当oraclepki,osdt_cert和osdt_core在类路径上时,从Jav 6升级到Java 8后无法登录到Web应用程序

Question

在从Java 1.6升级到Java 1.8之前,我们能够登录Web应用程序.升级后,我们无法登录其中一个Web应用程序,但我可以登录到另一个.他们使用相同的Spring-Security,OJDBC和Hibernate版本.

但是,如果我们从类路径中删除了以下jar,只要您不需要使用钱包登录,登录就会再次起作用:

• com.oracle:oraclepki(12.1.0.2.0)
• com.oracle:osdt_cert(12.1.0.2.0)
• com.oracle:osdt_core(12.1.0.2.0)

在上层环境中删除它们不是一种选择,因为我们使用oracle钱包登录.

版本:

• OJDBC6 12.1.0.2.0
• SPRINGFRAMEWORK 3.0.7.RELEASE

调试日志

当我将日志级别设置为DEBUG时,我看到登录被拒绝作为anonomys用户,但在loggs之前它成功验证了登录名/密码.

认证成功:

DEBUG [org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter][http-bio-8080-exec-10] - Authentication success. Updating SecurityContextHolder to contain: org.springframework.security.authentication.UsernamePasswordAuthenticationToken@85ca488a: Principal: org.springframework.security.core.userdetails.User@f75cc3bd: Username: admin; Password: [PROTECTED]; Enabled: true; AccountNonExpired: true; credentialsNonExpired: true; AccountNonLocked: true; Granted Authorities: ADMIN,READ_ONLY; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@2cd90: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: 383A7E52904236DDEA18E00864C0B94C; Granted Authorities: ADMIN, READ_ONLY
DEBUG [org.springframework.security.web.context.HttpSessionSecurityContextRepository][http-bio-8080-exec-10] - SecurityContext stored to HttpSession: 'org.springframework.security.core.context.SecurityContextImpl@85ca488a: Authentication: org.springframework.security.authentication.UsernamePasswordAuthenticationToken@85ca488a: Principal: org.springframework.security.core.userdetails.User@f75cc3bd: Username: admin; Password: [PROTECTED]; Enabled: true; AccountNonExpired: true; credentialsNonExpired: true; AccountNonLocked: true; Granted Authorities: ADMIN,READ_ONLY; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@2cd90: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: 383A7E52904236DDEA18E00864C0B94C; Granted Authorities: ADMIN, READ_ONLY'

然后拒绝访问:

DEBUG [org.springframework.security.access.vote.AffirmativeBased][http-bio-8080-exec-5] - Voter: org.springframework.security.web.access.expression.WebExpressionVoter@259af14a, returned: -1
DEBUG [org.springframework.security.web.access.ExceptionTranslationFilter][http-bio-8080-exec-5] - Access is denied (user is anonymous); redirecting to authentication entry point

完整堆栈跟踪:

DEBUG [org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter][http-bio-8080-exec-10] - Authentication success. Updating SecurityContextHolder to contain: org.springframework.security.authentication.UsernamePasswordAuthenticationToken@85ca488a: Principal: org.springframework.security.core.userdetails.User@f75cc3bd: Username: admin; Password: [PROTECTED]; Enabled: true; AccountNonExpired: true; credentialsNonExpired: true; AccountNonLocked: true; Granted Authorities: ADMIN,READ_ONLY; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@2cd90: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: 383A7E52904236DDEA18E00864C0B94C; Granted Authorities: ADMIN, READ_ONLY
DEBUG [org.springframework.security.web.context.HttpSessionSecurityContextRepository][http-bio-8080-exec-10] - SecurityContext stored to HttpSession: 'org.springframework.security.core.context.SecurityContextImpl@85ca488a: Authentication: org.springframework.security.authentication.UsernamePasswordAuthenticationToken@85ca488a: Principal: org.springframework.security.core.userdetails.User@f75cc3bd: Username: admin; Password: [PROTECTED]; Enabled: true; AccountNonExpired: true; credentialsNonExpired: true; AccountNonLocked: true; Granted Authorities: ADMIN,READ_ONLY; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@2cd90: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: 383A7E52904236DDEA18E00864C0B94C; Granted Authorities: ADMIN, READ_ONLY'
DEBUG [org.springframework.security.web.context.SecurityContextPersistenceFilter][http-bio-8080-exec-10] - SecurityContextHolder now cleared, as request processing completed
DEBUG [org.springframework.security.web.context.HttpSessionSecurityContextRepository][http-bio-8080-exec-8] - No HttpSession currently exists
DEBUG [org.springframework.security.web.context.HttpSessionSecurityContextRepository][http-bio-8080-exec-8] - No SecurityContext was available from the HttpSession: null. A new one will be created.
DEBUG [org.springframework.security.web.authentication.AnonymousAuthenticationFilter][http-bio-8080-exec-8] - Populated SecurityContextHolder with anonymous token: 'org.springframework.security.authentication.AnonymousAuthenticationToken@9055c2bc: Principal: anonymousUser; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@b364: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: null; Granted Authorities: ROLE_ANONYMOUS'
DEBUG [org.springframework.security.web.access.intercept.FilterSecurityInterceptor][http-bio-8080-exec-5] - Secure object: FilterInvocation: URL: /canary/dashboard.action; Attributes: [hasAnyRole('READ_ONLY','READ_ONLY2','STATISTICS','ADMIN')]
DEBUG [org.springframework.security.web.access.intercept.FilterSecurityInterceptor][http-bio-8080-exec-5] - Previously Authenticated: org.springframework.security.authentication.AnonymousAuthenticationToken@9055c2bc: Principal: anonymousUser; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@b364: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: null; Granted Authorities: ROLE_ANONYMOUS
DEBUG [org.springframework.security.access.vote.AffirmativeBased][http-bio-8080-exec-5] - Voter: org.springframework.security.web.access.expression.WebExpressionVoter@259af14a, returned: -1
DEBUG [org.springframework.security.web.access.ExceptionTranslationFilter][http-bio-8080-exec-5] - Access is denied (user is anonymous); redirecting to authentication entry point
org.springframework.security.access.AccessDeniedException: Access is denied
    at org.springframework.security.access.vote.AffirmativeBased.decide(AffirmativeBased.java:71)
    at org.springframework.security.access.intercept.AbstractSecurityInterceptor.beforeInvocation(AbstractSecurityInterceptor.java:204)
    at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.invoke(FilterSecurityInterceptor.java:106)
    at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.doFilter(FilterSecurityInterceptor.java:83)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:381)
    at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:97)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:381)
    at org.springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.java:100)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:381)
    at org.springframework.security.web.authentication.AnonymousAuthenticationFilter.doFilter(AnonymousAuthenticationFilter.java:78)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:381)
    at org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter.doFilter(SecurityContextHolderAwareRequestFilter.java:54)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:381)
    at org.springframework.security.web.savedrequest.RequestCacheAwareFilter.doFilter(RequestCacheAwareFilter.java:35)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:381)
    at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:187)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:381)
    at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:105)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:381)
    at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:79)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:381)
    at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:168)
    at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:237)
    at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:167)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
    at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:220)
    at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:122)
    at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:505)
    at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:169)
    at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103)
    at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:956)
    at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116)
    at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:436)
    at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1078)
    at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:625)
    at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:318)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
    at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
    at java.lang.Thread.run(Thread.java:748)

安全背景:

<security:authentication-manager alias="authenticationManager">
    <security:authentication-provider user-service-ref="userDetailsService"/>
    <security:authentication-provider ref="ldapProvider"/>
</security:authentication-manager>

<bean id="userDetailsService" class="*******.CustomUserDetailsService">
    <property name="userDetailsService" ref="userDetailsService"/>
    <property name="dataSource" ref="dataSource"/>
    <property name="annotatedSessionFactory" ref="sessionFactory"></property>
</bean>

<bean id="ldapProvider" class="org.springframework.security.ldap.authentication.LdapAuthenticationProvider">
    <constructor-arg ref="authenticator"/>
    <constructor-arg ref="ldapAuthPopulator"/>
</bean>

Answer 1

Spring 3.x与java 8不兼容，最好升级到4.x。

鉴于您面临 java 升级问题（例如，您这边没有更改代码），这只是确认存在版本不兼容。

取决于你定制拦截器的程度，它可能是中等的努力，或者根本不需要努力（我记得在 xml 配置中声明匿名资源时，从 spring 3.0.x 到 3.1.x 存在微小的向后兼容性中断，但是所有 java 接口都保持向后兼容）