Spring Security:如何排除某些资源？

Question

我有以下定义......

    <bean id="fsi" class="org.springframework.security.intercept.web.FilterSecurityInterceptor">
    <property name="authenticationManager" ref="authenticationManager"/>
    <property name="accessDecisionManager" ref="httpRequestAccessDecisionManager"/>
    <property name="objectDefinitionSource">
      <sec:filter-invocation-definition-source >
            <sec:intercept-url pattern="/secure/css/**"        access="ROLE_TIER0"/>
            <sec:intercept-url pattern="/secure/images/**"     access="ROLE_TIER0"/>
            <sec:intercept-url pattern="/**"                   access="ROLE_TIER0"/>
      </sec:filter-invocation-definition-source>
    </property>
    </bean>

我想拥有这个网址的资源......

"/不安全/**"

打开所有呼叫,即没有安全性.

我试过添加......

<sec:intercept-url pattern="/nonsecure/**" access="permitAll" />

但这会导致Websphere抛出错误

Unsupported configuration attributes: [permitAll] 

谁能告诉我如何从安全性中排除这个URL？

Answer 1

在spring security 3.1.x中,不推荐使用filters ="none".相反,你使用这样的多个<http>标签:

<http pattern="/nonsecure/**" security="none"/>

http://static.springsource.org/spring-security/site/docs/3.1.x/reference/springsecurity-single.html#ns-form-and-basic

Answer 2

我认为你必须在安全xml中为use-expressions你的http配置添加标签,例如:

<http auto-config="true" use-expressions="true">
...
...
</http>

编辑:嗯,我不知道你正在使用什么版本的弹簧安全.我知道这适用于3.0,但对于旧版本,我不确定.

Answer 3

<security:http auto-config='true'>
    <security:intercept-url pattern="/getfeed/**" access="IS_AUTHENTICATED_ANONYMOUSLY"/>
    <security:intercept-url pattern="/**" access="ROLE_USER, ROLE_ADMIN" />
    <security:http-basic />
</security:http>

access =" IS_AUTHENTICATED_ANONYMOUSLY "是解决方案.我在以下链接中找到了它:http://syntx.io/adding-http-basic-auth-to-restful-services-in-java-and-spring/

截距自上而下评估.如果你在/ getIntelFeed/**之前写这个/**,那么所有服务都将通过/**并且安全性将应用于所有服务.在这种情况下/ getIntelFeed/**将无效.

Answer 4

尝试:

<sec:intercept-url pattern="/nonsecure/**" filters="none" />