Spring安全性:不要求WSDL文档需要身份验证

Question

我已经创建了一个Axis Web服务作为在Tomcat 7上运行的Java 6应用程序.为了安全起见,Spring Security 2.0.1框架已经集成.

出于安全考虑,应使用基本身份验证来保护服务端点.但是,WSDL文档应该是公开的.

我创建了一个像这样的Spring安全配置:

<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security"
    xmlns:beans="http://www.springframework.org/schema/beans"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="
            http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.5.xsd
            http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-2.0.1.xsd">

    <http>
        <intercept-url pattern="/services/InitechAuthenticationService*" access="ROLE_WSUSER" />
        <intercept-url pattern="/services/InitechAuthenticationService?wsdl" filters="none" />
        <http-basic />
    </http>

    <authentication-provider>
        <user-service>
            <user name="internal" password="${WS_USER_INTERNAL_PASSWORD}" authorities="ROLE_WSUSER" />
            <user name="external" password="${WS_USER_EXTERNAL_PASSWORD}" authorities="ROLE_WSUSER" />
        </user-service>
    </authentication-provider>

</beans:beans>

问题是无论拦截线的顺序如何,线都是如此

<intercept-url pattern="/services/InitechAuthenticationService*" access="ROLE_WSUSER" />

似乎总是应用和行

<intercept-url pattern="/services/InitechAuthenticationService?wsdl" filters="none" />

被忽略了.我本以为可以通过某种方式控制行为,例如通过指定顺序(以便Spring Security选择第一个或最后一个匹配规则)或规则的特殊性,以便Spring Security选择最具体的规则,即在这种情况下,最后一个是"wsdl".如何排除WSDL文档的身份验证,同时启用身份验证以实际使用WS？

Answer 1

我通过更改配置的 http 部分以使用正则表达式而不是Ant Path Matcher解决了该问题。完整的工作配置在这里：

<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security"
    xmlns:beans="http://www.springframework.org/schema/beans"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="
            http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.5.xsd
            http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-2.0.1.xsd">

    <http path-type="regex">
        <intercept-url pattern="/services/InitechAuthenticationService*" access="ROLE_WSUSER" />
        <intercept-url pattern="/services/InitechAuthenticationService\\?wsdl" filters="none" />
        <http-basic />
    </http>

    <authentication-provider>
        <user-service>
            <user name="internal" password="${WS_USER_INTERNAL_PASSWORD}" authorities="ROLE_WSUSER" />
            <user name="external" password="${WS_USER_EXTERNAL_PASSWORD}" authorities="ROLE_WSUSER" />
        </user-service>
    </authentication-provider>

</beans:beans>

变化：

1. 向 http 添加了路径类型“regex”属性
2. 改变了？到 \\？在 wsdl 的拦截 URL 中