Spring MVC 自定义身份验证问题答案

【问题标题】：Spring MVC Custom Authentication IssueSpring MVC 自定义身份验证问题
【发布时间】：2015-03-10 10:49:35
【问题描述】：

我的应用程序在尝试登录时产生 404 错误页面（找不到资源）。我已经正确设置了所有身份验证类。它转发到的链接是：http://localhost:23121/IssueTracking/j_spring_security_check

下面是我的代码：

login.jsp

<form action='<c:url value="/j_spring_security_check"/>' method='post'>
    <fieldset>   
        <input name="j_username" id="j_username"  type="text" class="span12" placeholder="Username" />
        <input  name="j_password" id="j_password" type="password" class="span12" placeholder="Password" />
        <button type="submit" class="width-35 pull-right btn btn-small btn-primary">Login</button>
    </fieldset>
</form>

web.xml

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" version="3.1" xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd">
   <context-param>
      <param-name>contextConfigLocation</param-name>
      <param-value>/WEB-INF/applicationContext.xml</param-value>
   </context-param>
   <listener>
      <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
   </listener>
   <servlet>
      <servlet-name>dispatcher</servlet-name>
      <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
      <load-on-startup>1</load-on-startup>
   </servlet>
   <servlet-mapping>
      <servlet-name>dispatcher</servlet-name>
      <url-pattern>/</url-pattern>
   </servlet-mapping>
   <session-config>
      <session-timeout>30</session-timeout>
   </session-config>
   <!-- Spring Security -->
   <filter>
      <filter-name>springSecurityFilterChain</filter-name>
      <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
   </filter>
   <filter-mapping>
      <filter-name>springSecurityFilterChain</filter-name>
      <url-pattern>/*</url-pattern>
   </filter-mapping>
   <listener>
      <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
   </listener>
   <context-param>
      <param-name>contextConfigLocation</param-name>
      <param-value>/WEB-INF/issuetracking-security.xml</param-value>
   </context-param>
</web-app>

issuetracking-security.xml（安全 xml 配置文件）

<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security"
    xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns:c="http://www.springframework.org/schema/c" xmlns:context="http://www.springframework.org/schema/context"
    xmlns:jdbc="http://www.springframework.org/schema/jdbc" xmlns:mvc="http://www.springframework.org/schema/mvc"
    xmlns:p="http://www.springframework.org/schema/p" xmlns:util="http://www.springframework.org/schema/util"
    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
    http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.1.xsd
        http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.2.xsd
        http://www.springframework.org/schema/jdbc http://www.springframework.org/schema/jdbc/spring-jdbc-3.2.xsd
        http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc-3.2.xsd
        http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util-3.2.xsd">
    <http auto-config="true" use-expressions="true">
        <form-login login-page="/login.jsp"
            always-use-default-target="true" authentication-failure-url="/login.jsp?error=true"
             authentication-success-handler-ref="customAuthenticationSuccessHandler" 
            default-target-url="/" />

        <intercept-url pattern="/*" access="permitAll" />
        <intercept-url pattern="/myTickets" access="hasAnyRole('ROLE_USER')" />
                <intercept-url pattern="/ticketList" access="hasAnyRole('ROLE_ADMIN')" />
        <logout invalidate-session="true" logout-success-url="/index.jsp" />
    </http>
    <authentication-manager>
        <authentication-provider user-service-ref="loginService"/>
    </authentication-manager>
    <beans:bean id="customAuthenticationSuccessHandler" 
         class="net.fluidinnovations.security.CustomAuthenticationSessionHandler">
        <beans:property name="roleUrlMap">
            <beans:map>
                <beans:entry key="ROLE_USER" value="/myTickets"/>
                <beans:entry key="ROLE_ADMIN" value="/ticketList"/>
            </beans:map>
        </beans:property>
    </beans:bean>

</beans:beans>

【问题讨论】：

我在您的代码中添加了语言标签，以便正确着色。如果您可以发布您的 CustomAuthenticationSessionHandler 实现，那将会很有帮助。我们需要确切地知道您的应用程序是如何工作的，以尝试和调试任何东西。您说您已正确设置了身份验证类，但您可能遗漏了一些微妙的东西，如果我们看不到它，我们将无法修复它。

标签： java spring spring-mvc

【解决方案1】：

您有两个ContextLoaderListener 声明，删除底部的一个

<listener>
    <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>
<context-param>
    <param-name>contextConfigLocation</param-name>
    <param-value>/WEB-INF/issuetracking-security.xml</param-value>
</context-param>

并将顶部的更改为;

<context-param>
    <param-name>contextConfigLocation</param-name>
    <param-value>/WEB-INF/applicationContext.xml, /WEB-INF/issuetracking-security.xml</param-value>
</context-param>
<listener>
     <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>

我没有看到您的DispatcherServlet 的contextConfigLocation，所以我假设您在applicationContext.xml 中创建了与Web MVC 相关的bean。但如果你不这样做，你需要设置它。

【讨论】：