Spring FilterChainProxy与filterSecurityInterceptor无法正常工作？

Question

我有一个带有配置文件的spring应用程序,如下所示.所有的配置似乎都是正确的,但在调试时我发现,在初始化期间,spring为FilterSecurityInterceptor创建了两个bean,没有任何拦截 - url规则,另一个有我指定的规则. 当请求到来时,它使用FilterSecurityInterceptor bean而没有intercept-url规则.所以我看到以下日志:

DEBUG FilterSecurityInterceptor:183 - Public object - authentication not attempted

但请求URL属于拦截URL规则.我调试,发现这是因为所使用的豆没有任何拦截规则httpMethodMap的DefaultFilterInvocationSecurityMetadataSource.我不确定这里有什么问题.

以下是applicationContext-security.xml:

<beans xmlns="http://www.springframework.org/schema/beans"
    xmlns:security="http://www.springframework.org/schema/security"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.2.xsd
                        http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.0.xsd"
    default-init-method="init">

    <security:authentication-manager alias="authenticationManager">
        <security:authentication-provider
            user-service-ref="userDetailService">
        </security:authentication-provider>
    </security:authentication-manager>

    <alias name="filterChainProxy" alias="springSecurityFilterChain" />

    <bean id="accessDecisionManager"
        class="org.springframework.security.access.vote.AffirmativeBased">
        <property name="decisionVoters">
            <list>
                <bean class="org.springframework.security.access.vote.RoleVoter" />
                <bean class="org.springframework.security.access.vote.AuthenticatedVoter" />
            </list>
        </property>
    </bean>

    <bean id="consoleAuthenticationSuccessHandler"
        class="custom_class">
        <property name="defaultTargetUrl" value="/loginSuccess.htm" />
        <property name="targetUrlParameter" value="targetURL" />
    </bean>

    <bean id="consoleAuthenticationFailureHandler"
        class="custom_class">
        <property name="loginFailureUrl" value="/loginFailure.htm" />
    </bean>

    <bean id="consoleLogoutSuccessHandler"
        class="custom_class">
        <property name="logoutUrl" value="/loggedout.htm" />
    </bean>

    <bean id="userDetailService"
        class="custom_class">
    </bean>

    <security:http auto-config="true"
        security-context-repository-ref="securityContextRepository">
        <security:form-login authentication-failure-url="/loginFailure.htm"
            default-target-url="/loginSuccess.htm"
            authentication-success-handler-ref="consoleAuthenticationSuccessHandler" />
        <security:logout success-handler-ref="consoleLogoutSuccessHandler" />
        <security:anonymous enabled="false" />
        <security:session-management
            session-fixation-protection="none" />
    </security:http>

    <bean id="filterChainProxy" class="org.springframework.security.web.FilterChainProxy">
        <security:filter-chain-map path-type="ant">
            <security:filter-chain pattern="/login.htm*"
                filters="none" />
            <security:filter-chain pattern="/**"
                filters="securityContextFilter, logoutFilter, formLoginFilter, servletApiFilter, exceptionTranslator, filterSecurityInterceptor" />
        </security:filter-chain-map>
    </bean>

    <bean id="securityContextRepository"
        class="org.springframework.security.web.context.HttpSessionSecurityContextRepository" />

    <bean id="securityContextFilter"
        class="org.springframework.security.web.context.SecurityContextPersistenceFilter">
        <property name="securityContextRepository" ref="securityContextRepository" />
    </bean>
    <bean id="logoutFilter"
        class="org.springframework.security.web.authentication.logout.LogoutFilter">
        <constructor-arg ref="consoleLogoutSuccessHandler"
            index="0"
            type="org.springframework.security.web.authentication.logout.LogoutSuccessHandler" />
        <constructor-arg>
            <list>
                <bean
                    class="org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler" />
            </list>
        </constructor-arg>
    </bean>

    <bean id="servletApiFilter"
        class="org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter" />

    <bean id="exceptionTranslator"
        class="org.springframework.security.web.access.ExceptionTranslationFilter">
        <property name="authenticationEntryPoint">
            <bean
                class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint">
                <property name="loginFormUrl" value="/login.jsp" />
            </bean>
        </property>
    </bean>

    <bean id="formLoginFilter"
        class="org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter">
        <property name="authenticationManager" ref="authenticationManager" />
        <property name="authenticationSuccessHandler" ref="consoleAuthenticationSuccessHandler" />
        <property name="authenticationFailureHandler" ref="consoleAuthenticationFailureHandler" />
    </bean>

    <bean id="filterSecurityInterceptor"
        class="org.springframework.security.web.access.intercept.FilterSecurityInterceptor">
        <property name="securityMetadataSource">
            <security:filter-security-metadata-source>
                <security:intercept-url pattern="/login.htm*"
                    access="ROLE_ANONYMOUS" />
                <security:intercept-url pattern="/**"
                    access="ROLE_USER,ROLE_ADMIN" />
            </security:filter-security-metadata-source>
        </property>
        <property name="accessDecisionManager" ref="accessDecisionManager" />
        <property name="authenticationManager" ref="authenticationManager" />
    </bean>

</beans>

感谢这里的任何帮助.

Answer 1

你<security:http>在配置中有元素.从文档:

38.1.2 <http>
每个<http>命名空间块总是创建一个SecurityContextPersistenceFilter,一个ExceptionTranslationFilter和一个FilterSecurityInterceptor.这些是固定的,不能替代替代品.

所以你<bean id="filterSecurityInterceptor">被忽略了.代替

<bean id="filterSecurityInterceptor"
    class="org.springframework.security.web.access.intercept.FilterSecurityInterceptor">
    <property name="securityMetadataSource">
        <security:filter-security-metadata-source>
            <security:intercept-url pattern="/login.htm*"
                access="ROLE_ANONYMOUS" />
            <security:intercept-url pattern="/**"
                access="ROLE_USER,ROLE_ADMIN" />
        </security:filter-security-metadata-source>
    </property>
    <property name="accessDecisionManager" ref="accessDecisionManager" />
    <property name="authenticationManager" ref="authenticationManager" />
</bean>

你应该改变<security:http>以包括类似的东西

<security:http ...
        authentication-manager-ref="authenticationManager">
    ...
    <security:intercept-url pattern="/login.htm*"
        access="ROLE_ANONYMOUS" />
    <security:intercept-url pattern="/**"
        access="ROLE_USER,ROLE_ADMIN" />
</security:http>

你不需要<bean id="accessDecisionManager">,因为(引用文档)"默认情况下,一个AffirmativeBased实现用于a RoleVoter和a AuthenticatedVoter",这正是你定义的.

此外,您将<bean id="securityContextFilter">被忽略,而应将security-context-repository-ref="securityContextRepository"属性添加到http元素.
你<bean id="exceptionTranslator">被忽略了,我不知道如何正确地更换它.

并且您手动定义了很多org.springframework.securitybean.我怀疑它们中的大部分都是不必要的(默认定义),或者应该使用security:命名空间的专用元素而不是raw spring 来定义bean.