Question

下面是我的安全配置文件，我想将其更改为java config

<beans:bean id="filterSecurityInterceptor" class="org.springframework.security.web.access.intercept.FilterSecurityInterceptor">
    <beans:property name="accessDecisionManager" ref="accessDecisionManager" />
    <beans:property name="authenticationManager" ref="authenticationManager" />
    <beans:property name="securityMetadataSource" ref="securityMetadataSource" />
</beans:bean>

<authentication-manager alias="authenticationManager" xmlns="http://www.springframework.org/schema/security">
        <authentication-provider ref="customAuthentication"></authentication-provider>
</authentication-manager>

<beans:bean name="accessDecisionManager" class="com.xy.security.CustomAccessDecisionManager" ></beans:bean>

<beans:bean name="securityMetadataSource" class="com..xy.security.InvocationSecurityMetadataSourceService">
</beans:bean>

<beans:bean id="customAuthentication" class="com.xy.security.CustomAuthentication" />

<beans:bean id="securityExceptionTranslationHandler" class="org.springframework.security.web.authentication.ExceptionMappingAuthenticationFailureHandler">
    <beans:property name="exceptionMappings">
        <beans:props>
            <beans:prop key="org.springframework.security.authentication.CredentialsExpiredException">/changepassword.xhtml</beans:prop>
        </beans:props>
    </beans:property>
    <beans:property name="defaultFailureUrl" value="/login.jsp" />
</beans:bean>    ====================================================

我想将其更改为java config，以下是我的代码，但是失败

@Configuration

@EnableWebSecurity

public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Autowired
    private CustomAuthentication customAuthentication;

    @Autowired
    private CustomAccessDecisionManager customAccessDecisionManager;

    @Autowired
    private InvocationSecurityMetadataSourceService invocationSecurityMetadataSourceService;

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.authenticationProvider(customAuthentication);
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {

        http.authorizeRequests()
            .antMatchers("/login*","/favicon.ico","/","/**/*.css" ,"/images/*.*","/js/*.js","/bt-fonts/*.*").permitAll()
            .anyRequest().authenticated()
            .and()
            .formLogin().loginPage("/login")
            .defaultSuccessUrl("/admin*")
            .failureUrl("/login?error=true")
            .and()
            .logout().logoutSuccessUrl("/login").invalidateHttpSession(true).deleteCookies("true")
            .and()
            .authenticationProvider(customAuthentication)
            //.accessDecisionManager(customAccessDecisionManager)
            //.authorizeRequests().accessDecisionManager(customAccessDecisionManager)
            //.csrf().disable()
            ;

    }

我有一个具有自定义身份验证逻辑的类

public class CustomAccessDecisionManager implements AccessDecisionManager{

  -@Override
    public Authentication authenticate(Authentication authentication){

//这里有一些代码 }

和下面这样的另一个类，我具有自定义的授权逻辑

public class CustomAuthentication implements AuthenticationProvider{

  @Override
    public void decide(Authentication arg0, Object object, Collection<ConfigAttribute> arg2)

//这里有一些代码

Answer 1

第一个（我建议）是将您的配置更新为包含WebExpressionVoter。例如：

     @Bean
public AccessDecissionManager defaultAccessDecisionManager() {
    List<AccessDecisionVoter<FilterInvocation>> voters = new ArrayList<AccessDecisionVoter<FilterInvocation>>();
    voters.add(new WebExpressionVoter());
    voters.add(new CustomVoter());
    AccessDecissionManager result = new UnanimousBased();
    result.setDecisionVoters(voters);
    return result;
}

第二个选项是更改为不使用Spring Security的URL映射中的表达式。例如

protected void configure(HttpSecurity http) throws Exception {
 http
    .apply(new UrlAuthorizationConfigurer())
        .accessDecisionManager(defaultAccessDecisionManager())
        .antMatchers("/admin/**").hasRole("ADMINGROUP")
        .anyRequest().authenticated().and()
    ....

}

view the below link

Answer 2

@Configuration
@EnableWebMvcSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private CustomAuthenticationProvider customAuthenticationProvider;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        /**
         * Do your stuff here
         */
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.authenticationProvider(customAuthenticationProvider);
    }
}

如何在春季启动时配置自定义AccessDecisionManager和自定义AuthenticationProvider

2 个答案: