Question

我创建了一个实现FilterInvocationSecurityMetadataSource接口的类。

我实现了这样：

public List<ConfigAttribute> getAttributes(Object object) {
    FilterInvocation fi = (FilterInvocation) object;
    Object principal = SecurityContextHolder.getContext().getAuthentication().getPrincipal();
    Long companyId = ((ExtenededUser) principal).getCompany().getId();
    String url = fi.getRequestUrl();
    // String httpMethod = fi.getRequest().getMethod();
    List<ConfigAttribute> attributes = new ArrayList<ConfigAttribute>();
    FilterSecurityService service = (FilterSecurityService) SpringBeanFinder.findBean("filterSecurityService");
    Collection<Role> roles = service.getRoles(companyId);
    for (Role role : roles) {
        for (View view : role.getViews()) {
            if (view.getUrl().equalsIgnoreCase(url))
                attributes.add(new SecurityConfig(role.getName() + "_" + role.getCompany().getName()));
        }
    }
    return attributes;
}

当我调试我的应用程序时，我看到它到达这个类，它只到达getAllConfigAttributes方法，就像我说的那样是空的，并返回null。之后会打印出这个警告：无法验证配置属性，因为SecurityMetadataSource未从getAllConfigAttributes（）返回任何属性。

我的aplicationContext-安全性是这样的：

<beans:bean id="filterChainProxy"
        class="org.springframework.security.web.FilterChainProxy">
        <filter-chain-map path-type="ant">
            <filter-chain filters="sif,filterSecurityInterceptor"
                pattern="/**" />
        </filter-chain-map>
    </beans:bean>    
<beans:bean id="filterSecurityInterceptor"
        class="org.springframework.security.web.access.intercept.FilterSecurityInterceptor">
        <beans:property name="authenticationManager" ref="authenticationManager" />
        <beans:property name="accessDecisionManager" ref="accessDecisionManager" />
        <beans:property name="securityMetadataSource" ref="filterSecurityMetadataSource" />
    </beans:bean>
<beans:bean id="filterSecurityMetadataSource"
        class="com.mycompany.filter.FilterSecurityMetadataSource">
    </beans:bean>

可能是什么问题？

Answer 1

抱歉我的错误。

我在代码中使用了id =“securityFilterChaing”

虽然我应该使用id =“filterChainProxy”

filterSecurityInterceptor和metadatasource实现spring-security

1 个答案: