Question

我正在尝试创建一个自定义过滤器来处理身份验证，因为我不得不使用AD和本地数据库（arg！）的组合来确定访问权限。我正在使用官方文档，因为这个特定问题主要是this part。

然而，当我运行我的服务器时，它抱怨AuthenticationManager为null，而我相信我将其设置为XML in this SO question。我在这里错过了什么？

例外：

SEVERE: Context initialization failed org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'myUsernamePasswordAuthenticationFilter' defined in file [*snip*]:
Invocation of init method failed; nested exception is java.lang.IllegalArgumentException: authenticationManager must be specified
...
Caused by: java.lang.IllegalArgumentException: authenticationManager must be specified
at org.springframework.util.Assert.notNull(Assert.java:112)

XML :(带有一些简化的类名）

<beans xmlns="http://www.springframework.org/schema/beans"
   xmlns:context="http://www.springframework.org/schema/context"
   xmlns:sec="http://www.springframework.org/schema/security"
   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
   xsi:schemaLocation="http://www.springframework.org/schema/beans
    http://www.springframework.org/schema/beans/spring-beans-3.2.xsd
    http://www.springframework.org/schema/context
    http://www.springframework.org/schema/context/spring-context-3.2.xsd
    http://www.springframework.org/schema/security
    http://www.springframework.org/schema/security/spring-security-3.1.xsd">

<context:property-placeholder location="classpath*:META-INF/spring/*.properties" />
<context:spring-configured />
<context:component-scan base-package="myapp" />

<!-- Spring Security Configuration. -->
<sec:http auto-config="false" entry-point-ref="loginUrlAuthenticationEntryPoint"
        access-denied-page="/denied.jsp">
    <sec:custom-filter position="FORM_LOGIN_FILTER" ref="myAuthenticationFilter" />

    <sec:intercept-url pattern="/login" access="IS_AUTHENTICATED_ANONYMOUSLY" />
    <sec:intercept-url pattern="/404.jsp" access="IS_AUTHENTICATED_ANONYMOUSLY" />
    <sec:intercept-url pattern="/index.jsp" access="IS_AUTHENTICATED_ANONYMOUSLY" />
    <sec:intercept-url pattern="/**" access="ROLE_USER" />

    <sec:logout logout-url="/logout" logout-success-url="/login" />
</sec:http>
<sec:authentication-manager alias="authenticationManager">
    <sec:authentication-provider ref="myAuthenticationProvider" />
</sec:authentication-manager>

<bean id="loginUrlAuthenticationEntryPoint" class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint">
    <property name="loginFormUrl" value="/login" />
</bean>
<bean id="myAuthenticationFilter" class="myapp.MyUsernamePasswordAuthenticationFilter">
    <property name="authenticationManager" ref="authenticationManager" />
</bean>
<bean id="myAuthenticationProvider" class="myapp.MyAuthenticationProvider" />

过滤器：

@Component
public class MyUsernamePasswordAuthenticationFilter extends AbstractAuthenticationProcessingFilter {
public AdminUsernamePasswordAuthenticationFilter() {
    super("/login");
}

@Override
public Authentication attemptAuthentication(final HttpServletRequest request,
        final HttpServletResponse response) throws AuthenticationException {
    // stuff and:
    return getAuthenticationManager().authenticate(new UsernamePasswordAuthenticationToken(
            login, request.getParameter("password")));
}
}

AuthenticationProvider：

@Component
public class MyAuthenticationProvider implements AuthenticationProvider {
@Override
public Authentication authenticate(final Authentication authentication) throws AuthenticationException {
    // all the funky AD+DB code
    return null;
}

@Override
public boolean supports(final Class<?> clazz) {
    return true;
}
}

我正在运行Java 6，最新的Spring Security（3.1.4.RELEASE）和Spring（3.2.3.RELEASE）版本，在Tomcat v6服务器上运行。不同的Spring版本似乎不是问题（related SO question）。如果它是一个问题，如果你想使用Spring Security，必须运行Spring 3.1.4只是meh ......

我试图做的其他一些事情无济于事：

我试图放弃<sec:authentication-manager />，转而使用正常的bean，如上所述here (bottom answer)。
我尝试以各种组合方式添加bean id，names，authentication-manager-ref。

Answer 1

啊......我发现Spring中许多人犯的基本错误。您在XML中定义了bean MyUsernamePasswordAuthenticationFilter，这是正确的。但是，您也可以通过@Component注释对其进行注释，这意味着它被组件扫描选中并注册为另一个bean定义。从这个定义中提取的bean实例实际上不会将authenticationManager依赖关系初始化。

只需删除@Component中的MyUsernamePasswordAuthenticationFilter注释，您就可以了。

Spring Security身份验证管理器不会在自定义筛选器上获取

1 个答案: