时间戳

首页 > 解决方案 > Spring security 5/spring boot 2.2: No AuthenticationProvider found for org.springframework.security.authentication.UsernamePasswordAuthenticationToken

java - Spring security 5/spring boot 2.2: No AuthenticationProvider found for org.springframework.security.authentication.UsernamePasswordAuthenticationToken

问题描述

我们正在将我们的应用程序从 spring boot 1.5.x 升级到 2.2.x，将 spring security 4.x 升级到 5.3.2。我们为我们的网络安全定义了以下内容：

 @EnableWebSecurity
 @Configuration
 @EnableGlobalMethodSecurity(prePostEnabled = true)
 @Profile("uno")
 public class UnoSecurityConfig extends AbstractSecurityConfig {

 @Autowired
 private ServletContext servletContext;

 @Override
 protected void configure(HttpSecurity http) throws Exception {
    BasicAuthFilter basicAuthFilter = new BasicAuthFilter();
    basicAuthFilter.init(new BasicAuthSSOFilterConfig(servletContext));
    http
            .csrf().disable()
            .authorizeRequests()
            .antMatchers(HttpMethod.GET, "/ping").permitAll()
            .antMatchers(HttpMethod.POST, "/ping").permitAll()
            .antMatchers("/**").hasAuthority(OurPrivileges.ALL_MEASURE)
            .antMatchers(HttpMethod.OPTIONS, "/**").permitAll()//allow CORS option calls
            .and()
            .addFilter(securityContextPersistenceFilter())
            .addFilterAfter(new RequestContextFilter(), SecurityContextPersistenceFilter.class)
            .addFilterAfter(new CrossFramePreventionFilter(), RequestContextFilter.class)
            .addFilterAfter(basicAuthFilter, CrossFramePreventionFilter.class)
            .addFilterAfter(preAuthenticationFilter(), BasicAuthFilter.class)
            .addFilterAfter(exceptionTranslationFilter(), PreAuthenticatedUserDetailsFilter.class);
    http.headers().contentSecurityPolicy(SecurityUtility.getContentSecurityPolicy());
}

当我尝试访问 /ping 端点时，它应该让我进入，但我却弹出了身份验证框，然后被拒绝了。我在日志中看到了这一点：

2020-05-26 09:56:39.881-0500 DEBUG APP=829 COMP=782 [https-jsse-nio-30062-exec- 
2:OrRequestMatcher:[]] -Trying to match using Ant [pattern='/actuator/health/**']
2020-05-26 09:56:39.881-0500 DEBUG APP=829 COMP=782 [https-jsse-nio-30062-exec- 
2:AntPathRequestMatcher:[]] -Checking match of request : '/ping'; against '/actuator/health/**'
2020-05-26 09:56:39.881-0500 DEBUG APP=829 COMP=782 [https-jsse-nio-30062-exec-2:OrRequestMatcher:[]] -Trying to match using Ant [pattern='/actuator/info/**']
2020-05-26 09:56:39.881-0500 DEBUG APP=829 COMP=782 [https-jsse-nio-30062-exec-2:AntPathRequestMatcher:[]] -Checking match of request : '/ping'; against '/actuator/info/**'
2020-05-26 09:56:39.881-0500 DEBUG APP=829 COMP=782 [https-jsse-nio-30062-exec-2:OrRequestMatcher:[]] -Trying to match using Ant [pattern='/actuator']
2020-05-26 09:56:39.881-0500 DEBUG APP=829 COMP=782 [https-jsse-nio-30062-exec-2:AntPathRequestMatcher:[]] -Checking match of request : '/ping'; against '/actuator'
2020-05-26 09:56:39.881-0500 DEBUG APP=829 COMP=782 [https-jsse-nio-30062-exec-2:OrRequestMatcher:[]] -Trying to match using Ant [pattern='/actuator/']
2020-05-26 09:56:39.881-0500 DEBUG APP=829 COMP=782 [https-jsse-nio-30062-exec-2:AntPathRequestMatcher:[]] -Checking match of request : '/ping'; against '/actuator/'
2020-05-26 09:56:39.881-0500 DEBUG APP=829 COMP=782 [https-jsse-nio-30062-exec-2:OrRequestMatcher:[]] -No matches found
2020-05-26 09:56:39.881-0500 DEBUG APP=829 COMP=782 [https-jsse-nio-30062-exec-2:AntPathRequestMatcher:[]] -Request '/ping' matched by universal pattern '/**'

其他需要身份验证的端点不允许我进入并给出 401/403 错误，抛出异常是帖子的标题。很明显，spring 没有使用我们的自定义逻辑。我们的代码都没有改变，只是依赖关系。我该如何超越这一点？

标签： javaspringspring-bootspring-security

解决方案

配置覆盖创建一个新的过滤器链，它优先于默认的 springSecurityFilterChain ，因此接受所有请求并拒绝一切。我将@Order(1) 添加到解决了问题的安全配置类中。

推荐阅读