带有访问拒绝处理程序标记的 Spring 安全错误

Question

当我的应用处理 AccessDeniedException 时，我添加了 access-denied-handler 标记以重定向到特定页面，但出现错误：

配置问题：无法从相对导入 bean 定义 位置 [pgm-security-cas.xml] 违规资源：类路径 资源 [spring/pgm-servlet.xml]；嵌套异常是 org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException： 来自类路径资源的 XML 文档中的第 92 行 [spring/pgm-security-cas.xml] 无效；嵌套异常是 org.xml.sax.SAXParseException：cvc-complex-type.2.4.a：无效的内容 发现以元素“sec:access-denied-handler”开头。之一 '{"http://www.springframework.org/schema/security":intercept-url}' 是 预计。

这是我的 xml：

<bean id="fsi"
    class="org.springframework.security.web.access.intercept.FilterSecurityInterceptor">
    <property name="authenticationManager" ref="authenticationManager" />
    <property name="accessDecisionManager" ref="httpRequestAccessDecisionManager" />
    <property name="securityMetadataSource">
        <sec:filter-invocation-definition-source use-expressions="true">
            <sec:intercept-url pattern="/manageboxes" access="hasRole('A_READ_USER')" />
            <sec:access-denied-handler error-page="/accessDeniedPage" />
        </sec:filter-invocation-definition-source>
    </property>
</bean>

有人知道问题出在哪里吗？

filterChainProxy的定义是：

<bean id="springSecurityFilterChain" class="org.springframework.security.web.FilterChainProxy">
    <sec:filter-chain-map request-matcher="ant">
        <sec:filter-chain pattern="/xhtml/login/invalidLogin.xhtml*" filters="none" />
        <sec:filter-chain pattern="/j_spring_security_logout"
            filters="logoutFilter,fsi" />
        <sec:filter-chain pattern="/javax.faces.resource/*"
            filters="none" />
        <sec:filter-chain pattern="/**"
            filters="casAuthenticationFilter, casValidationFilter, wrappingFilter, sif, j2eePreAuthFilter, logoutFilter, fsi" />
    </sec:filter-chain-map>
</bean>

Answer 1

<access-denied-handler> 不能放在<filter-invocation-definition-source> 中。你必须创建一个exceptionTranslator：

<bean id="exceptionTranslator"            class="org.springframework.security.web.access.ExceptionTranslationFilter">
<property name="authenticationEntryPoint">
    <bean class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint"
            p:loginFormUrl="/login" />
</property>
<property name="accessDeniedHandler">
    <bean class="org.springframework.security.web.access.AccessDeniedHandlerImpl"
    p:errorPage="/accessDenied" />
</property>
</bean> 

并将其连接到您的filterChainProxy

<bean id="springSecurityFilterChain" class="org.springframework.security.web.FilterChainProxy">
    <sec:filter-chain-map request-matcher="ant">
        <sec:filter-chain pattern="/**"
            filters="casAuthenticationFilter, casValidationFilter, wrappingFilter, sif,      j2eePreAuthFilter, logoutFilter, 
            exceptionTranslator,
            fsi" />
        </sec:filter-chain-map>
</bean>