Question

StackOverflow上有很多类似的问题，但我找不到任何答案:(

我有像web.xml这样的文件：

<context-param>
    <param-name>contextConfigLocation</param-name>
    <param-value>
        /WEB-INF/spring-security.xml
    </param-value>
</context-param>

<servlet>
    <servlet-name>spring</servlet-name>
    <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
    <load-on-startup>1</load-on-startup>
    <init-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>/WEB-INF/spring-web.xml</param-value>
    </init-param>
</servlet>

<servlet-mapping>
    <servlet-name>spring</servlet-name>
    <url-pattern>/</url-pattern>
</servlet-mapping>

<listener>
    <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>

<filter>
    <filter-name>springSecurityFilterChain</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
    <filter-name>springSecurityFilterChain</filter-name>
    <url-pattern>/*</url-pattern>
    <dispatcher>FORWARD</dispatcher>
    <dispatcher>REQUEST</dispatcher>
</filter-mapping>

并尝试使用注释配置method security。我认为它必须由<sec:global-method-security pre-post-annotations="enabled"/>完成，与我的情况{（1}}放置在与其他组件相同的上下文中。所以我跟随spring-web.xml：

spring-web.xml

和<beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:sec="http://www.springframework.org/schema/security" xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.0.xsd" default-autowire="byName"> <context:component-scan base-package="com.cleanplates.apiserv"/> <sec:global-method-security pre-post-annotations="enabled"/> </beans>：

spring-security.xml

添加<beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:sec="http://www.springframework.org/schema/security" xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.0.xsd"> <bean id="springSecurityFilterChain" class="org.springframework.security.web.FilterChainProxy"> <sec:filter-chain-map path-type="ant"> <sec:filter-chain pattern="/**" filters=" usernamePasswordProcessingFilter, rememberMeFilter, anonymousProcessingFilter, exceptionTranslationFilter, filterInvocationInterceptor"/> </sec:filter-chain-map> </bean> <bean id="accessDecisionManager" class="org.springframework.security.access.vote.AffirmativeBased"> <property name="decisionVoters"> <list> <bean class="org.springframework.security.access.vote.RoleVoter"/> </list> </property> </bean> <bean id="anonymousProcessingFilter" class="org.springframework.security.web.authentication.AnonymousAuthenticationFilter"> <property name="key" value="********"/> <property name="userAttribute"> <bean class="org.springframework.security.core.userdetails.memory.UserAttribute"> <property name="authoritiesAsString"> <list> <value>ROLE_ANONYMOUS</value> </list> </property> <property name="password" value="none"/> </bean> </property> </bean> <bean id="usernamePasswordProcessingFilter" class="org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter"> <property name="filterProcessesUrl" value="/auth/password"/> <property name="usernameParameter" value="username"/> <property name="passwordParameter" value="password"/> <property name="authenticationManager" ref="authenticationManager"/> </bean> <bean id="rememberMeFilter" class="org.springframework.security.web.authentication.rememberme.RememberMeAuthenticationFilter"> <property name="rememberMeServices" ref="rememberMeServices"/> <property name="authenticationManager" ref="authenticationManager" /> </bean> <bean id="rememberMeServices" class="org.springframework.security.web.authentication.rememberme.TokenBasedRememberMeServices"> <property name="userDetailsService" ref="myUserDetailsService"/> <property name="key" value="*******"/> <property name="alwaysRemember" value="true"/> </bean> <bean id="rememberMeAuthenticationProvider" class="org.springframework.security.authentication.RememberMeAuthenticationProvider"> <property name="key" value="******"/> </bean> <bean id="exceptionTranslationFilter" class="org.springframework.security.web.access.ExceptionTranslationFilter"> <property name="authenticationEntryPoint"> <bean class="org.springframework.security.web.authentication.Http403ForbiddenEntryPoint"/> </property> </bean> <bean id="filterInvocationInterceptor" class="org.springframework.security.web.access.intercept.FilterSecurityInterceptor"> <property name="authenticationManager" ref="authenticationManager"/> <property name="securityMetadataSource"> <sec:filter-security-metadata-source> <sec:intercept-url pattern="/**" access="ROLE_ANONYMOUS,ROLE_USER" method="GET"/> <sec:intercept-url pattern="/**" access="ROLE_ADMIN" method="POST"/> <sec:intercept-url pattern="/**" access="ROLE_ADMIN" method="PUT"/> <sec:intercept-url pattern="/**" access="ROLE_ADMIN" method="DELETE"/> </sec:filter-security-metadata-source> </property> <property name="accessDecisionManager" ref="accessDecisionManager"/> </bean> <bean id="authenticationManager" class="org.springframework.security.authentication.ProviderManager"> <property name="providers"> <list> <bean class="org.springframework.security.authentication.AnonymousAuthenticationProvider"> <property name="key" value="***"/> </bean> <bean class="org.springframework.security.authentication.dao.DaoAuthenticationProvider"> <property name="saltSource"> <bean class="org.springframework.security.authentication.dao.ReflectionSaltSource"> <property name="userPropertyToUse" value="salt"/> </bean> </property> <property name="userDetailsService" ref="myUserDetailsService"/> <property name="passwordEncoder" ref="passwordEncoder"/> </bean> </list> </property> </bean> <bean id="myUserDetailsService" class=".UserDetailsServiceImpl"> </bean> <bean id="passwordEncoder" class="org.springframework.security.authentication.encoding.Md5PasswordEncoder"> </bean> </beans>后所有控制器停止工作的问题。我在日志中有以下内容：

<sec:global-method-security

删除此PageNotFound:noHandlerFound:947 - No mapping found for HTTP request with URI [/some/page] in DispatcherServlet with name 'spring'元素后，一切正常。如果我将其添加到global-security - 没有任何变化。似乎没有使用它，因为任何人都可以访问带有spring-security.xml（或任何其他角色）注释的方法。

PS我正在使用Spring 3.0.5.RELEASE和Spring Security 3.0.5.RELEASE

Answer 1

启用<sec:global-method-security>后，spring security会为您的控制器创建代理。在这种情况下，spring-mvc在bean上找不到像@RequestMapping这样的注释。如果要在控制器上使用安全注释，则应提取控制器的接口并在其上放置mvc注释。 Spring文档包含以下关于此的注释：

注意：使用控制器接口时（例如，对于AOP代理），请确保始终将所有映射注释 - 例如{ {1}}和@RequestMapping - 在控制器接口上，而不是在实现类上。

Spring Security - 如何启用Method Security注释？

1 个答案: