Spring安全性hasPermission无效

Question

我试图在我的春季Web应用程序中集成Spring Security.基本上我需要根据用户权限隐藏一些菜单.这就是我做的.

我在classpath中添加了JARS.

spring-security-acl-4.0.2.RELEASE.jar
spring-security-config-4.0.2.RELEASE.jar
spring-security-core-4.0.2.RELEASE.jar
spring-security-taglibs-4.0.1.RELEASE.jar
spring-security-web-4.0.2.RELEASE.jar

以下是web.xml中的条目

<context-param>
    <param-name>log4jConfiguration</param-name>
    <param-value>/WEB-INF/web_log4j.xml</param-value>
</context-param>

<listener>
    <listener-class>org.apache.logging.log4j.web.Log4jServletContextListener</listener-class>
</listener>

<servlet>
    <servlet-name>dispatcher</servlet-name>
    <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
    <init-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>/WEB-INF/spring-root.xml</param-value>
    </init-param>
    <load-on-startup>1</load-on-startup>
</servlet>

我写了一个类CustomPermissionEvaluator,如下所示.

public class CustomPermissionEvaluator implements PermissionEvaluator{


@Override
public boolean hasPermission(Authentication authentication, Object targetDomainObject, Object permission) {
    HttpServletRequest request = (HttpServletRequest) targetDomainObject;
    Profile userProfile = (Profile) request.getSession().getAttribute("testprofile");
    if (userProfile.getPermissionMap().get(String.valueOf(permission)) != null) {
        return true;
    } else {
        return false;
    }
}

@Override
public boolean hasPermission(Authentication arg0, Serializable arg1,
        String arg2, Object arg3) {
    // TODO Auto-generated method stub
    return false;
}

}

在此之后我写了SecurityConfig文件.

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

@Override
public void configure(WebSecurity web) throws Exception {
    DefaultWebSecurityExpressionHandler handler = new DefaultWebSecurityExpressionHandler();
    handler.setPermissionEvaluator(new CustomPermissionEvaluator());
    web.expressionHandler(handler);
}

}

我在spring-root.xml中有以下条目

<sec:global-method-security pre-post-annotations="enabled">
    <sec:expression-handler ref="expressionHandler" />
</sec:global-method-security>
<bean id="expressionHandler"
    class="org.springframework.security.access.expression.method.DefaultMethodSecurityExpressionHandler">
    <property name="permissionEvaluator" ref="permissionEvaluator" />
</bean>
<bean id="permissionEvaluator" class="main.java.com.config.CustomPermissionEvaluator" />

现在在我的JSP文件中,我在taglib下面使用.

以下代码

<sec:authorize access="hasPermission('cadastra_categoria', #request)">      
                <div id="TEST">
                </div>
            </sec:authorize>

但它没有用.任何建议将不胜感激.

Answer 1

请尝试 hasAnyRole 并检查一次即

<sec:authorize access="hasAnyRole('ROLE_NAME')"> TEST </sec:authorize>