下面是我的spring security XML配置整个代码。
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:oauth="http://www.springframework.org/schema/security/oauth2"
xmlns:sec="http://www.springframework.org/schema/security"
xsi:schemaLocation="http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans-4.2.xsd
http://www.springframework.org/schema/security
http://www.springframework.org/schema/security/spring-security-3.2.xsd
http://www.springframework.org/schema/security/oauth2
http://www.springframework.org/schema/security/spring-security-oauth2-1.0.xsd">
<!-- Definition of the Authentication Service
For Authenticating a User the Client application will send request to the URL "/oauth/token". This request will contain the clientId, client password, userName and user password details
-->
<http pattern="/oauth/token" create-session="stateless" authentication-manager-ref="clientAuthenticationManager"
xmlns="http://www.springframework.org/schema/security" >
<intercept-url pattern="/oauth/token" access="IS_AUTHENTICATED_FULLY"/>
<anonymous enabled="false"/>
<http-basic entry-point-ref="clientAuthenticationEntryPoint"/>
<!-- include this only if you need to authenticate clients via request parameters -->
<custom-filter ref="clientCredentialsTokenEndpointFilter" after="BASIC_AUTH_FILTER"/> <!-- http/http-basic -->
<access-denied-handler ref="oauthAccessDeniedHandler"/>
</http>
<http pattern="/**" entry-point-ref="oauthAuthenticationEntryPoint"
xmlns="http://www.springframework.org/schema/security" use-expressions="true" auto-config="true">
<anonymous enabled="false"/>
<custom-filter ref="specializedResourceServerFilter"
before="PRE_AUTH_FILTER" />
<access-denied-handler ref="oauthAccessDeniedHandler"/>
</http>
<bean id="oauthAuthenticationEntryPoint"
class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint"/>
<bean id="clientAuthenticationEntryPoint"
class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint">
<property name="realmName" value="client"/>
<property name="typeName" value="Basic"/>
</bean>
<bean id="oauthAccessDeniedHandler"
class="org.springframework.security.oauth2.provider.error.OAuth2AccessDeniedHandler"/>
<bean id="clientCredentialsTokenEndpointFilter"
class="org.springframework.security.oauth2.provider.client.ClientCredentialsTokenEndpointFilter">
<property name="authenticationManager" ref="clientAuthenticationManager"/>
</bean>
<bean id="oAuth2authenticationManager" class="org.springframework.security.oauth2.provider.authentication.OAuth2AuthenticationManager">
<property name="tokenServices" ref="tokenServices"/>
<property name="resourceId" value="myId"/>
</bean>
<bean id="specializedResourceServerFilter" class="com.my.backend.authentication.oauth2.OAuth2AuthenticationProcessingCustomFilter">
<property name="authenticationManager" ref="oAuth2authenticationManager"/>
</bean>
<bean id="customAuthenticationManager"
class="com.my.backend.read.rest.authentication.MyDBAuthenticationProvider"/>
<bean id="myJDBCAuthenticationProvider"
class="com.my.backend.authentication.MyJDBCAuthenticationProvider"/>
<!-- Authentication in config file -->
<authentication-manager id="clientAuthenticationManager" xmlns="http://www.springframework.org/schema/security">
<authentication-provider user-service-ref="clientDetailsUserService"/>
</authentication-manager>
<!-- authentication Manager called auto and their provider is called -->
<authentication-manager alias="authenticationManager" xmlns="http://www.springframework.org/schema/security">
<authentication-provider ref="customAuthenticationManager"/>
<authentication-provider ref="myJDBCAuthenticationProvider"/>
</authentication-manager>
<bean id="clientDetailsUserService"
class="org.springframework.security.oauth2.provider.client.ClientDetailsUserDetailsService">
<constructor-arg ref="clientDetails"/>
</bean>
<!-- Token Store -->
<bean id="tokenStore" class="org.springframework.security.oauth2.provider.token.store.JdbcTokenStore">
<constructor-arg ref="jdbcDataSource" />
</bean>
<bean id="jdbcDataSource"
class="org.springframework.jdbc.datasource.DriverManagerDataSource">
<property name="driverClassName" value="com.mysql.jdbc.Driver"/>
<property name="url" value="#{systemProperties['JDBC_CONNECTION_STRING']}/#{systemProperties['DATABASE']}?autoReconnect=true"/>
<property name="username" value="#{systemProperties['USER_NAME']}"/>
<property name="password" value="#{systemProperties['PASSWORD']}"/>
</bean>
<bean id="tokenServices" class="com.my.backend.authentication.oauth2.CustomTokenServices">
<property name="tokenStore" ref="tokenStore"/>
<property name="supportRefreshToken" value="true"/>
<property name="clientDetailsService" ref="clientDetails"/>
<!-- VIV -->
<property name="accessTokenValiditySeconds" value="7776000"/>
</bean>
<bean id="userApprovalHandler"
class="org.springframework.security.oauth2.provider.approval.TokenStoreUserApprovalHandler">
<property name="tokenStore" ref="tokenStore"/>
<property name="requestFactory" ref="oAuth2RequestFactory"/>
</bean>
<bean id="oAuth2RequestFactory"
class="org.springframework.security.oauth2.provider.request.DefaultOAuth2RequestFactory">
<constructor-arg ref="clientDetails"/>
</bean>
<!-- Token management -->
<oauth:authorization-server client-details-service-ref="clientDetails" token-services-ref="tokenServices"
user-approval-handler-ref="userApprovalHandler">
<oauth:implicit/>
<oauth:refresh-token/>
<oauth:client-credentials/>
<oauth:password/>
</oauth:authorization-server>
<oauth:resource-server id="resourceServerFilter"
token-services-ref="tokenServices"/>
<!-- Client Definition -->
<bean id="clientDetails"
class="com.my.backend.authentication.oauth2.JdbcClientDetailsService" >
<constructor-arg name="dataSource" ref="jdbcDataSource" />
</bean>
<sec:global-method-security pre-post-annotations="enabled" proxy-target-class="true">
<sec:expression-handler ref="oauthExpressionHandler"/>
</sec:global-method-security>
<oauth:expression-handler id="oauthExpressionHandler"/>
<oauth:web-expression-handler id="oauthWebExpressionHandler"/>
</beans>
当我按照这些访问决定点击受限制的URL时，选民参与了肯定访问决策经理的授权：
0 = {PreInvocationAuthorizationAdviceVoter@11611}
1 = {RoleVoter@11635}
2 = {AuthenticatedVoter@11639}
虽然我没有在上面的XML配置中设置任何访问决策管理器，但我认为它默认调用我不知道如何。无论如何我想添加分层访问决策选民，所以我创建了自己的访问决策管理器并在其中引用层次结构并在http元素中引用它：
<http pattern="/**" access-decision-manager-ref="*myAccessDecisionManager*" entry-point-ref="oauthAuthenticationEntryPoint"
xmlns="http://www.springframework.org/schema/security" use-expressions="true" auto-config="true">
<anonymous enabled="false"/>
<custom-filter ref="specializedResourceServerFilter"
before="PRE_AUTH_FILTER" />
<access-denied-handler ref="oauthAccessDeniedHandler"/>
</http>
它确实打电话但是之后那三个默认的访问决定选民也叫我不知道如何覆盖它。请帮忙......
编辑：
了解如何设置访问决策选民如下所述，现在我被困在HirarichalRoleVoter中，我已经提到了下面我想让客户在公共角色@PreAuthorize（＆＃34; harRole（＆＃34; harRole）时使用方法＃39; ROLE_PUBLIC＆＃39;）＆＃34 ;. 但它无法访问它。
<bean id="accessDecisionManager" class="org.springframework.security.access.vote.AffirmativeBased"
xmlns="http://www.springframework.org/schema/beans">
<constructor-arg>
<list>
<ref bean="roleVoter" />
<bean class="org.springframework.security.access.vote.AuthenticatedVoter"/>
</list>
</constructor-arg>
</bean>
<bean id="roleVoter" class="org.springframework.security.access.vote.RoleHierarchyVoter">
<constructor-arg ref="roleHierarchy" />
</bean>
<bean id="roleHierarchy"
class="org.springframework.security.access.hierarchicalroles.RoleHierarchyImpl">
<property name="hierarchy">
<value>
ROLE_CUSTOMER > ROLE_PUBLIC
</value>
</property>
</bean>
<sec:global-method-security pre-post-annotations="enabled" access-decision-manager-ref="accessDecisionManager" >
<sec:expression-handler ref="methodSecurityExpressionHandler"/>
</sec:global-method-security>
<bean id = "methodSecurityExpressionHandler"
class = "org.springframework.security.access.expression.method.DefaultMethodSecurityExpressionHandler">
<property name = "roleHierarchy" ref="roleHierarchy"/>
</bean>
答案 0 :(得分：1)
myAccessDecisionManager未显示，但我认为它扩展了org.springframework.security.access.vote.AffirmativeBased或其父AbstractAccessDecisionManager。如果是这样，那么您可以尝试使用decisionVoters这样的属性：
<bean id="accessDecisionManager" class="org.springframework.security.access.vote.AffirmativeBased">
<property name="decisionVoters">
<list>
<bean class="org.springframework.security.access.vote.RoleVoter"/>
<bean class="org.springframework.security.access.vote.AuthenticatedVoter"/>
</list>
</property>
</bean>
指定你喜欢的任何选民。
另一个选择是制作快捷方式并避免使用选民：只需在决策经理实施中硬编码您的决策逻辑。