我在使用由@EnableGlobalMethodSecurity
控制的方法级别注释设置应用程序时遇到一些问题我正在使用
public class SecurityWebApplicationInitializer extends AbstractSecurityWebApplicationInitializer {
public SecurityWebApplicationInitializer() {
super(MultiSecurityConfig.class);
}
}
我尝试了两种不同的方法来初始化AuthenticationManager
这两个问题。请注意, not 使用@EnableGlobalMethodSecurity
会导致服务器启动成功,并且所有表单安全性都按预期执行。当我在控制器上添加@EnableGlobalMethodSecurity
和@PreAuthorize("hasRole('ROLE_USER')")
注释时,我的问题就出现了。
我正在尝试独立设置基于表单和基于api的安全性。基于注释的方法只需要用于api安全性。
以下是一种配置。
@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled=true)
public class MultiSecurityConfig {
@Configuration
@Order(1)
public static class ApiWebSecurityConfigurationAdapter extends WebSecurityConfigurerAdapter {
protected void configure(HttpSecurity http) throws Exception {
http.antMatcher("/api/**").httpBasic();
}
protected void registerAuthentication(AuthenticationManagerBuilder auth) throws Exception {
auth.inMemoryAuthentication()
.withUser("user").password("password").roles("USER").and()
.withUser("admin").password("password").roles("USER", "ADMIN");
}
}
@Configuration
public static class FormWebSecurityConfigurerAdapter extends WebSecurityConfigurerAdapter {
public void configure(WebSecurity web) throws Exception {
web.ignoring().antMatchers("/static/**","/status");
}
protected void configure(HttpSecurity http) throws Exception {
http.authorizeRequests().anyRequest().hasRole("USER").and()
.formLogin().loginPage("/login").permitAll();
}
protected void registerAuthentication(AuthenticationManagerBuilder auth) throws Exception {
auth.inMemoryAuthentication()
.withUser("user").password("password").roles("USER").and()
.withUser("admin").password("password").roles("USER", "ADMIN");
}
}
}
这并不理想,因为我真的只想要一次注册认证机制,但主要问题是它会导致以下异常:
java.lang.IllegalArgumentException: Expecting to only find a single bean for type interface org.springframework.security.authentication.AuthenticationManager, but found []
据我所知@EnableGlobalMethodSecurity
设置了自己的AuthenticationManager
,所以我不确定这里的问题是什么。
第二种配置如下。
@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled=true)
public class MultiSecurityConfig {
@Bean
protected AuthenticationManager authenticationManager() throws Exception {
return new AuthenticationManagerBuilder(ObjectPostProcessor.QUIESCENT_POSTPROCESSOR)
.inMemoryAuthentication()
.withUser("user").password("password").roles("USER").and()
.withUser("admin").password("password").roles("USER", "ADMIN").and()
.and()
.build();
}
@Configuration
@Order(1)
public static class ApiWebSecurityConfigurationAdapter extends WebSecurityConfigurerAdapter {
@Override protected void configure(HttpSecurity http) throws Exception {
http.antMatcher("/api/**").httpBasic();
}
}
@Configuration
public static class FormWebSecurityConfigurerAdapter extends WebSecurityConfigurerAdapter {
public void configure(WebSecurity web) throws Exception {
web.ignoring().antMatchers("/static/**","/status");
}
protected void configure(HttpSecurity http) throws Exception {
http.authorizeRequests().anyRequest().hasRole("USER").and()
.formLogin().loginPage("/login").permitAll();
}
}
}
此配置实际上已成功启动但有例外
java.lang.IllegalArgumentException: A parent AuthenticationManager or a list of AuthenticationProviders is required
at org.springframework.security.authentication.ProviderManager.checkState(ProviderManager.java:117)
at org.springframework.security.authentication.ProviderManager.<init>(ProviderManager.java:106)
at org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder.performBuild(AuthenticationManagerBuilder.java:221)
当我测试时,我发现安全性不起作用。
我现在已经看了几天,甚至在深入了解Spring安全实现代码后,我似乎无法找到我的配置有什么问题。
我使用的是spring-security-3.2.0.RC1和spring-framework-3.2.3.RELEASE。
答案 0 :(得分:12)
当您在protected registerAuthentication
上使用WebSecurityConfigurerAdapter
方法时,它会将身份验证范围限定为WebSecurityConfigurerAdapter
,因此EnableGlobalMethodSecurity
无法找到它。如果你考虑这个...它是有道理的,因为该方法是受保护的。
您看到的错误实际上是一个调试语句(注意级别是DEBUG)。原因是Spring Security将尝试使用几种不同的方法来自动连接全局方法安全性。具体来说,EnableGlobalMethodSecurity
会尝试以下方式尝试获取AuthenticationManager
:
GlobalMethodSecurityConfiguration
并覆盖registerAuthentication
,则会使用传入的AuthenticationManagerBuilder
。这样就可以像您一样隔离AuthenticationManager
使用WebSecurityConfigurerAdapter
AuthenticationManagerBuilder
的全局共享实例构建,如果失败则记录您看到的错误消息(注意日志还说明“现在可以,我们将尝试直接使用AuthenticationManager” )AuthenticationManager
。对于您的代码,您最好使用以下内容:
@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled=true)
public class MultiSecurityConfig {
// Since MultiSecurityConfig does not extend GlobalMethodSecurityConfiguration and
// define an AuthenticationManager, it will try using the globally defined
// AuthenticationManagerBuilder to create one
// The @Enable*Security annotations create a global AuthenticationManagerBuilder
// that can optionally be used for creating an AuthenticationManager that is shared
// The key to using it is to use the @Autowired annotation
@Autowired
public void registerSharedAuthentication(AuthenticationManagerBuilder auth) throws Exception {
auth
.inMemoryAuthentication()
.withUser("user").password("password").roles("USER").and()
.withUser("admin").password("password").roles("USER", "ADMIN");
}
@Configuration
@Order(1)
public static class ApiWebSecurityConfigurationAdapter extends WebSecurityConfigurerAdapter {
// Since we didn't specify an AuthenticationManager for this class,
// the global instance is used
protected void configure(HttpSecurity http) throws Exception {
http
.antMatcher("/api/**")
.httpBasic();
}
}
@Configuration
public static class FormWebSecurityConfigurerAdapter extends WebSecurityConfigurerAdapter {
// Since we didn't specify an AuthenticationManager for this class,
// the global instance is used
public void configure(WebSecurity web) throws Exception {
web
.ignoring()
.antMatchers("/static/**","/status");
}
protected void configure(HttpSecurity http) throws Exception {
http
.authorizeRequests()
.anyRequest().hasRole("USER")
.and()
.formLogin()
.loginPage("/login")
.permitAll();
}
}
}
注意:有关此内容的更多文档将在未来几天内添加到参考文献中。