Question

我在Spring 3.2.0项目中使用spring security 3.1.3。我使用spring security为我的安全配置了两个入口点。我们的想法是拥有一个像企业用户应该登录的/ enterprise_login这样的网址，以及普通用户登录操作的其他网址，例如/ login。在我的安全配置中，我有下一个代码

<security:global-method-security jsr250-annotations="enabled" pre-post-annotations="enabled" secured-annotations="enabled" />

<security:http pattern="/enterprise/**" auto-config="false" use-expressions="true" authentication-manager-ref="autenticationManagerUserEnterprise">
    <security:intercept-url pattern="/enterprise/**" access="hasRole('ROLE_ENTERPRISE')" />
    <security:intercept-url pattern="/enterprise_login" access="isAnonymous()" />
    <security:form-login login-page="/enterprise_login" default-target-url="/" authentication-failure-url="/empresas_login_error" login-processing-url="/enterprise_login_process" />
    <security:logout logout-success-url="/" delete-cookies="JSESSIONID"/>
    <security:remember-me user-service-ref="enterpriseAuthenticationProvider"/>
    <security:session-management invalid-session-url="/">
        <security:concurrency-control max-sessions="2" error-if-maximum-exceeded="true" />
    </security:session-management>
</security:http>

<security:http pattern="/**" auto-config="false" use-expressions="true" authentication-manager-ref="autenticationManagerUser">
    <security:intercept-url pattern="/**" access="permitAll" />
    <security:form-login login-page="/login" default-target-url="/" authentication-failure-url="/login_error" />
    <security:logout logout-success-url="/" delete-cookies="JSESSIONID"/>
    <security:remember-me user-service-ref="UserAuthenticationProvider"/>
    <security:session-management invalid-session-url="/">
        <security:concurrency-control max-sessions="2" error-if-maximum-exceeded="true" />
    </security:session-management>
</security:http>

<security:authentication-manager id="autenticationManagerUserEnterprise">
    <security:authentication-provider user-service-ref="enterpriseAuthenticationProvider">
        <security:password-encoder hash="plaintext"></security:password-encoder>
    </security:authentication-provider>
</security:authentication-manager>

<security:authentication-manager id="autenticationManagerUser">
    <security:authentication-provider user-service-ref="UserAuthenticationProvider">
        <security:password-encoder hash="plaintext"></security:password-encoder>
    </security:authentication-provider>
</security:authentication-manager>

<bean id="enterpriseAuthenticationProvider" class="com.test.security.enterpriseAuthenticationProvider"></bean>
<bean id="UserAuthenticationProvider" class="com.test.security.UserDetailsServiceImp"></bean>

然后，当我转到/ enterprise_login表单并提交登录数据时，我得到一个“HTTP 405 - 请求方法'POST'不支持”由tomcat在url / enterprise_login_process中抛出（配置为充当登录处理的url- url。我无法弄清楚问题出在哪里，真的很感激任何帮助。

PD：我的web.xml看起来像：

<web-app version="2.5" xmlns="http://java.sun.com/xml/ns/javaee"
     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
     xsi:schemaLocation="http://java.sun.com/xml/ns/javaee
        http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd">

<display-name>AT-2</display-name>

<context-param>
    <param-name>contextConfigLocation</param-name>
    <param-value>
        /WEB-INF/spring-config.xml
    </param-value>
</context-param>

<context-param>
    <param-name>webAppRootKey</param-name>
    <param-value>tutorial.root</param-value>
</context-param>

<listener>
    <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>

<listener>
    <listener-class>org.springframework.security.web.session.HttpSessionEventPublisher</listener-class>
</listener>

<filter>
    <filter-name>springSecurityFilterChain</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>

<filter-mapping>
    <filter-name>springSecurityFilterChain</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

<servlet>
    <servlet-name>mvc-dispatcher</servlet-name>
    <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
    <init-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>/WEB-INF/spring-config.xml</param-value>
    </init-param>
    <load-on-startup>0</load-on-startup>
</servlet>

<servlet-mapping>
    <servlet-name>mvc-dispatcher</servlet-name>
    <url-pattern>/</url-pattern>
</servlet-mapping>

<welcome-file-list>
    <welcome-file>index.jsp</welcome-file>
</welcome-file-list>

Answer 1

问题是第一个配置目前仅匹配以“/ enterprise /”开头的URL，而处理身份验证的URL配置为“/ enterprise_login_process”。这意味着向“/ enterprise_login_process”提交POST将提交给第二个不尝试验证“/ enterprise_login_process”的配置。

要解决此问题，您需要确保http @ pattern和login-processing-url对齐。例如：

<security:http pattern="/enterprise/**" 
      auto-config="false" 
      use-expressions="true" 
      authentication-manager-ref="autenticationManagerUserEnterprise">
    <security:intercept-url pattern="/enterprise/login" 
          access="isAnonymous()" />
    <security:intercept-url pattern="/**" 
          access="hasRole('ROLE_ENTERPRISE')" />
    <security:form-login login-page="/enterprise/login" 
          default-target-url="/" 
          authentication-failure-url="/enterprise/login?error" 
          login-processing-url="/enterprise/login_process" />
    <security:logout logout-success-url="/" 
          delete-cookies="JSESSIONID"/>
    <security:remember-me 
          user-service-ref="enterpriseAuthenticationProvider"/>
    <security:session-management invalid-session-url="/">
        <security:concurrency-control max-sessions="2" 
              error-if-maximum-exceeded="true" />
    </security:session-management>
</security:http>

您将观察到我修改了代码以确保块中的所有URL都以“/ enterprise /”开头。这也意味着您需要确保将企业登录表单更新为POST到“/ enterprise / login_process”。

Spring security login-processing-url抛出405请求方法POST不受支持

1 个答案: