时间戳

首页 > 解决方案 > Spring security：身份验证管理器和全局安全配置，带有来自 xml config 的 Java 配置

java - Spring security：身份验证管理器和全局安全配置，带有来自 xml config 的 Java 配置

问题描述

我正在使用 spring security 4.2.5.RELEASE和 spring 4.3.16.RELEASE 我的 XML 配置工作正常，如下所示

<security:global-method-security secured-annotations="enabled" pre-post-annotations="enabled" access-decision-manager-ref="methodAccessDecisionManager">
        <security:expression-handler ref="methodExpressionHandler"/>
    </security:global-method-security>
    <security:authentication-manager>
        <security:authentication-provider user-service-ref="userDetailsService">
            <security:password-encoder ref="passwordEncoder">
                <security:salt-source user-property="saltSource" />
            </security:password-encoder>
        </security:authentication-provider>         

        <security:authentication-provider user-service-ref="userDetailsService">
            <security:password-encoder ref="bcryptPasswordEncoder"/>
        </security:authentication-provider>
    </security:authentication-manager>

我也有http安全配置。需要此配置与 java 配置。access-decision-manager-ref="methodAccessDecisionManager" 但不能这样做，因为我没有找到任何解决方案 <security:expression-handler ref="methodExpressionHandler"/>

@Configuration
@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
public class SecurityConfig extends WebSecurityConfigurerAdapter  {
    @Override
    protected void configure(HttpSecurity http) throws Exception {

        http
        .csrf().disable()
        .addFilterAt(switchUserProcessingFilter(), SwitchUserFilter.class)
        .authorizeRequests()
        .accessDecisionManager(webAccessDecisionManager())
        .antMatchers("/pages/login.jsf").permitAll()
        .antMatchers("/pages/expired.jsf").permitAll()
        .antMatchers("/css/*").permitAll()
        .antMatchers("/images/*").permitAll()
        .antMatchers("/pages/testui/*").access("hasRole('PRIVILEGE_TESTER')")
        .antMatchers("/pages/client/*").access("hasAnyRole('PRIVILEGE_USE_TENDERING, PRIVILEGE_MANAGE_USERS')")
        .antMatchers("/pages/html5/**").access("hasAnyRole('PRIVILEGE_USE_TENDERING, PRIVILEGE_USE_SPOTREQUEST')")
        .antMatchers("/moker/*").access("isAuthenticated()")
        .antMatchers("/e/*").access("hasRole('PRIVILEGE_FILE')")
        .and()
        .formLogin()
        .loginPage("/pageogin.jsf")
        .usernameParameter("j_username")
        .passwordParameter("j_password")
        .loginProcessingUrl("/j_sy_check")
        .failureUrl("/pages/l_error=1")
        .successHandler(tenderEasyAuthSuccessHandler())
        .and()
        .exceptionHandling()
        .accessDeniedHandler(accessDeniedHandler())
        .and()
        .logout()
        .logoutUrl("/j_spring_security_logout")
        .logoutSuccessUrl("/pages/logout.jsf")
        .and();
    }

     @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
       auth
       .userDetailsService(userDetailsService())
       .passwordEncoder(passwordEncoder().isPasswordValid(encPass, rawPass, salt))

    }

}

但在这里我找到了任何东西：

access-decision-manager-ref="methodAccessDecisionManager", security:expression-handler ref=methodExpressionHandler和 security:salt-source user-property=saltSource

标签： javaspringspring-security

解决方案

要指定方法表达式处理程序和访问决策管理器，请使用基于以下配置的配置GlobalMethodSecurityConfiguration：

@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
public class MyGlobalMethodSecurityConfiguration extends GlobalMethodSecurityConfiguration {

    @Autowired
    private MethodSecurityExpressionHandler methodExpressionHandler;

    @Autowired
    private AccessDecisionManager methodAccessDecisionManager;

    @Override
    protected MethodSecurityExpressionHandler createExpressionHandler() {
        return methodExpressionHandler;
    }

    @Override
    protected AccessDecisionManager accessDecisionManager() {
        return methodAccessDecisionManager;
    }

}

（@EnableGlobalMethodSecurity从您的中删除SecurityConfig）。

另请参阅Spring Security 参考文档。

推荐阅读