Spring 安全注释不适用于服务层

Question

我正在使用 Spring 安全性在方法级别定义访问规则，并且面临的问题是 Spring 安全性注释在服务层上不起作用。但它们在 Controller 层正常工作。

这是我的配置:

@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

@Autowired
private UserDetailsService userDetailsService;

@Bean
public PasswordEncoder passwordEncoder() {
    return new BCryptPasswordEncoder();
}

@Autowired
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
    auth
            .userDetailsService(userDetailsService)
            .passwordEncoder(passwordEncoder());

}

@Override
public void configure(WebSecurity web) throws Exception {
    web
            .ignoring()
            .antMatchers("/api/register")
            .antMatchers("/api/activate")
            .antMatchers("/api/lostpassword")
            .antMatchers("/api/resetpassword");

}

@Override
@Bean
public AuthenticationManager authenticationManagerBean() throws Exception {
    return super.authenticationManagerBean();
}

@EnableGlobalMethodSecurity(prePostEnabled = true, jsr250Enabled = true)
private static class GlobalSecurityConfiguration extends GlobalMethodSecurityConfiguration {

    @Autowired
    private MutableAclService mutableAclService;

    @Autowired
    private RoleHierarchy roleHierarchy;

    public GlobalSecurityConfiguration() {
        super();
    }

    @Override
    protected MethodSecurityExpressionHandler createExpressionHandler() {
        DefaultMethodSecurityExpressionHandler expressionHandler = new DefaultMethodSecurityExpressionHandler();
        expressionHandler.setPermissionEvaluator(new AclPermissionEvaluator(mutableAclService));
        expressionHandler.setRoleHierarchy(roleHierarchy);
        return expressionHandler;
    }

}

服务不工作:

@Override
@PreAuthorize("hasRole('ROLE_ADMIN')")
public Iterable<Appliance> getAll() {
    return applianceRepo.findAll();
}

Controller 运行良好:

@PreAuthorize("hasRole('ROLE_ADMIN')")
@RequestMapping(method = RequestMethod.GET)
public ResponseEntity<PagedResources<Appliance>> getPage(@PageableDefault Pageable pageable, PagedResourcesAssembler pagedAssembler) {
    Page<Appliance> appliancePage = applianceService.getPage(pageable);
    return ResponseEntity.ok(pagedAssembler.toResource(appliancePage, applianceAssembler));
}

Answer 1

我意识到将 @PreAuthorize 放在 getAll() 方法上是错误的，但我正在测试 getPage(pageable) 方法. Spring 安全配置运行良好。抱歉给您带来不便。