java - 带有 filterSecurityInterceptor 的 Spring FilterChainProxy 无法正常工作？

Question

我有一个 spring 应用程序，其配置文件如下所示。所有配置似乎都是正确的，但在调试时我发现，在初始化期间，spring 为 FilterSecurityInterceptor 创建了两个 bean，一个没有任何拦截 url 规则，另一个具有我指定的规则。当请求到来时，它使用没有拦截 url 规则的 FilterSecurityInterceptor bean。所以我看到了以下日志:

DEBUG FilterSecurityInterceptor:183 - Public object - authentication not attempted

但请求 URL 属于拦截 URL 规则。调试发现这是因为使用的bean在DefaultFilterInvocationSecurityMetadataSource的httpMethodMap中没有任何拦截规则。我不确定这里出了什么问题。

下面是applicationContext-security.xml:

<beans xmlns="http://www.springframework.org/schema/beans"
    xmlns:security="http://www.springframework.org/schema/security"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.2.xsd
                        http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.0.xsd"
    default-init-method="init">

    <security:authentication-manager alias="authenticationManager">
        <security:authentication-provider
            user-service-ref="userDetailService">
        </security:authentication-provider>
    </security:authentication-manager>

    <alias name="filterChainProxy" alias="springSecurityFilterChain" />

    <bean id="accessDecisionManager"
        class="org.springframework.security.access.vote.AffirmativeBased">
        <property name="decisionVoters">
            <list>
                <bean class="org.springframework.security.access.vote.RoleVoter" />
                <bean class="org.springframework.security.access.vote.AuthenticatedVoter" />
            </list>
        </property>
    </bean>

    <bean id="consoleAuthenticationSuccessHandler"
        class="custom_class">
        <property name="defaultTargetUrl" value="/loginSuccess.htm" />
        <property name="targetUrlParameter" value="targetURL" />
    </bean>

    <bean id="consoleAuthenticationFailureHandler"
        class="custom_class">
        <property name="loginFailureUrl" value="/loginFailure.htm" />
    </bean>

    <bean id="consoleLogoutSuccessHandler"
        class="custom_class">
        <property name="logoutUrl" value="/loggedout.htm" />
    </bean>

    <bean id="userDetailService"
        class="custom_class">
    </bean>

    <security:http auto-config="true"
        security-context-repository-ref="securityContextRepository">
        <security:form-login authentication-failure-url="/loginFailure.htm"
            default-target-url="/loginSuccess.htm"
            authentication-success-handler-ref="consoleAuthenticationSuccessHandler" />
        <security:logout success-handler-ref="consoleLogoutSuccessHandler" />
        <security:anonymous enabled="false" />
        <security:session-management
            session-fixation-protection="none" />
    </security:http>

    <bean id="filterChainProxy" class="org.springframework.security.web.FilterChainProxy">
        <security:filter-chain-map path-type="ant">
            <security:filter-chain pattern="/login.htm*"
                filters="none" />
            <security:filter-chain pattern="/**"
                filters="securityContextFilter, logoutFilter, formLoginFilter, servletApiFilter, exceptionTranslator, filterSecurityInterceptor" />
        </security:filter-chain-map>
    </bean>

    <bean id="securityContextRepository"
        class="org.springframework.security.web.context.HttpSessionSecurityContextRepository" />

    <bean id="securityContextFilter"
        class="org.springframework.security.web.context.SecurityContextPersistenceFilter">
        <property name="securityContextRepository" ref="securityContextRepository" />
    </bean>
    <bean id="logoutFilter"
        class="org.springframework.security.web.authentication.logout.LogoutFilter">
        <constructor-arg ref="consoleLogoutSuccessHandler"
            index="0"
            type="org.springframework.security.web.authentication.logout.LogoutSuccessHandler" />
        <constructor-arg>
            <list>
                <bean
                    class="org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler" />
            </list>
        </constructor-arg>
    </bean>

    <bean id="servletApiFilter"
        class="org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter" />

    <bean id="exceptionTranslator"
        class="org.springframework.security.web.access.ExceptionTranslationFilter">
        <property name="authenticationEntryPoint">
            <bean
                class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint">
                <property name="loginFormUrl" value="/login.jsp" />
            </bean>
        </property>
    </bean>

    <bean id="formLoginFilter"
        class="org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter">
        <property name="authenticationManager" ref="authenticationManager" />
        <property name="authenticationSuccessHandler" ref="consoleAuthenticationSuccessHandler" />
        <property name="authenticationFailureHandler" ref="consoleAuthenticationFailureHandler" />
    </bean>

    <bean id="filterSecurityInterceptor"
        class="org.springframework.security.web.access.intercept.FilterSecurityInterceptor">
        <property name="securityMetadataSource">
            <security:filter-security-metadata-source>
                <security:intercept-url pattern="/login.htm*"
                    access="ROLE_ANONYMOUS" />
                <security:intercept-url pattern="/**"
                    access="ROLE_USER,ROLE_ADMIN" />
            </security:filter-security-metadata-source>
        </property>
        <property name="accessDecisionManager" ref="accessDecisionManager" />
        <property name="authenticationManager" ref="authenticationManager" />
    </bean>

</beans>

在此感谢任何帮助。

Answer 1

你有 <security:http>配置中的元素。来自文档:

38.1.2 <http>
Each <http> namespace block always creates an SecurityContextPersistenceFilter, an ExceptionTranslationFilter and a FilterSecurityInterceptor. These are fixed and cannot be replaced with alternatives.

所以你的 <bean id="filterSecurityInterceptor">被忽略。而不是

<bean id="filterSecurityInterceptor"
    class="org.springframework.security.web.access.intercept.FilterSecurityInterceptor">
    <property name="securityMetadataSource">
        <security:filter-security-metadata-source>
            <security:intercept-url pattern="/login.htm*"
                access="ROLE_ANONYMOUS" />
            <security:intercept-url pattern="/**"
                access="ROLE_USER,ROLE_ADMIN" />
        </security:filter-security-metadata-source>
    </property>
    <property name="accessDecisionManager" ref="accessDecisionManager" />
    <property name="authenticationManager" ref="authenticationManager" />
</bean>

你应该改变<security:http>包括类似的东西

<security:http ...
        authentication-manager-ref="authenticationManager">
    ...
    <security:intercept-url pattern="/login.htm*"
        access="ROLE_ANONYMOUS" />
    <security:intercept-url pattern="/**"
        access="ROLE_USER,ROLE_ADMIN" />
</security:http>

你不需要<bean id="accessDecisionManager"> ，因为(引自 docs)“默认情况下，AffirmativeBased 实现用于 RoleVoter 和 AuthenticatedVoter”，这正是您定义的内容。

还有你的<bean id="securityContextFilter">被忽略，您应该添加 security-context-repository-ref="securityContextRepository"属性为 http元素。
还有你的<bean id="exceptionTranslator">被忽略了，我不确定如何正确替换它。

而你手动定义了很多org.springframework.security bean 。我怀疑它们中的大多数要么是不必要的(默认定义的)，要么应该使用 security: 的专门元素来定义。命名空间，而不是原始 Spring bean