证组件 #

更新你的Spring Bean配置，把自定义过滤器注册进去，并关联到认证管理器：

<spring:beans>
    <!-- 你的自定义认证Provider -->
    <spring:bean id="apiAuthenticationProvider" class="com.poc.ApiAuthenticationProvider" />

    <!-- Spring认证管理器 -->
    <ss:authentication-manager id="authenticationManager">
        <ss:authentication-provider ref="apiAuthenticationProvider" />
    </ss:authentication-manager>

    <!-- 注册自定义Bearer令牌过滤器 -->
    <spring:bean id="bearerAuthFilter" class="com.poc.BearerTokenAuthenticationFilter">
        <spring:property name="authenticationManager" ref="authenticationManager" />
        <spring:property name="realm" value="mule-realm" />
    </spring:bean>
</spring:beans>

步骤3：在Mule Flow中使用自定义过滤器 #

修改你的Flow配置，让mule-ss:http-security-filter使用咱们的Bearer过滤器，替换默认的Basic Auth过滤器：

<mule-ss:security-manager name="muleSecurityManager" doc:name="Spring Security Provider">
    <mule-ss:delegate-security-provider name="memory-provider" delegate-ref="authenticationManager" />
</mule-ss:security-manager>

<http:listener-config name="HTTP_Listener_Configuration" host="localhost" port="8081" doc:name="HTTP Listener Configuration" />

<flow name="SpringExample">
    <http:listener config-ref="HTTP_Listener_Configuration" path="/" doc:name="HTTP"/>
    <!-- 指定使用自定义的Bearer令牌过滤器 -->
    <mule-ss:http-security-filter realm="mule-realm" securityManager-ref="muleSecurityManager" filter-ref="bearerAuthFilter" />
    <!-- 这里放你的业务逻辑处理器 -->
</flow>

步骤4：完善自定义AuthenticationProvider的验证逻辑 #

确保你的ApiAuthenticationProvider能处理传入的令牌（也就是UsernamePasswordAuthenticationToken中的principal），比如验证令牌的有效性、过期时间、权限等：

package com.poc;

import org.springframework.security.authentication.AuthenticationProvider;
import org.springframework.security.authentication.BadCredentialsException;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.core.authority.SimpleGrantedAuthority;

import java.util.Collections;

public class ApiAuthenticationProvider implements AuthenticationProvider {

    @Override
    public Authentication authenticate(Authentication authentication) throws AuthenticationException {
        String token = (String) authentication.getPrincipal();
        
        // 这里替换成你的真实令牌验证逻辑：比如JWT解析、数据库查询、缓存校验等
        if (!isValidToken(token)) {
            throw new BadCredentialsException("Invalid or expired Bearer token");
        }
        
        // 验证通过后，返回带权限信息的Authentication对象
        return new UsernamePasswordAuthenticationToken(
            token, 
            null, 
            Collections.singletonList(new SimpleGrantedAuthority("ROLE_API_CONSUMER"))
        );
    }

    private boolean isValidToken(String token) {
        // 示例验证逻辑，根据你的业务需求替换
        return "your-valid-jwt-token-or-api-key".equals(token);
    }

    @Override
    public boolean supports(Class<?> authentication) {
        // 声明支持我们传入的UsernamePasswordAuthenticationToken类型
        return UsernamePasswordAuthenticationToken.class.isAssignableFrom(authentication);
    }
}

关键注意事项 #

• 确保所有自定义类都在Mule的类路径下（比如放在src/main/java目录）
• 当令牌验证失败时，过滤器会自动抛出AuthenticationException，Mule会返回401 Unauthorized响应
• 如果需要支持JWT令牌，可以集成JJWT等库，在isValidToken方法中解析并验证签名、过期时间等字段
• 测试时记得在请求头中携带Authorization: Bearer your-valid-token

内容的提问来源于stack exchange，提问作者Abhishek Kumar