maven - 测试和生产环境中的 Spring Security

Question

我想在两个环境中运行 Spring Security:测试环境和生产环境。

我尝试对生产环境进行配置:

@Configuration
@EnableWebSecurity
@ComponentScan(basePackages = { "com.thalasoft.learnintouch.rest.security" })
@Import({ WebSecurityInitializer.class })
public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter {

    private static Logger logger = LoggerFactory.getLogger(WebSecurityConfiguration.class);

    @Autowired
    CustomAuthenticationProvider customAuthenticationProvider;

    @Autowired
    RestAuthenticationEntryPoint restAuthenticationEntryPoint;

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.authenticationProvider(customAuthenticationProvider);
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
        .csrf().disable()
        .httpBasic()
        .authenticationEntryPoint(restAuthenticationEntryPoint)
        .and()
        .authorizeRequests()
        .antMatchers("/**").hasRole("ADMIN")
        .anyRequest().authenticated();
    }

}

还有一个用于集成测试环境:

@Configuration
@EnableWebSecurity
@ComponentScan(basePackages = { "com.thalasoft.learnintouch.rest.security" })
@Import({ WebSecurityInitializer.class })
public class WebSecurityTestConfiguration extends WebSecurityConfigurerAdapter {

    private static Logger logger = LoggerFactory.getLogger(WebSecurityConfiguration.class);

    @Autowired
    RestAuthenticationEntryPoint restAuthenticationEntryPoint;

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        auth.inMemoryAuthentication().withUser("stephane").password("mypassword").roles("ADMIN");
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
        .csrf().disable()
        .httpBasic()
        .authenticationEntryPoint(restAuthenticationEntryPoint)
        .and()
        .authorizeRequests()
        .antMatchers("/**").hasRole("ADMIN")
        .anyRequest().authenticated();
    }

}

这两个类位于不同的源中，一个位于 src/main/java 中，一个位于 src/test/java 中，但它们具有相同的包名称。

Maven 构建给了我以下异常:

Caused by: java.lang.IllegalStateException: @Order on WebSecurityConfigurers must be unique. Order of 100 was already used, so it cannot be used on com.thalasoft.learnintouch.rest.config.WebSecurityConfiguration$$EnhancerByCGLIB$$2d511ca8@536972 too.

两次扩展 WebSecurityConfigurerAdapter 是否是尝试再次实例化 WebSecurityConfiguration 失败的原因？

那该怎么办呢？

Answer 1

我可以通过将 @Order(2) 添加到生产环境 WebSecurityConfigurerAdapter 并将 @Order(1) 添加到测试环境来解决该问题。

@Configuration
@EnableWebSecurity
@ComponentScan(basePackages = { "com.thalasoft.learnintouch.rest.security" })
@Import({ WebSecurityInitializer.class })
@Order(2)
public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter {
}

@Configuration
@EnableWebSecurity
@ComponentScan(basePackages = { "com.thalasoft.learnintouch.rest.security" })
@Import({ WebSecurityInitializer.class })
@Order(1)
public class WebSecurityTestConfiguration extends WebSecurityConfigurerAdapter {
}

编辑:更好的解决方案是避免使用 @Order 注释，这本身就是困惑配置的标志。

该问题是由于运行测试时同时加载了WebSecurityConfiguration和WebSecurityTestConfiguration，当只需要加载其中之一时，只需要加载WebSecurityTestConfiguration。

借助条件注释，可以轻松地仅加载所需的注释。

下面是条件定义的界面:

@Target(ElementType.TYPE)
@Retention(RetentionPolicy.RUNTIME)
@Conditional(EnvNotTestCondition.class)
public @interface EnvNotTest {
}

这是它的实现:

public class EnvNotTestCondition implements Condition {

  private static final String ENV_TEST = "test";

    @Override
    public boolean matches(ConditionContext context, AnnotatedTypeMetadata metadata) {
        return context.getEnvironment().getProperty("env") == null || !context.getEnvironment().getProperty("env").equals(ENV_TEST);
    }

}