java - Spring boot 和 Spring Security inMemoryAuthentication 不工作

Question

我正在尝试为应用程序配置具有 Spring 安全性的 Spring boot。

但是，inMemoryAuthentication() 似乎无法正常工作，对于每个用户我都有以下错误:

INFO 6964 --- [nio-8080-exec-6] o.s.b.a.audit.listener.AuditListener     : AuditEvent [timestamp=Fri Oct 16 19:09:41 IST 2015, principal=anonymousUser, type=AUTHORIZATION_FAILURE, data={message=Access is denied, type=org.springframework.security.access.AccessDeniedException}]

以下是使用的文件配置:

安全配置.java:

@Configuration
@EnableWebMvcSecurity
@Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)
public class SecurityConfig extends WebSecurityConfigurerAdapter {


    @Override
    public void configure( WebSecurity web ) throws Exception
    {
        //
        web
        .ignoring()
        .antMatchers( "/WEB-INF/jsp/**" );
    }

    @Autowired
    public void configureGlobal( AuthenticationManagerBuilder auth ) throws Exception
    {
          auth.inMemoryAuthentication()
                    .withUser("user").password("password").roles("USER");


    }


    @Override
    protected void configure(HttpSecurity http) throws Exception {

        http

            .authorizeRequests().antMatchers("/homepage**").hasRole("USER")
            .antMatchers("/index**").permitAll()
            .antMatchers("/login**").permitAll()

            .and()
            .formLogin()
            .loginPage( "/login" )
            .loginProcessingUrl( "/login" )
            .defaultSuccessUrl( "/index" );
        http.csrf().disable();

    }

即使应用程序无法使用给定的“用户”和“密码”登录；

Spring boot version: 1.2.6
Editor: STS

引用调试日志，inMemoryAuthencated 用户显示为匿名用户:

org.springframework.security.authentication.AnonymousAuthenticationToken@90576bf4: **Principal: anonymousUser**; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@21a2c: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: FB03A4C352FC0164A5A3F751E52A5421; **Granted Authorities: ROLE_ANONYMOUS**

有什么见解吗？

Answer 1

如果您将自定义登录过程替换为自动生成的登录页面:

@Override
protected void configure(HttpSecurity http) throws Exception {
    http.authorizeRequests().antMatchers("/homepage**").hasRole("USER")
        .antMatchers("/index**").permitAll()
        .antMatchers("/login**").permitAll()
        .and()
        .formLogin();
        //.loginPage( "/login" )
        //.loginProcessingUrl( "/login" )
        //.defaultSuccessUrl( "/index" );
    http.csrf().disable();
}

错误是否仍然出现？如果不是，这似乎是您的自定义登录过程有问题。