为什么我的自定义PermissionEvaluator没有被调用？

Question

我正在努力使用我的Spring Security配置,到目前为止我无法使其工作.我不知道为什么我的自定义PermissionEvaluator没有被调用,我的@PreAuthorize注释使用hasPermission表达式被忽略.

我正在使用Spring 4.2.4和Spring security 4.1.0

她是我的代码:

网络安全配置

@Configuration
@EnableWebSecurity
public class MyWebSecurityConfig extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http //
                .addFilterBefore(wafflePreAuthFilter(), AbstractPreAuthenticatedProcessingFilter.class) //
                .authenticationProvider(preauthAuthProvider()) //
                .csrf().disable() //
                .authorizeRequests() //
                .antMatchers("/ui/**").authenticated() //
                .anyRequest().permitAll();
    }

    @Bean
    public WafflePreAuthFilter wafflePreAuthFilter() throws Exception {
        WafflePreAuthFilter filter = new WafflePreAuthFilter();
        filter.setAuthenticationManager(authenticationManager());
        return filter;
    }

    @Bean
    public PreAuthenticatedAuthenticationProvider preauthAuthProvider() {
        PreAuthenticatedAuthenticationProvider preauthAuthProvider = new PreAuthenticatedAuthenticationProvider();
        preauthAuthProvider.setPreAuthenticatedUserDetailsService(userDetailsServiceWrapper());
        return preauthAuthProvider;
    }

    @Bean
    public UserDetailsByNameServiceWrapper<PreAuthenticatedAuthenticationToken> userDetailsServiceWrapper() {
        UserDetailsByNameServiceWrapper<PreAuthenticatedAuthenticationToken> wrapper = new UserDetailsByNameServiceWrapper<PreAuthenticatedAuthenticationToken>();
        wrapper.setUserDetailsService(myUserDetailsService());
        return wrapper;
    }

    @Bean
    public UserDetailsService myUserDetailsService() {
        return new myUserDetailsService();
    }
}

方法安全配置

@Configuration
@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true, proxyTargetClass = true)
public class MyServiceMethodSecurityConfig extends GlobalMethodSecurityConfiguration {
    @Bean
    public PermissionEvaluator myPermissionEvaluator() {
        return new DcePermissionEvaluator();
    }

    @Override
    public MethodSecurityExpressionHandler createExpressionHandler() {
        DefaultMethodSecurityExpressionHandler expressionHandler = new DefaultMethodSecurityExpressionHandler();
        expressionHandler.setPermissionEvaluator(myPermissionEvaluator());
        return expressionHandler;
    }
}

PermissionEvaluator

public class MyPermissionEvaluator implements PermissionEvaluator {
    @Autowired
    private MyService myAutowiredService;

    @Override
    public boolean hasPermission(Authentication authentication, Object targetDomainObject, Object permission) {
        // checking permissions
        return true;
    }

    @Override
    public boolean hasPermission(Authentication authentication, Serializable targetId, String targetType, Object permission) {
        // checking permissions
        return true;
    }
}

任何人都可以给我一个暗示该做什么的提示？

顺便说一句,如果我将MyServiceMethodSecurityConfig更改为this,则会处理myPermissionEvaluator,但依赖注入不起作用,因为它不受Spring管理:

@Configuration
@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true, proxyTargetClass = false)
public class MyServiceMethodSecurityConfig extends GlobalMethodSecurityConfiguration {

    @Override
    public MethodSecurityExpressionHandler createExpressionHandler() {
        DefaultMethodSecurityExpressionHandler expressionHandler = new DefaultMethodSecurityExpressionHandler();
        expressionHandler.setPermissionEvaluator(new DcePermissionEvaluator());
        return expressionHandler;
    }
}

Answer 1

我遇到了这个问题.它似乎是由多个地方指定的注释@EnableGlobalMethodSecurity引起的.

一旦我从上面的位置删除它,我的GlobalMethodSecurityConfiguration实现开始按预期工作.