Spring 安全认证管理器无法解析的循环引用

Question

我正在使用 Spring Security 3.2.5。我有 2 个身份验证提供程序。 我遇到了无法解决的循环引用的问题。 第一个security.xml：

<security:http use-expressions="true" auto-config="false"
    entry-point-ref="loginUrlAuthenticationEntryPoint">
    <security:intercept-url pattern="/**" access="permitAll"
        method="OPTIONS" />
        <security:intercept-url pattern="/user/login"
        access="permitAll" />
    <security:intercept-url pattern="/**"
    access="isAuthenticated()" />

<security:custom-filter position="FORM_LOGIN_FILTER"
    ref="twoFactorAuthenticationFilter" />


<security:logout logout-url="/user/logout"
    logout-success-url="/demo/user/logoutSuccess" />

<security:session-management
    session-authentication-strategy-ref="sas" />

</security:http>

<bean id="sas"
    class="org.springframework.security.web.authentication.session.SessionFixationProtectionStrategy">
    <property name="migrateSessionAttributes" value="false" />
</bean>

<bean id="sessionRegistry"
    class="org.springframework.security.core.session.SessionRegistryImpl" />

<bean id="loginUrlAuthenticationEntryPoint"
    class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint">
    <property name="loginFormUrl" value="/demo/user/login" />
</bean>

<bean id="twoFactorAuthenticationFilter" class="com.xxx.filter.TwoFactorAuthenticationFilter">
    <property name="authenticationManager" ref="authenticationManager" />
    <property name="authenticationFailureHandler" ref="failureHandler" />
    <property name="authenticationSuccessHandler" ref="userAuthenticationSuccessHandler" />
    <property name="postOnly" value="true" />
</bean>


<bean id="failureHandler"
    class="org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler">
    <property name="defaultFailureUrl" value="/login?login_error=true" />

</bean>

<bean id="bCryptPasswordEncoder"
    class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder" />

<security:authentication-manager alias="authenticationManager">
    <security:authentication-provider
        ref="authenticationProvider">
    </security:authentication-provider>
    <security:authentication-provider
        ref="restAuthenticationProvider">
    </security:authentication-provider>
</security:authentication-manager>

rest-security-context.xml：

<security:http create-session="stateless"
        entry-point-ref="digestEntryPoint" pattern="/provider/**"
        use-expressions="true">
        <security:intercept-url pattern="/provider/**"
            access="isAuthenticated()" />


        <security:http-basic />
        <security:custom-filter ref="digestFilter"
            after="BASIC_AUTH_FILTER" />
    </security:http>

    <bean id="digestFilter"
        class="org.springframework.security.web.authentication.www.DigestAuthenticationFilter">
        <property name="userDetailsService" ref="customerDetailsServiceImpl" />
        <property name="authenticationEntryPoint" ref="digestEntryPoint" />
    </bean>

    <bean id="digestEntryPoint"
        class="org.springframework.security.web.authentication.www.DigestAuthenticationEntryPoint">
        <property name="realmName" value="Contacts Realm via Digest Authentication" />
        <property name="key" value="acegi" />
    </bean>

在application.xml中的顺序是：

<import resource="/rest-security-context.xml" />
<import resource="/security.xml" />

我收到此错误：

 org.springframework.beans.factory.BeanCurrentlyInCreationException: Error creating bean with name 'org.springframework.security.authenticationManager': Requested bean is currently in creation: Is there an unresolvable circular reference?

如果我在应用程序上下文中更改顺序，我会收到此错误：

A universal match pattern ('/**') is defined  before other patterns in the filter chain, causing them to be ignored.

Answer 1

更改文件的顺序，现在我看到了第二个错误的问题：

你有：

// Below url says, all urls must be permitted for everyone
 <security:intercept-url pattern="/**" access="permitAll"
        method="OPTIONS" />
        <security:intercept-url pattern="/user/login"
        access="permitAll" />
// Below line says, all URLS must be authenticated, how is that possible without reaching authentication page. remove below
    <security:intercept-url pattern="/**"
    access="isAuthenticated()" />

所以它应该看起来像：

// I wouldnt recomment the below URL to permit /** for all, not good. 
    <security:intercept-url pattern="/**" access="permitAll"
            method="OPTIONS" />
            <security:intercept-url pattern="/user/login"
            access="permitAll" /> 

这是我的猜测。试试看。让我知道它是否有效，或者我删除我的答案。