Spring 安全性 sec:authorize 抛出异常

Question

我想在我的 jsp 中添加一个字段，该字段仅对管理员显示。为此，我使用标签 sec:authorize access="hasRole('Admin')"。但是当我添加它时，应用程序抛出异常：http://pastebin.com/TcN0k0K0
我用的是spring4.1.7.RELEASE，spring-安全版本4.0.3.RELEASE。在 pom.xml 我添加了 spring-security-taglibs v.4.0.3
这是我的 jsp 代码：

<%@ taglib prefix="sec" uri="http://www.springframework.org/security/tags" %>
<html>
<body>    
<sec:authorize access="hasRole('Admin')">
    <p>Must have ROLE_Admin to see this</p>
</sec:authorize>    
<form name='registerForm' method='POST' action="/admin/createuser">
        ...

在数据库角色中存储为 ROLE_Admin、ROLE_User
spring-security.xml

<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security"
             xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:beans="http://www.springframework.org/schema/beans"
             xmlns:security="http://www.springframework.org/schema/security"
             xsi:schemaLocation="http://www.springframework.org/schema/security

     http://www.springframework.org/schema/security/spring-security-4.0.xsd
     http://www.springframework.org/schema/beans
     http://www.springframework.org/schema/beans/spring-beans-4.1.xsd">

<http use-expressions="true" >
    <csrf disabled="true"/>
    <intercept-url pattern="/admin" access="hasAnyRole('Admin', 'User')" />
    <intercept-url pattern="/" access="permitAll" />
    <intercept-url pattern="/login" access="permitAll" />
    <intercept-url pattern="/logout" access="permitAll" />

    <access-denied-handler error-page="/403" />

    <form-login login-page='/login' login-processing-url="/login" authentication-failure-url="/403"
                default-target-url="/admin"
                username-parameter="login" password-parameter="password" />
    <logout logout-url="/logout" logout-success-url="/logoutSuccessful" delete-cookies="JSESSIONID" invalidate-session="true" />
</http>

<authentication-manager>
    <authentication-provider>
        <jdbc-user-service data-source-ref="myDataSource"
                           users-by-username-query= "select login, password, 'true' from employee where login=?"
                           authorities-by-username-query= "select login, role from employee where login =?  " />
    </authentication-provider>
</authentication-manager>

<beans:import resource="data-source-cfg.xml"/>
</beans:beans>

如何解决这个问题？

Answer 1

看看这个，你遇到的问题是关于 spring 版本的。您有两个选择：

1 - 要继续使用 spring security 4.0.3，您必须将 Spring 版本升级到 4.2.x.

2 - 要继续使用当前的 spring 版本，您必须降级到 Spring 安全 4.0.2

此致

Spring 安全性 sec:authorize 抛出异常

Spring Security sec:authorize throw exception

spring

jsp

jsp-tags

spring-mvc

spring-security