如何动态定义应用程序中的安全URL

Question

我正在使用Spring框架版本：3.2.3.RELEASE和 Spring安全版：3.2.3.RELEASE

我想动态定义应用程序中的安全URL，我尝试了几种方法。我无法成功，请帮助我！

根据http://docs.spring.io/spring-security/site/docs/3.2.x/reference/htmlsingle/faq.html#faq-dynamic-url-metadata， 我了解到，使用显式声明的安全过滤器链动态定义对URL的访问控制需要自定义FilterSecurityInterceptor bean。 我的问题是

1. 如何明确声明安全过滤器链？有什么例子吗？
2. 根据书籍Spring security 3.1 其中说“我们可以使用自定义BeanPostProcessor将标准FilterInvocationServiceSecurityMetadataSource替换为我们的自定义实现。”

我按照这种方式行事，它不起作用，我想知道我做错了什么？

Java配置类如下所示：

 public class MessageSecurityWebApplicationInitializer extends AbstractSecurityWebApplicationInitializer {
    }

@Configuration
@EnableWebSecurity
public class MultiHttpSecurityConfig {
    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception { 
        auth
            .inMemoryAuthentication()
                .withUser("user").password("password").roles("USER").and()
                .withUser("admin").password("password").roles("USER", "ADMIN");
    }

    @Configuration
    @Order(1)                                                        
    public static class ApiWebSecurityConfigurationAdapter extends WebSecurityConfigurerAdapter {
        protected void configure(HttpSecurity http) throws Exception {
            http
                .antMatcher("/api/**")                               
                .authorizeRequests()
                    .anyRequest().hasRole("ADMIN")
                    .and()
                .httpBasic();
        }
    }


    @Configuration                                                   
    public static class FormLoginWebSecurityConfigurerAdapter extends WebSecurityConfigurerAdapter {

        @Override
        protected void configure(HttpSecurity http) throws Exception {
            http
                .authorizeRequests()
                    .anyRequest().authenticated()
                    .and()
                .formLogin();
        }
    }
}

@Component
public class KpiFilterInvocationSecurityMetadataSourceBeanPostProcessor implements BeanPostProcessor {
    @Autowired
    private KpiFilterInvocationSecurityMetadataSource metadataSource;

    @Override
    public Object postProcessBeforeInitialization(Object bean, String beanName) throws BeansException {
        if(bean instanceof FilterInvocationSecurityMetadataSource) {
            return metadataSource;
        }
        if(bean instanceof FilterChainProxy.FilterChainValidator) {
            return new FilterChainProxy.FilterChainValidator() {
                @Override
                public void validate(FilterChainProxy filterChainProxy) {

                }
            };
        }
        return bean;
    }

    @Override
    public Object postProcessAfterInitialization(Object bean, String beanName) throws BeansException {
        return bean;
    }
}

我找到了一个方法withObjectPostProcessor，并尝试执行以下操作，但仍然无效。那么利用这种方法的最佳方法是什么？

@Configuration
public static class FormLoginWebSecurityConfigurerAdapter extends WebSecurityConfigurerAdapter {

    @Autowired
    private KpiFilterInvocationSecurityMetadataSource metadataSource;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf()
                .disable()
                .authorizeRequests()
                    .antMatchers("/signup/**", "/about", "/login/**", "/index")
                    .permitAll()
                .anyRequest()
                    .authenticated()
                .and()
                    .formLogin()
                    .permitAll()
                    .loginPage("/login/form")
                    .loginProcessingUrl("/login")
                    .usernameParameter("policeNo")
                    .passwordParameter("password")
                    .failureUrl("/login/form?error")
                    .defaultSuccessUrl("/default")
                .and()
                    .logout()
                    .logoutUrl("/logout")
                    .logoutSuccessUrl("/login/form?logout")
                .and()
                    .authorizeRequests()
                    .anyRequest()
                    .authenticated()
                    .withObjectPostProcessor(
                        new ObjectPostProcessor<FilterSecurityInterceptor>() {
                                public <O extends FilterSecurityInterceptor> O postProcess(
                                        O fsi) {
                                    fsi.setSecurityMetadataSource(metadataSource);
                                    return fsi;
                                }
                            });
        }

        @Override
        public void configure(WebSecurity webSecurity) throws Exception {
            webSecurity.ignoring().antMatchers("/resources/**");
        }
    }