带有 filterSecurityInterceptor 的 Spring FilterChainProxy 无法正常工作？

Question

我有一个带有如下配置文件的 spring 应用程序。所有配置似乎都是正确的，但在调试时我发现，在初始化期间，spring 为 FilterSecurityInterceptor 创建了两个 bean，一个没有任何拦截 url 规则，另一个使用我指定的规则。 当请求到来时，它使用没有拦截 URL 规则的 FilterSecurityInterceptor bean。所以我看到了以下日志：

DEBUG FilterSecurityInterceptor:183 - Public object - authentication not attempted

但请求 URL 属于拦截 URL 规则。我调试了一下发现这是因为使用的bean在httpMethodMap的DefaultFilterInvocationSecurityMetadataSource中没有任何拦截规则。 我不确定这里出了什么问题。

下面是applicationContext-security.xml：

<beans xmlns="http://www.springframework.org/schema/beans"
    xmlns:security="http://www.springframework.org/schema/security"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.2.xsd
                        http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.0.xsd"
    default-init-method="init">

    <security:authentication-manager alias="authenticationManager">
        <security:authentication-provider
            user-service-ref="userDetailService">
        </security:authentication-provider>
    </security:authentication-manager>

    <alias name="filterChainProxy" alias="springSecurityFilterChain" />

    <bean id="accessDecisionManager"
        class="org.springframework.security.access.vote.AffirmativeBased">
        <property name="decisionVoters">
            <list>
                <bean class="org.springframework.security.access.vote.RoleVoter" />
                <bean class="org.springframework.security.access.vote.AuthenticatedVoter" />
            </list>
        </property>
    </bean>

    <bean id="consoleAuthenticationSuccessHandler"
        class="custom_class">
        <property name="defaultTargetUrl" value="/loginSuccess.htm" />
        <property name="targetUrlParameter" value="targetURL" />
    </bean>

    <bean id="consoleAuthenticationFailureHandler"
        class="custom_class">
        <property name="loginFailureUrl" value="/loginFailure.htm" />
    </bean>

    <bean id="consoleLogoutSuccessHandler"
        class="custom_class">
        <property name="logoutUrl" value="/loggedout.htm" />
    </bean>

    <bean id="userDetailService"
        class="custom_class">
    </bean>

    <security:http auto-config="true"
        security-context-repository-ref="securityContextRepository">
        <security:form-login authentication-failure-url="/loginFailure.htm"
            default-target-url="/loginSuccess.htm"
            authentication-success-handler-ref="consoleAuthenticationSuccessHandler" />
        <security:logout success-handler-ref="consoleLogoutSuccessHandler" />
        <security:anonymous enabled="false" />
        <security:session-management
            session-fixation-protection="none" />
    </security:http>

    <bean id="filterChainProxy" class="org.springframework.security.web.FilterChainProxy">
        <security:filter-chain-map path-type="ant">
            <security:filter-chain pattern="/login.htm*"
                filters="none" />
            <security:filter-chain pattern="/**"
                filters="securityContextFilter, logoutFilter, formLoginFilter, servletApiFilter, exceptionTranslator, filterSecurityInterceptor" />
        </security:filter-chain-map>
    </bean>

    <bean id="securityContextRepository"
        class="org.springframework.security.web.context.HttpSessionSecurityContextRepository" />

    <bean id="securityContextFilter"
        class="org.springframework.security.web.context.SecurityContextPersistenceFilter">
        <property name="securityContextRepository" ref="securityContextRepository" />
    </bean>
    <bean id="logoutFilter"
        class="org.springframework.security.web.authentication.logout.LogoutFilter">
        <constructor-arg ref="consoleLogoutSuccessHandler"
            index="0"
            type="org.springframework.security.web.authentication.logout.LogoutSuccessHandler" />
        <constructor-arg>
            <list>
                <bean
                    class="org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler" />
            </list>
        </constructor-arg>
    </bean>

    <bean id="servletApiFilter"
        class="org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter" />

    <bean id="exceptionTranslator"
        class="org.springframework.security.web.access.ExceptionTranslationFilter">
        <property name="authenticationEntryPoint">
            <bean
                class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint">
                <property name="loginFormUrl" value="/login.jsp" />
            </bean>
        </property>
    </bean>

    <bean id="formLoginFilter"
        class="org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter">
        <property name="authenticationManager" ref="authenticationManager" />
        <property name="authenticationSuccessHandler" ref="consoleAuthenticationSuccessHandler" />
        <property name="authenticationFailureHandler" ref="consoleAuthenticationFailureHandler" />
    </bean>

    <bean id="filterSecurityInterceptor"
        class="org.springframework.security.web.access.intercept.FilterSecurityInterceptor">
        <property name="securityMetadataSource">
            <security:filter-security-metadata-source>
                <security:intercept-url pattern="/login.htm*"
                    access="ROLE_ANONYMOUS" />
                <security:intercept-url pattern="/**"
                    access="ROLE_USER,ROLE_ADMIN" />
            </security:filter-security-metadata-source>
        </property>
        <property name="accessDecisionManager" ref="accessDecisionManager" />
        <property name="authenticationManager" ref="authenticationManager" />
    </bean>

</beans>

在这里感谢任何帮助。

Answer 1

您在配置中有<security:http> 元素。来自文档：

38.1.2 <http>
每个<http> 命名空间块总是创建一个SecurityContextPersistenceFilter、一个ExceptionTranslationFilter 和一个FilterSecurityInterceptor。这些是固定的，不能用替代品代替。

所以你的<bean id="filterSecurityInterceptor"> 被忽略了。而不是

<bean id="filterSecurityInterceptor"
    class="org.springframework.security.web.access.intercept.FilterSecurityInterceptor">
    <property name="securityMetadataSource">
        <security:filter-security-metadata-source>
            <security:intercept-url pattern="/login.htm*"
                access="ROLE_ANONYMOUS" />
            <security:intercept-url pattern="/**"
                access="ROLE_USER,ROLE_ADMIN" />
        </security:filter-security-metadata-source>
    </property>
    <property name="accessDecisionManager" ref="accessDecisionManager" />
    <property name="authenticationManager" ref="authenticationManager" />
</bean>

您应该更改 <security:http> 以包含类似的内容

<security:http ...
        authentication-manager-ref="authenticationManager">
    ...
    <security:intercept-url pattern="/login.htm*"
        access="ROLE_ANONYMOUS" />
    <security:intercept-url pattern="/**"
        access="ROLE_USER,ROLE_ADMIN" />
</security:http>

您不需要<bean id="accessDecisionManager">，因为（引用docs）“默认情况下，AffirmativeBased 实现用于RoleVoter 和AuthenticatedVoter”，这正是您定义的.

您的<bean id="securityContextFilter"> 也会被忽略，而是应将security-context-repository-ref="securityContextRepository" 属性添加到http 元素。
并且您的<bean id="exceptionTranslator"> 被忽略，我不确定如何正确替换它。

你手动定义了很多org.springframework.security bean。我怀疑它们中的大多数要么是不必要的（默认定义），要么应该使用 security: 命名空间的特殊元素来定义，而不是原始 spring beans。