spring-security - Websphere 7 - 通用匹配模式 ('/**' ) 在其他模式之前定义

Question

我使用 Roo 生成了一个 spring 项目，并使用安全设置插件添加了 spring 安全性。安全性在 Tomcat 7 上运行良好，但在尝试部署到 Websphere 7.0.0.19 时遇到以下问题。我目前正在使用 Spring Security 3.1.0.RELEASE。我已经看到其他项目在 Websphere 中使用 Spring DelegatingFilterProxy 就好了。有人有任何想法吗？

来自 StackTrace 的错误:

E org.springframework.web.context.ContextLoader initWebApplicationContext Context initialization failed
org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.springframework.security.filterChainProxy': Invocation of init method failed; nested exception is java.lang.IllegalArgumentException: A universal match pattern ('/**') is defined  before other patterns in the filter chain, causing them to be ignored. Please check the ordering in your <security:http> namespace or FilterChainProxy bean configuration

applicationContext-security.xml

<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security" 
    xmlns:beans="http://www.springframework.org/schema/beans" 
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
        http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.1.xsd"> 

    <!-- HTTP security configurations -->
    <http auto-config="true" use-expressions="true" >
        <form-login login-processing-url="/resources/j_spring_security_check" login-page="/login" authentication-failure-url="/login?login_error=t" />
        <logout logout-url="/resources/j_spring_security_logout" />
        <!-- Configure these elements to secure URIs in your application -->
        <intercept-url pattern="/login" access="permitAll" />
        <intercept-url pattern="/admin/**" access="hasRole('ROLE_ADMIN')" />
        <intercept-url pattern="/jobtypes/**" access="isAuthenticated()" />
        <intercept-url pattern="/tests/**" access="permitAll" />
        <!-- Websphere Problem: IllegalArgumentException: A universal match pattern ('/**') is defined  before other patterns in the filter chain -->
        <intercept-url pattern="/resources/**" access="permitAll" />
        <intercept-url pattern="/**" access="hasRole('ROLE_USER')" />
    </http>

    <!-- Configure Authentication mechanism -->
    <beans:bean name="myCompanyAuthenticationProvider" class="edu.mycompany.project.security.MyCompanyAuthenticationProvider" />
    <authentication-manager alias="authenticationManager">
        <authentication-provider ref="myCompanyAuthenticationProvider" />
    </authentication-manager>   
</beans:beans>

谢谢，

Answer 1

对于其他阅读本文(并寻找答案)的人，该问题记录为 SEC-2034并判定为无效。出现此问题是由于配置被提取两次。