升级到Spring 5.0.3 / Spring Security 5.0.1后处理登录时出错

Question

我正在使用Maven更新Web应用程序构建库，并使用在Apache Tomcat上运行的Spring和Spring Security。我不熟悉Spring，而且我在认证方面遇到了一些麻烦。

弹簧security.xml文件

<beans xmlns="http://www.springframework.org/schema/beans"
    xmlns:security="http://www.springframework.org/schema/security"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns:context="http://www.springframework.org/schema/context"
    xsi:schemaLocation="http://www.springframework.org/schema/beans
        http://www.springframework.org/schema/beans/spring-beans-4.3.xsd
        http://www.springframework.org/schema/security
        http://www.springframework.org/schema/security/spring-security-4.2.xsd
        http://www.springframework.org/schema/context
        http://www.springframework.org/schema/context/spring-context-4.3.xsd">

    <bean class="org.springframework.beans.factory.config.PropertyPlaceholderConfigurer">
        <property name="ignoreUnresolvablePlaceholders" value="true" />
        <property name="ignoreResourceNotFound" value="true" />
        <property name="locations">
            <list>
                <value>classpath:web.properties</value>
                <value>classpath*:my-configuration.properties</value>
            </list>
        </property>
    </bean>
    <context:annotation-config />
    <security:global-method-security  pre-post-annotations="enabled"/>
    <security:http pattern="/css/**" security="none" />
    <security:http pattern="/scripts/**" security="none" />
    <security:http pattern="/images/**" security="none" />
    <security:http pattern="/assets/**" security="none" />
    <security:http auto-config="true" disable-url-rewriting="true" use-expressions="true" >
        <security:form-login  login-page="/webapp/login" authentication-failure-url="/webapp/login-failed" default-target-url="/webapp/dashboard" always-use-default-target="true" />
        <security:intercept-url pattern="/webapp/dashboard" access="hasAnyRole({'ROLE_USER', 'ROLE_ADMINISTRATOR'})"/>
        <security:intercept-url pattern="/webapp/dashboard/" access="hasAnyRole({'ROLE_USER', 'ROLE_ADMINISTRATOR'})"/>

        <security:logout invalidate-session="false" delete-cookies="JSESSIONID" logout-success-url="/webapp/logout" />
        <security:session-management invalid-session-url="/webapp/login" />
        <security:access-denied-handler error-page="/webapp/access-denied"></security:access-denied-handler>
    </security:http>

    <!-- Authentication -->
    <security:authentication-manager>
        <security:authentication-provider ref="authenticationProvider">
        </security:authentication-provider>
    </security:authentication-manager>
    <bean id="userDetailsService" class="com.company.security.UserDetailsServiceImpl"/>
    <bean id="passwordEncoder" class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder"/>
    <bean id="authenticationProvider" class="org.springframework.security.authentication.dao.DaoAuthenticationProvider">
        <property name="userDetailsService" ref="userDetailsService"/>
        <property name="passwordEncoder" ref="passwordEncoder"/>
    </bean>
</beans>

当我尝试登录时（我知道现在因为不同的密码加密方法会出错），我使用自定义登录方法会导致此功能被触发

@PreAuthorize("isAuthenticated()")
@RequestMapping(value = "/access-denied", method = RequestMethod.POST)
public String accessDeniedPost(ModelMap model, Principal principal) {
    if(logger.isDebugEnabled())logger.info(">>> Received request '/denied'");
    String name = principal.getName();
    model.addAttribute("username", name);
    return "webapp/access-denied";
}

它返回以下错误

2018-02-15 12:54:36.883 [DEBUG] (https-jsse-nio-8443-exec-4) org.springframework.web.servlet.mvc.method.annotation.ExceptionHandlerExceptionResolver  - Resolving exception from handler [public java.lang.String com.company.controller.LoginController.accessDeniedPost(org.springframework.ui.ModelMap,java.security.Principal)]: org.springframework.security.authentication.AuthenticationCredentialsNotFoundException: An Authentication object was not found in the SecurityContext
2018-02-15 12:54:36.887 [DEBUG] (https-jsse-nio-8443-exec-4) org.springframework.web.servlet.mvc.annotation.ResponseStatusExceptionResolver  - Resolving exception from handler [public java.lang.String com.company.controller.LoginController.accessDeniedPost(org.springframework.ui.ModelMap,java.security.Principal)]: org.springframework.security.authentication.AuthenticationCredentialsNotFoundException: An Authentication object was not found in the SecurityContext
2018-02-15 12:54:36.887 [DEBUG] (https-jsse-nio-8443-exec-4) org.springframework.web.servlet.mvc.support.DefaultHandlerExceptionResolver  - Resolving exception from handler [public java.lang.String com.company.controller.LoginController.accessDeniedPost(org.springframework.ui.ModelMap,java.security.Principal)]: org.springframework.security.authentication.AuthenticationCredentialsNotFoundException: An Authentication object was not found in the SecurityContext
2018-02-15 12:54:36.888 [DEBUG] (https-jsse-nio-8443-exec-4) org.springframework.web.servlet.DispatcherServlet  - Could not complete request
org.springframework.security.authentication.AuthenticationCredentialsNotFoundException: An Authentication object was not found in the SecurityContext
    at org.springframework.security.access.intercept.AbstractSecurityInterceptor.credentialsNotFound(AbstractSecurityInterceptor.java:379)
    at org.springframework.security.access.intercept.AbstractSecurityInterceptor.beforeInvocation(AbstractSecurityInterceptor.java:223)
    at org.springframework.security.access.intercept.aopalliance.MethodSecurityInterceptor.invoke(MethodSecurityInterceptor.java:65)
    at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:185)
    at org.springframework.aop.framework.CglibAopProxy$DynamicAdvisedInterceptor.intercept(CglibAopProxy.java:689)
    at com.company.controller.LoginController$$EnhancerBySpringCGLIB$$df00c0dc.accessDeniedPost(<generated>)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:498)
    at org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:209)
    at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:136)
    at org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:102)
    at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandlerMethod(RequestMappingHandlerAdapter.java:870)
    at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:776)
    at org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:87)
    at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:991)
    at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:925)
    at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:978)
    at org.springframework.web.servlet.FrameworkServlet.doPost(FrameworkServlet.java:881)
    at javax.servlet.http.HttpServlet.service(HttpServlet.java:661)
    at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:855)
    at javax.servlet.http.HttpServlet.service(HttpServlet.java:742)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:231)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
    at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
    at org.apache.catalina.core.ApplicationDispatcher.invoke(ApplicationDispatcher.java:728)
    at org.apache.catalina.core.ApplicationDispatcher.processRequest(ApplicationDispatcher.java:467)
    at org.apache.catalina.core.ApplicationDispatcher.doForward(ApplicationDispatcher.java:392)
    at org.apache.catalina.core.ApplicationDispatcher.forward(ApplicationDispatcher.java:311)
    at org.springframework.security.web.access.AccessDeniedHandlerImpl.handle(AccessDeniedHandlerImpl.java:73)
    at org.springframework.security.web.access.DelegatingAccessDeniedHandler.handle(DelegatingAccessDeniedHandler.java:73)
    at org.springframework.security.web.csrf.CsrfFilter.doFilterInternal(CsrfFilter.java:118)
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
    at org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:64)
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
    at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:56)
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
    at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:105)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
    at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:215)
    at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:178)
    at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:357)
    at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:270)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
    at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:198)
    at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96)
    at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:478)
    at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:140)
    at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:80)
    at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:624)
    at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:87)
    at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:342)
    at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:799)
    at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66)
    at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:861)
    at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1455)
    at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
    at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
    at java.lang.Thread.run(Thread.java:748)

我假设我必须介绍 AuthenticationCredentialsNotFoundException 类的使用，但我忽略了如何以及在何处进行操作。