java - 如何在 Spring Boot 中配置自定义 AccessDecisionManager 和自定义 AuthenticationProvider

Question

下面是我的安全配置文件，我想将其更改为java配置

<beans:bean id="filterSecurityInterceptor" class="org.springframework.security.web.access.intercept.FilterSecurityInterceptor">
    <beans:property name="accessDecisionManager" ref="accessDecisionManager" />
    <beans:property name="authenticationManager" ref="authenticationManager" />
    <beans:property name="securityMetadataSource" ref="securityMetadataSource" />
</beans:bean>

<authentication-manager alias="authenticationManager" xmlns="http://www.springframework.org/schema/security">
        <authentication-provider ref="customAuthentication"></authentication-provider>
</authentication-manager>

<beans:bean name="accessDecisionManager" class="com.xy.security.CustomAccessDecisionManager" ></beans:bean>

<beans:bean name="securityMetadataSource" class="com..xy.security.InvocationSecurityMetadataSourceService">
</beans:bean>

<beans:bean id="customAuthentication" class="com.xy.security.CustomAuthentication" />

<beans:bean id="securityExceptionTranslationHandler" class="org.springframework.security.web.authentication.ExceptionMappingAuthenticationFailureHandler">
    <beans:property name="exceptionMappings">
        <beans:props>
            <beans:prop key="org.springframework.security.authentication.CredentialsExpiredException">/changepassword.xhtml</beans:prop>
        </beans:props>
    </beans:property>
    <beans:property name="defaultFailureUrl" value="/login.jsp" />
</beans:bean>    ====================================================        

我想将其更改为 java 配置，下面是我的代码，但失败了

@Configuration

@EnableWebSecurity

public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Autowired
    private CustomAuthentication customAuthentication;

    @Autowired
    private CustomAccessDecisionManager customAccessDecisionManager;

    @Autowired
    private InvocationSecurityMetadataSourceService invocationSecurityMetadataSourceService;

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.authenticationProvider(customAuthentication);
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {

        http.authorizeRequests()
            .antMatchers("/login*","/favicon.ico","/","/**/*.css" ,"/images/*.*","/js/*.js","/bt-fonts/*.*").permitAll()
            .anyRequest().authenticated()
            .and()
            .formLogin().loginPage("/login")
            .defaultSuccessUrl("/admin*")
            .failureUrl("/login?error=true")
            .and()
            .logout().logoutSuccessUrl("/login").invalidateHttpSession(true).deleteCookies("true")
            .and()
            .authenticationProvider(customAuthentication)
            //.accessDecisionManager(customAccessDecisionManager)
            //.authorizeRequests().accessDecisionManager(customAccessDecisionManager)
            //.csrf().disable()
            ;

    }

我有一个类，其中有自定义身份验证逻辑

public class CustomAccessDecisionManager implements AccessDecisionManager{

  -@Override
    public Authentication authenticate(Authentication authentication){

//这里有一些代码}

}

还有像下面这样的另一个类，我有自定义授权逻辑

public class CustomAuthentication implements AuthenticationProvider{

  @Override
    public void decide(Authentication arg0, Object object, Collection<ConfigAttribute> arg2)

//这里有一些代码

}

Answer 1

第一个(我建议)是更新您的配置以包含 WebExpressionVoter。例如:

     @Bean
public AccessDecissionManager defaultAccessDecisionManager() {
    List<AccessDecisionVoter<FilterInvocation>> voters = new ArrayList<AccessDecisionVoter<FilterInvocation>>();
    voters.add(new WebExpressionVoter());
    voters.add(new CustomVoter());
    AccessDecissionManager result = new UnanimousBased();
    result.setDecisionVoters(voters);
    return result;
}

第二个选项是更改为不在 Spring Security 的 url 映射中使用表达式。例如

protected void configure(HttpSecurity http) throws Exception {
 http
    .apply(new UrlAuthorizationConfigurer())
        .accessDecisionManager(defaultAccessDecisionManager())
        .antMatchers("/admin/**").hasRole("ADMINGROUP")
        .anyRequest().authenticated().and()
    ....

}

view the below link