Question

我正在尝试编写自定义方法安全拦截器。但是，我没有使用我在安全上下文中添加到bean属性的身份验证管理器，并在检查身份验证管理器是否存在时返回null。任何人都可以阐明为什么没有使用身份验证管理器bean属性？我在WebSphere 7.0上使用spring security 3.0.5

这是包含方法拦截器

的bean

<beans:bean id="methodInterceptor"
    class="bigbank.security.CustomMethodSecInterceptor">
    <beans:property name="authenticationManager" ref="authenticationManager" />
    <beans:property name="accessDecisionManager" ref="universalAccessDecisionManager" />
    <beans:property name="securityMetadataSource" ref="tspmMethodSecurityMetaData" />

这是我的方法安全拦截器

public class CustomMethodSecInterceptor extends MethodSecurityInterceptor {

private static final Log logger = LogFactory
        .getLog(WebSphere2SpringSecurityPropagationInterceptor.class);
private AuthenticationManager authenticationManager = null;
private AuthenticationDetailsSource authenticationDetailsSource = new WebSpherePreAuthenticatedAuthenticationDetailsSource();
private final WASUsernameAndGroupsExtractor wasHelper;

public CustomMethodSecInterceptor() {
    wasHelper = new DefaultWASUsernameAndGroupsExtractor();
}

@Override
public Object invoke(MethodInvocation mi) throws Throwable {
    try {
        logger.debug("Performing Spring Security authentication with WebSphere credentials");
        System.out.println("@@going through ss authentication");
        authenticateSpringSecurityWithWASCredentials();
        InterceptorStatusToken token = super.beforeInvocation(mi);

        logger.debug("Proceeding with method invocation");
        Object result = mi.proceed();
        return super.afterInvocation(token, result);

    } finally {
        logger.debug("Clearing Spring Security security context");
        SecurityContextHolder.clearContext();
    }
}

private void authenticateSpringSecurityWithWASCredentials() {
    Assert.notNull(authenticationManager); // This is where the error is coming up
    Assert.notNull(authenticationDetailsSource);

    String userName = wasHelper.getCurrentUserName();
    if (logger.isDebugEnabled()) {
        logger.debug("Creating authentication request for user " + userName);
    }
    PreAuthenticatedAuthenticationToken authRequest = new PreAuthenticatedAuthenticationToken(
            userName, "N/A");
    authRequest.setDetails(authenticationDetailsSource.buildDetails(null));
    if (logger.isDebugEnabled()) {
        logger.debug("Authentication request for user " + userName + ": "
                + authRequest);
    }
    Authentication authResponse = authenticationManager
            .authenticate(authRequest);
    if (logger.isDebugEnabled()) {
        logger.debug("Authentication response for user " + userName + ": "
                + authResponse);
    }
    SecurityContextHolder.getContext().setAuthentication(authResponse);
}

public void setAuthenticationManager(
        AuthenticationManager authenticationManager) {
    this.authenticationManager = authenticationManager;
}

}

这是错误：

Caused by: java.lang.IllegalArgumentException: An AuthenticationManager is required
at org.springframework.util.Assert.notNull(Assert.java:112)
at org.springframework.security.access.intercept.AbstractSecurityInterceptor.afterPropertiesSet(AbstractSecurityInterceptor.java:118)
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.invokeInitMethods(AbstractAutowireCapableBeanFactory.java:1469)
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1409)
... 119 more

Answer 1

您已覆盖setAuthenticationManager方法，因此当Spring调用它来注入AuthenticationManager时，它不会在AbstractSecurityInterceptor中设置相应的字段。

由于基类包含此属性的getter，因此最好删除field和setter方法，并使用getter访问代码中的身份验证管理器。

Spring Security Method安全拦截器没有获取authenticationManager

1 个答案: