Spring Security - @Secured仅适用于mvc Controller

时间：2011-03-08 11:02:52

标签： java spring-mvc spring-security


我正在使用Spring Security + MVC 注释@Secured({ "ROLE_ADMIN" })仅在控制器层中正常工作 如果我尝试在更深层/其他层中使用它，我就不会出现安全错误 或者如果我试图在“无mvc映射”方法上使用它，我没有得到任何安全错误 跟随我的xml的配置文件：
web.xml： 

  <?xml version="1.0" encoding="UTF-8"?>
<web-app id="WebApp_ID" version="2.4"
    xmlns="http://java.sun.com/xml/ns/j2ee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd">
    <filter>
        <filter-name>springSecurityFilterChain</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    </filter>
    <filter-mapping>
        <filter-name>springSecurityFilterChain</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>
    <context-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>
        /WEB-INF/spring-security.xml
        /WEB-INF/applicationContext.xml
        </param-value>
    </context-param>
    <context-param>
        <param-name>log4jConfigLocation</param-name>
        <param-value>/WEB-INF/classes/log4j-myapp.properties</param-value>
    </context-param>
    <servlet>
        <servlet-name>spring</servlet-name>
        <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
        <load-on-startup>1</load-on-startup>
    </servlet>
    <servlet-mapping>
        <servlet-name>spring</servlet-name>
        <url-pattern>/Management/*</url-pattern>
    </servlet-mapping>
    <listener>
        <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
    </listener>
</web-app>

弹簧servlet.xml中 

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:p="http://www.springframework.org/schema/p"
    xmlns:context="http://www.springframework.org/schema/context"
    xsi:schemaLocation="http://www.springframework.org/schema/beans 
        http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
         http://www.springframework.org/schema/context
        http://www.springframework.org/schema/context/spring-context-3.0.xsd">

    <!-- Declare a view resolver -->
    <bean id="viewResolver"
    class="org.springframework.web.servlet.view.InternalResourceViewResolver"
    p:prefix="/WEB-INF/pages/" p:suffix=".jsp" />
     <context:component-scan base-package="com.affiliates" />

</beans>

弹簧security.xml文件 

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:security="http://www.springframework.org/schema/security"
    xsi:schemaLocation="http://www.springframework.org/schema/beans 
            http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
            http://www.springframework.org/schema/security 

            http://www.springframework.org/schema/security/spring-security-3.0.xsd">
    <security:global-method-security secured-annotations="enabled" />
    <security:http auto-config="true" use-expressions="true"
        access-denied-page="/Management/auth/denied">

        <security:intercept-url pattern="/Management/auth/login"
            access="permitAll" />
        <security:intercept-url pattern="/Management/main/admin"
            access="hasRole('ROLE_EMPLOYEE')" />
        <security:intercept-url pattern="/Management/api/affiliates/**"
            access="hasRole('ROLE_EMPLOYEE')" />

        <security:form-login login-page="/Management/auth/login/"
            authentication-failure-url="/Management/auth/login?error=true"
            login-processing-url="/Management/auth/j_spring_security_check"
            default-target-url="/Management/auth/login?error=false" />
        <security:logout invalidate-session="true"
            logout-success-url="/Management/auth/login/" logout-url="/Management/auth/logout" />
    </security:http>

    <security:authentication-manager>
        <security:authentication-provider
            user-service-ref="customUserDetailsService">
            <security:password-encoder ref="passwordEncoder" />
        </security:authentication-provider>
    </security:authentication-manager>

    <bean
        class="org.springframework.security.authentication.encoding.Md5PasswordEncoder"
        id="passwordEncoder" />
    <bean id="customUserDetailsService" class="com.affiliates.service.CustomUserDetailsService" />
</beans>

MVC-dispacher-servlet.xml中 

<beans xmlns="http://www.springframework.org/schema/beans"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:context="http://www.springframework.org/schema/context"
    xsi:schemaLocation="http://www.springframework.org/schema/beans 
    http://www.springframework.org/schema/beans/spring-beans-2.5.xsd
    http://www.springframework.org/schema/context
    http://www.springframework.org/schema/context/spring-context-2.5.xsd">

    <context:component-scan base-package="com.affiliates.controllers" />

    <bean id="viewResolver"
        class="org.springframework.web.servlet.view.InternalResourceViewResolver">
        <property name="prefix">
            <value>/WEB-INF/pages/</value>
        </property>
        <property name="suffix">
            <value>.jsp</value>
        </property>
    </bean>
</beans>

applocationContext.xml 

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:context="http://www.springframework.org/schema/context"
    xmlns:mvc="http://www.springframework.org/schema/mvc"
    xsi:schemaLocation="http://www.springframework.org/schema/beans 
            http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
            http://www.springframework.org/schema/context
            http://www.springframework.org/schema/context/spring-context-3.0.xsd
            http://www.springframework.org/schema/mvc 
            http://www.springframework.org/schema/mvc/spring-mvc-3.0.xsd">

    <!-- Activates various annotations to be detected in bean classes -->
    <context:annotation-config />

    <!-- Scans the classpath for annotated components that will be auto-registered 
        as Spring beans. For example @Controller and @Service. Make sure to set the 
        correct base-package -->
    <context:component-scan base-package="com.affiliates" />

    <!-- Configures the annotation-driven Spring MVC Controller programming 
        model. Note that, with Spring 3.0, this tag works in Servlet MVC only! -->
    <mvc:annotation-driven />

</beans>

以下是我如何使用它： 安全的方法：

 @Component
    public  class BrandsApi{
    @Secured({ "ROLE_ADMIN" })
        public ResultContainer getAll() {
            return brandDao.getAll(getSecurityFilter().getBrandSecurityFilter());
        }
    }
}

来电者：

@Controller
@RequestMapping("/api/brands")
public class BrandsController {
@RequestMapping(value = "/get")
    public ModelAndView get(){
       BrandsApi brandsApi = new BrandsApi();
       brandsApi.getAll();
}
}

这是我的最新更新：
嗨，
我将配置转换为javaconfig文件，工作正常 我在加载时调试我的应用程序，我看到参数已被转移 这意味着brandsApi被初始化了 代码：

@Configuration
public class SpringJavaConfig { 
    @Bean
    public BrandsApi brandsApi(){
        return new BrandsApi();
    }
}

在BrandsApi里面我有一个@Secured（{“ROLE_ADMIN”}）的方法

这就是我调用方法的方法： 代码：

ApplicationContext ctx = new AnnotationConfigApplicationContext(SpringJavaConfig.class);
    BrandsApi brandsApi = (BrandsApi)ctx.getBean(BrandsApi.class);
        brandsApi.getAll();

但由于某些原因，即使我已经登录ROLE_EMPLOYEE，我也可以进去 这是我的BrandsApi类：
代码：

class BrandsApi extends BaseApi{
    @Secured({ "ROLE_ADMIN" })
    public void getAll() {
        System.out.println("Hello");
    }
}

1 个答案:

答案 0 :(得分：5)

如果实例是由Spring创建的，则注释仅具有效果。您必须将要使用它的每个类转换为bean并在应用程序上下文中注册它。

另请注意，如果进行内部调用，则会忽略注释：

 Foo foo = context.getBean( "foo", Foo.class );
 foo.foo(); // <-- annotatoon works here

但如果foo()调用this.foo2()，则不再进行检查。因此，忽略foo2()的任何注释。

相关问题
最新问题