java - Hazelcast 无法与 Spring 安全一起使用(未找到 SessionRegistry bean)

Question

我正在使用 Hazelcast 3.4 和 Spring security 3.2.5。当我部署应用程序并尝试登录时，登录成功但抛出异常，导致错误页面。无论错误页面如何，我都已登录并且我的 session 处于“Activity 状态”。但每次登录后，我总是会收到执行结果，结果会出现在错误页面上(我已将其设置为在出现未处理的异常时出现)。

web.xml 中我的 Hazelcast 配置:

     <filter>
    <filter-name>hazelcast-filter</filter-name>
    <filter-class>com.hazelcast.web.spring.SpringAwareWebFilter</filter-class>
    <init-param>
        <param-name>map-name</param-name>
        <param-value>at-sessions</param-value>
    </init-param>

    <init-param>
        <param-name>sticky-session</param-name>
        <param-value>true</param-value>
    </init-param>
    <init-param>
        <param-name>cookie-name</param-name>
        <param-value>hsessionId</param-value>
    </init-param>
    <init-param>
        <param-name>cookie-http-only</param-name>
        <param-value>true</param-value>
    </init-param>
    <init-param>
        <param-name>instance-name</param-name>
        <param-value>hazelcastInstance</param-value>
    </init-param>
    <init-param>
        <param-name>shutdown-on-destroy</param-name>
        <param-value>false</param-value>
    </init-param>
</filter>

<listener>
    <listener-class>com.hazelcast.web.SessionListener</listener-class>
</listener> 


 <filter-mapping>
    <filter-name>hazelcast-filter</filter-name>
    <url-pattern>/*</url-pattern>
    <dispatcher>FORWARD</dispatcher>
    <dispatcher>INCLUDE</dispatcher>
    <dispatcher>REQUEST</dispatcher>
</filter-mapping>

我在 Spring 上下文 xml 中的 hazelcast 配置:

<hz:hazelcast id="hazelcastInstance">
    <hz:config>
        <hz:instance-name>hazelcastInstance</hz:instance-name>
        <hz:group name="${hazelcast.group.name}" password="${hazelcast.group.password}"/>
        <hz:properties>
            <hz:property name="hazelcast.jmx">true</hz:property>
            <hz:property name="hazelcast.logging.type">slf4j</hz:property>
        </hz:properties>
        <hz:network port="${hazelcast.port}">
            <hz:join>
                <hz:multicast enabled="false"/>
                <hz:tcp-ip enabled="${hazelcast.tcp.ip.enabled}">
                    <hz:members>${hazelcast.tcp.ip.members}</hz:members>
                </hz:tcp-ip>
                <hz:aws enabled="${hazelcast.aws.enabled}"
                    access-key="${hazelcast.aws.access.key}"
                    secret-key="${hazelcast.aws.secret.key}"
                    region="${hazelcast.aws.region}"
                    tag-key="${hazelcast.aws.tag.key}"
                    tag-value="${hazelcast.aws.tag.value}"
                />
            </hz:join>
        </hz:network>
        <hz:map name="at-sessions"
            in-memory-format="${hazelcast.sessions.in.memory.format}"
            backup-count="${hazelcast.sessions.backup.count}"
            async-backup-count="${hazelcast.sessions.async.backup.count}"
            time-to-live-seconds="${hazelcast.sessions.ttl.seconds}"
            max-idle-seconds="${hazelcast.sessions.max.idle.seconds}"
            eviction-policy="LRU"
            max-size-policy="USED_HEAP_PERCENTAGE"
            max-size="${hazelcast.sessions.max.size}"
            eviction-percentage="${hazelcast.sessions.eviction.percentage}"
            merge-policy="${hazelcast.sessions.merge.policy}"
        />
    </hz:config>

</hz:hazelcast>

我收到以下异常:

Caused by: javax.servlet.ServletException: org.springframework.beans.factory.NoSuchBeanDefinitionException: No qualifying bean of type [org.springframework.security.core.session.SessionRegistry] is defined
    at org.apache.jsp.WEB_002dINF.views.common.general_002derror_jsp._jspService(general_002derror_jsp.java:195) ~[na:na]
    at org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:70) ~[jasper.jar:7.0.57]
    at javax.servlet.http.HttpServlet.service(HttpServlet.java:727) [servlet-api.jar:na]
    at org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:432) ~[jasper.jar:7.0.57]
    ... 97 common frames omitted

没有 Hazelcast，登录工作完全正常。任何帮助将不胜感激。

Answer 1

我也有同样的问题。原因是我使用 DSL 使用 Spring Java Config for Spring Security。使用当前的 Spring Security 4.0.1，配置器将仅根据需要创建 SessionRegistry，而不是(看起来)作为注册的 bean 组件。

我已经通过 SessionRegistry 的显式定义修复了这个问题。

    http
        .sessionManagement()
            .sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED)
            .sessionFixation()
                .migrateSession()
                .maximumSessions(10)
                .sessionRegistry(sessionRegistry()) // << this here!
                .and()
            .and()

和

@Bean
public SessionRegistry sessionRegistry() {
    return new SessionRegistryImpl();
}

除非使用 Hazelcast 的 WebFilter，否则不需要这样做，因为 Spring 的 SessionManagementConfigurer 将确保创建 SessionRegistry 的实例。但使用 SessionRegistry 类型无法找到它。