在 SPring Boot 2.1.1 中扩展 GlobalMethodSecurityConfiguration 时出现错误，指出“methodSecurityInterceptor”已被定义

Question

我正在覆盖GlobalMethodSecurityConfiguration该类，但只有一种方法：protected MethodSecurityExpressionHandler createExpressionHandler().

当我尝试运行该应用程序时，我得到：

描述：

无法注册在类路径资源 [org/springframework/security/config/annotation/method/configuration/GlobalMethodSecurityConfiguration.class] 中定义的 bean 'methodSecurityInterceptor'。具有该名称的 bean 已经在类路径资源 [com/testing/config/MyMethodSecurityConfig.class] 中定义并且覆盖被禁用。

行动：

考虑通过设置 spring.main.allow-bean-definition-overriding=true 重命名其中一个 bean 或启用覆盖

配置类

当我没有覆盖该基本方法时，为什么要这样做？如何在MethodSecurityExpressionHandler不出现此错误的情况下覆盖？

import com.testing.AadMethodSecurityExpressionHandler;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.access.expression.method.MethodSecurityExpressionHandler;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.method.configuration.GlobalMethodSecurityConfiguration;

@Configuration
@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
public class MyMethodSecurityConfig extends GlobalMethodSecurityConfiguration
{
    @Override
    protected MethodSecurityExpressionHandler createExpressionHandler()
    {
        return new MyMethodSecurityExpressionHandler();
    }
}

表达式处理程序

import org.aopalliance.intercept.MethodInvocation;
import org.springframework.security.access.expression.method.DefaultMethodSecurityExpressionHandler;
import org.springframework.security.access.expression.method.MethodSecurityExpressionOperations;
import org.springframework.security.core.Authentication;

public class MyMethodSecurityExpressionHandler extends DefaultMethodSecurityExpressionHandler
{
    @Override
    protected MethodSecurityExpressionOperations createSecurityExpressionRoot(Authentication authentication, MethodInvocation invocation)
    {
        MyMethodSecurityExpressionRoot root = new MyMethodSecurityExpressionRoot( authentication );
        root.setPermissionEvaluator( getPermissionEvaluator() );
        root.setTrustResolver( getTrustResolver() );
        root.setRoleHierarchy( getRoleHierarchy() );

        return root;
    }
}

表达式根

import org.springframework.security.access.expression.SecurityExpressionRoot;
import org.springframework.security.access.expression.method.MethodSecurityExpressionOperations;
import org.springframework.security.core.Authentication;

public class MyMethodSecurityExpressionRoot extends SecurityExpressionRoot implements MethodSecurityExpressionOperations
{
    private Object filterObject;
    private Object returnObject;
    private Object target;

    public MyMethodSecurityExpressionRoot(Authentication a)
    {
        super( a );
    }

    @Override
    public void setDefaultRolePrefix(String defaultRolePrefix)
    {
        //Simple test to see if this works
        super.setDefaultRolePrefix( "" );
    }

    public void setFilterObject(Object filterObject)
    {
        this.filterObject = filterObject;
    }

    public Object getFilterObject()
    {
        return filterObject;
    }

    public void setReturnObject(Object returnObject)
    {
        this.returnObject = returnObject;
    }

    public Object getReturnObject()
    {
        return returnObject;
    }

    void setThis(Object target)
    {
        this.target = target;
    }

    public Object getThis()
    {
        return target;
    }
}

Answer 1

对于为我解决此问题的任何人，解决方案是删除我在已设置的 WebSecurityConfigurer 上配置的重复 @EnableGlobalMethodSecurity 注释。