Question

这看起来很奇怪，可能是一个bug。我有一个Spring引导1.3.2作为使用Rest服务的后端API，我有另一个使用Angular 2的应用程序使用这些服务。所有的安全措施都可以正常使用JWT Token，我可以限制我的服务用于登录用户，我可以检查用户登录等等。授权无效100％，如果我添加了我的服务@Secured或@PreAuthorize以及某个用户角色，则可以使用swagger和我的MockMvc测试使用@WithMockUser(roles="ROLE_TEST")进行配置，以便进行配置行。

问题在于，当我通过角度应用程序访问时，使用@Secured或@PreAuthorize的授权无效，我的所有请求都有@Secured或@PreAuthorize我收到状态403。

authentication.getAuthorities()我的所有角色都被正确加载

控制器：

@RequestMapping(method=RequestMethod.GET, produces=MediaType.APPLICATION_JSON_UTF8_VALUE)
@Secured("ROLE_MANTER_INSTITUICAO")
public List<HierarquiaInstituicao> getAll() {
    return service.findAll();
}

安全配置：

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(securedEnabled = true, prePostEnabled=true, jsr250Enabled=true)
public class SpringSecurityConfig extends WebSecurityConfigurerAdapter {

    private UserService userService;
    private final TokenAuthenticationService tokenAuthenticationService;

    public SpringSecurityConfig() {
        super(true);
        this.userService = new UserService();
        tokenAuthenticationService = new TokenAuthenticationService(userService);
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {

        http.exceptionHandling().and().anonymous().and().servletApi().and()
                .authorizeRequests()
                // Allow anonymous logins
                .antMatchers("/api/auth/**").permitAll()

                // All other request need to be authenticated
                .anyRequest().authenticated().and()

                // Custom Token based authentication based on the header
                // previously given to the client
                .addFilterBefore(new StatelessAuthenticationFilter(tokenAuthenticationService),
                        UsernamePasswordAuthenticationFilter.class);
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userService).passwordEncoder(new BCryptPasswordEncoder());
    }

    @Bean
    @Override
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }

    @Bean
    @Override
    public UserService userDetailsService() {
        return userService;
    }

    @Bean
    public TokenAuthenticationService tokenAuthenticationService() {
        return tokenAuthenticationService;
    }
}

我的过滤器：

public class StatelessAuthenticationFilter extends GenericFilterBean {

    private final TokenAuthenticationService authenticationService;

    public StatelessAuthenticationFilter(TokenAuthenticationService authenticationService) {
        this.authenticationService = authenticationService;
    }

    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain filterChain)
            throws IOException, ServletException {

        HttpServletRequest httpRequest = (HttpServletRequest) request;
        HttpServletResponse httpResponse = (HttpServletResponse) response;
        Authentication authentication = authenticationService.getAuthentication(httpRequest);
        if(authentication != null) {
            SecurityContextHolder.getContext().setAuthentication(authentication);
            filterChain.doFilter(request, response);
        }
        else {
            httpResponse.setStatus(HttpStatus.UNAUTHORIZED.value());
        }
        SecurityContextHolder.getContext().setAuthentication(null);

    }
}

Spring Security无法识别用户角色

0 个答案: