java - 具有组合多个角色的 Spring security 拦截 url

Question

我对 Spring 很陌生，在配置 Spring 安全规则时遇到了一些困难。

这是我的规则:

<intercept-url pattern="/administration/**" access="ROLE_ADMINISTRATION" />
<intercept-url pattern="/programmation/**" access="ROLE_ADMINISTRATION, ROLE_SAISIE, ROLE_CONSULTATION" />
<intercept-url pattern="/programmation/validate" access="hasAnyRole('ROLE_ADMINISTRATION', 'ROLE_SAISIE', 'ROLE_CONSULTATION') and hasAnyRole('ROLE_NATIONAL', 'ROLE_REGIONAL')" />
<intercept-url pattern="/restitution/**" access="ROLE_ADMINISTRATION, ROLE_RESTITUTION" />
<intercept-url pattern="/**" access="ROLE_ADMINISTRATION, ROLE_SAISIE, ROLE_CONSULTATION, ROLE_RESTITUTION" />

我刚刚添加了第三个，当启动服务器时，从我的角度来看，它产生了一个非常奇怪的异常:

java.lang.IllegalArgumentException: Unsupported configuration attributes: [hasAnyRole('ROLE_ADMINISTRATION', 'ROLE_CONSULTATION') and hasAnyRole('ROLE_NATIONAL', 'ROLE_REGIONAL'), 'ROLE_SAISIE']
    at org.springframework.security.access.intercept.AbstractSecurityInterceptor.afterPropertiesSet(AbstractSecurityInterceptor.java:156) [spring-security-core-3.2.5.RELEASE.jar:3.2.5.RELEASE]
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.invokeInitMethods(AbstractAutowireCapableBeanFactory.java:1612) [spring-beans-4.0.1.RELEASE.jar:4.0.1.RELEASE]
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1549) [spring-beans-4.0.1.RELEASE.jar:4.0.1.RELEASE]
    ... 49 more

如你所见，它来自

hasAnyRole('ROLE_ADMINISTRATION', 'ROLE_SAISIE', 'ROLE_CONSULTATION') and hasAnyRole('ROLE_NATIONAL', 'ROLE_REGIONAL')

至

hasAnyRole('ROLE_ADMINISTRATION', 'ROLE_CONSULTATION') and hasAnyRole('ROLE_NATIONAL', 'ROLE_REGIONAL'), 'ROLE_SAISIE'

我认为规则之间存在某种不良的相互作用，但我无法弄清楚到底发生了什么。

Answer 1

尝试设置为父标签<http>属性 use-expressions="true" ，应该是这样的:

<http use-expressions="true"> 
     <intercept-url pattern="/administration/**" access="ROLE_ADMINISTRATION" />
     <intercept-url pattern="/programmation/**" access="ROLE_ADMINISTRATION, ROLE_SAISIE,        ROLE_CONSULTATION" />
....