java - Tomcat 7 和 AbstractSecurityWebApplicationInitializer 不能一起工作

Question

我在关注这个 article在不使用 web.xml 的情况下尝试基本的 http-auth

我正在使用 Tomcat 7.0.41，这些是我对 gradle 的依赖:

  ext.springVersion =  "3.2.1.RELEASE"
  compile "org.springframework:spring-jdbc:$springVersion",
          "org.springframework:spring-context:$springVersion",
          "org.springframework:spring-web:$springVersion",
          "org.springframework:spring-webmvc:$springVersion",
          "org.springframework.security:spring-security-core:3.2.0.M2",
          "org.springframework.security:spring-security-web:3.2.0.M2",
          "org.springframework.security:spring-security-config:3.2.0.M2",

根据教程我定义如下

@EnableWebSecurity
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Override
    protected void registerAuthentication(AuthenticationManagerBuilder auth)
            throws Exception {
        auth.inMemoryAuthentication().withUser("admin").password("admin")
                .roles("USER");
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeUrls().antMatchers("/").hasRole("USER")
                .and().httpBasic();
    }

}

然后像这样将该类添加到初始化器中:

@Order(1)
public class ServletConfiguration extends
        AbstractAnnotationConfigDispatcherServletInitializer {

    @Override
    protected Class<?>[] getRootConfigClasses() {
        return new Class[] { SecurityConfiguration.class };
        // return null;
    }

    @Override
    protected Class<?>[] getServletConfigClasses() {
        return new Class[] { AppConfiguration.class };
    }

    @Override
    protected String[] getServletMappings() {
        return new String[] { "/" };
    }

//  @Override
//  protected Dynamic registerServletFilter(ServletContext servletContext,
//          Filter filter) {
//      Dynamic securityFilter = servletContext.addFilter(
//              "springSecurityFilterChain", DelegatingFilterProxy.class);
//      securityFilter.addMappingForUrlPatterns(
//              EnumSet.allOf(DispatcherType.class), false, "/*");
//      return securityFilter;
//  }

}

最后添加了一个类来初始化 springSecurityFilterChain:

@Order(2)
public class SecurityInitializer extends AbstractSecurityWebApplicationInitializer  {
@Override
protected void afterSpringSecurityFilterChain(ServletContext servletContext) {
    System.out.println("afterSpringSecurityFilterChain");
    super.afterSpringSecurityFilterChain(servletContext);
}
}

但我总是收到这个错误:

DEBUG: org.springframework.jndi.JndiPropertySource - JNDI lookup for name [spring.liveBeansView.mbeanDomain] threw NamingException with message: Name [spring.liveBeansView.mbeanDomain] is not bound in this Context. Unable to find [spring.liveBeansView.mbeanDomain].. Returning null.
Jul 11, 2013 9:22:24 PM org.apache.catalina.core.StandardContext filterStart
SEVERE: Exception starting filter springSecurityFilterChain
org.springframework.beans.factory.NoSuchBeanDefinitionException: No bean named 'springSecurityFilterChain' is defined

虽然我不明白为什么，因为当我调试服务器初始化时，实际上调用了这两个方法:

@Override
public final void onStartup(ServletContext servletContext)
        throws ServletException {
    if(enableHttpSessionEventPublisher()) {
        servletContext.addListener(HttpSessionEventPublisher.class);
    }
    insertSpringSecurityFilterChain(servletContext);
    afterSpringSecurityFilterChain(servletContext);
}

然后

private void insertSpringSecurityFilterChain(ServletContext servletContext) {
    String filterName = "springSecurityFilterChain";
    DelegatingFilterProxy springSecurityFilterChain = new DelegatingFilterProxy(filterName);
    String contextAttribute = getWebApplicationContextAttribute();
    if(contextAttribute != null) {
        springSecurityFilterChain.setContextAttribute(contextAttribute);
    }
    registerFilter(servletContext, true, filterName, springSecurityFilterChain);
}

所以实际上过滤器被创建了。但随后它在某处丢失了。

我尝试使用 @Order，但它什么也没做所以我尝试使用 registerServletFilter 方法注册 springSecurityFilterChain 但我我没有获得任何 http-auth 请求身份验证。而且 SecurityConfiguration 甚至都没有加载。

Answer 1

SecurityInitializer 创建 DelegatingFilterProxy，用于查找名为 springSecurityFilterChain 的 bean。 springSecurityFilterChain 是使用@EnableWebSecurity 创建的。问题是您缺少 @Configuration 注释(没有它 Root ApplicationContext 甚至不会尝试加载 SecurityConfiguration)。具体来说，您想执行以下操作:

@Configuration
@EnableWebSecurity
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
...
}

一些额外的事情要指出:

• 您不需要使用@Order，因为您没有添加任何其他过滤器
• 您获得保护的唯一 URL 是上下文根(即/)。
• 您会想知道在 need spring security java config example showing basic auth only 上讨论的 httpBasic() 的错误。
• 更新:我还应该指出我已经登录了 SPR-10660支持 @Enable* 注释，而无需在其上添加 @Configuration。解决后，您的问题就会神奇地消失。