Question

以下spring-security-context：

<security:http auto-config="true" use-expressions="true">
    <security:access-denied-handler error-page="/403" />
    <security:intercept-url pattern="/admin/**" access="hasRole('ADMIN')" />
    <security:form-login login-page="/" username-parameter="user" password-parameter="pass" login-processing-url="/" default-target-url="/admin"/>
</security:http>

<security:authentication-manager>
    <security:authentication-provider>
        <security:jdbc-user-service data-source-ref="xaDataSource" 
        authorities-by-username-query="select name, role from users where name = ?" 
        users-by-username-query="select name, password, enabled from users_auth where name = ?" />
    </security:authentication-provider>
</security:authentication-manager>

在index.jsp中我有以下形式：

<body>
<h2>Hello, dear user</h2>
<form id="login" method="POST">
<!--    <label for="user">User: <label/> -->
    <input type="text" name="user" /><br/>
<!--    <label for="password">Passowrd: <label/> -->
    <input type="text" name="pass" /><br/>
    <input type="submit" value="login">
</body>

问题是在点击提交按钮后呈现403页面。为什么？我在调试器下检查了org.springframework.security.core.userdetails.jdbc.JdbcDaoImpl，但没有调用loadUserByUsername(String username), loadUsersByUsername(String username), loadUserAuthorities(String username), loadGroupAuthorities(String username)。关注web.xml：

<context-param>
    <param-name>contextConfigLocation</param-name>
    <param-value>/WEB-INF/coreContext.xml /WEB-INF/securityContext.xml</param-value>
  </context-param>

  <!-- servlets -->

  <filter>
    <filter-name>springSecurityFilterChain</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
  </filter>

  <filter-mapping>
    <filter-name>springSecurityFilterChain</filter-name>
    <url-pattern>/*</url-pattern>
  </filter-mapping>

出了什么问题？

Answer 1

试试这个......

您的安全性是使用以下页面定义的：

登录页= “/”

但表格在index.jsp中给出，也没有任何动作。

尝试：

将安全上下文更改为login-page=/index.jsp

并尝试更改表单以使用action=/index.jsp

请指定authentication-failure-url，只是为了检查它是否正在通话。

查看示例here

为什么不调用loadUserByUserName？

1 个答案: