java - 使用 Spring security 主体对象进行身份验证时 Spring RestController 上出现 IllegalArgumentException

Question

我尝试在后端实现 Spring Security，并在前端 Web 应用程序上实现 Angularjs。但是当我尝试通过/user 方法验证用户时，我得到:

java.lang.IllegalArgumentException: No converter found for return value of type: class org.springframework.security.authentication.UsernamePasswordAuthenticationToken
at org.springframework.util.Assert.isTrue(Assert.java:68) ...

anglarjs 验证功能:

 var authenticate = function(credentials, callback) {

    var headers = credentials ? {authorization : "Basic "
        + btoa(credentials.username + ":" + credentials.password)
    } : {};

    console.log("header",headers);

    $http.get('user', {headers : headers}).success(function(data) {
      if (data.name) {
        $rootScope.authenticated = true;
      } else {
        $rootScope.authenticated = false;
      }
      callback && callback();
    }).error(function() {
      $rootScope.authenticated = false;
      callback && callback();
    });

  }

Spring 支架 Controller :

@RestController
public class RestApiController {

@RequestMapping("/user")
  public Principal user(Principal user) {
    return user;
  }
...

安全配置:

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter{
@Autowired
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
    auth
        .inMemoryAuthentication()
            .withUser("user").password("password").roles("USER");
}

@Override
protected void configure(HttpSecurity http) throws Exception {
    http
    .httpBasic()
  .and()
    .authorizeRequests()
      .antMatchers("/index.jsp", "/resources/**","/").permitAll()
      .anyRequest().authenticated().and()
      .addFilterAfter(new CsrfHeaderFilter(), CsrfFilter.class)
      .csrf().csrfTokenRepository(csrfTokenRepository());;
}

private CsrfTokenRepository csrfTokenRepository() {
      HttpSessionCsrfTokenRepository repository = new HttpSessionCsrfTokenRepository();
      repository.setHeaderName("X-XSRF-TOKEN");
      return repository;
    }
}

Answer 1

Spring使用一组HttpMessageConverts以合适的格式序列化/反序列化请求/响应，即。 JSON/HTML 等。通过您的实现，您似乎没有适当的消息转换器来序列化响应正文中的 principal 对象。要解决此问题，您需要在类路径中包含 jackson-mapper-asl*.jar 和 jackson-databind*.jar