Question

我必须将方法发布为休息服务。我想在一种方法上应用基本授权安全性，以免＆＃34; gpnfeedback ＆＃34;。我不想对 sendgpn 申请任何授权我如何配置SecurityConfig.java？我使用了以下配置，但在调用 http://localhost:7071/gpns/rest/sendgpn

时仍然存在授权错误

控制器

@Controller
@RequestMapping("/gpns/rest/")
public class GpnsRestController {

   @CrossOrigin
   @RequestMapping(value = "/sendgpn", method = RequestMethod.POST, produces = MediaType.APPLICATION_JSON_VALUE, consumes = { MediaType.MULTIPART_FORM_DATA_VALUE, MediaType.APPLICATION_JSON_VALUE })
   public @ResponseBody
   GpnsResponse sendgpn(@Valid @RequestPart(value = "data", required = true) SendGpnMessageMsisdnListReq sendGpnMessageMsisdnListReq, @Valid @ModelAttribute(value = "photo") MultipartFile photo, @Valid @ModelAttribute(value = "video") MultipartFile video,
         @Valid @ModelAttribute(value = "videothumbnail") MultipartFile videothumbnail) {

   }

   @RequestMapping(method = RequestMethod.POST, value = "/gpnfeedback", consumes = MediaType.APPLICATION_JSON_VALUE, produces = MediaType.APPLICATION_JSON_VALUE)
   public @ResponseBody
   GpnsResponse gpnfeedback(HttpServletRequest http, @Valid @RequestBody GpnFeedbackReq gpnFeedbackReq) {
   }


}

安全性

@Configuration
@EnableWebSecurity(debug = true)
@EnableGlobalMethodSecurity(securedEnabled = true)
public class SecurityConfig extends WebSecurityConfigurerAdapter {


  public static final String ROLE_CLIENT = "CLIENT_USER";

  @Autowired
  private DatabaseAuthenticationProvider databaseAuthenticationProvider;

  @Autowired
  private GpnBasicAuthenticationEntryPoint basicAuthenticationEntryPoint;

   @Override
   public void configure(WebSecurity web) throws Exception {
   web.ignoring().antMatchers("/soap/lb/**");
   }

  @Override
  protected void configure(HttpSecurity http) throws Exception {

    http.csrf().disable();
    http.httpBasic().authenticationEntryPoint(this.basicAuthenticationEntryPoint);
    http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);


    // @formatter:off
    http.authorizeRequests()
      .antMatchers("/gpns/rest/gpnfeedback/**").hasRole(ROLE_CLIENT)           
      .anyRequest().authenticated().and().httpBasic();

    // @formatter:on
  }

  @Override
  protected void configure(AuthenticationManagerBuilder builder) throws Exception {

    //will be invoked in given order

    builder.authenticationProvider(this.databaseAuthenticationProvider);

  }

}

UPDATE-1： 我已经用下面的规则改变了规则。我可以在未经授权的情况下发送 http://localhost:7071/gpns/rest/sendgpn 方法，http://localhost:7071/gpns/rest/gpnfeedback不会被 databaseAuthenticationProvider

打包

http.authorizeRequests()
      .antMatchers("/gpns/rest/gpnfeedback/**").hasRole(ROLE_CLIENT)  
      .antMatchers("/gpns/rest/sendgpn/**").permitAll()          
      .anyRequest().authenticated().and().httpBasic();

Answer 1

我认为您的问题与您配置中的这一行有关：

.anyRequest().authenticated().and().httpBasic();

基本上，你在这里说的是每个请求（除了被忽略的）必须经过身份验证，但你不关心它有什么角色。请尝试使用这个：

.anyRequest().permitAll().and().httpBasic()

或者，如果您只想允许 sendgpn ，则可以使用此功能：

http.authorizeRequests()
      .antMatchers("/gpns/rest/gpnfeedback/**").hasRole(ROLE_CLIENT)  
      .antMatchers("/gpns/rest/sendgpn/**").permitAll()          
      .anyRequest().authenticated().and().httpBasic();

修改至于你的更新，我的猜测是你在某种程度上错误配置了所提供的数据，或者你的数据库中有不正确的数据。例如，如果ROLE_CLIENT的值为“CLIENT”，则Spring将期望DB中的值为“ROLE_CLIENT” - 它将“ROLE_”前缀添加到角色。

基于方法的Spring Boot授权

1 个答案: