Spring 在控制器中使用@security 注释的安全性

Question

我正在使用 spring 安全性并创建一个演示 application.It 包含一个登录控制器和 2 个 jsp 用于登录和成功的页面。

我想使用@secure 批注在控制器中应用方法级安全性，但它不起作用，当我在我的服务中应用它时 class 它运行良好。

谁能帮我找出我做错了什么:(

我的 Pom.xml 是

    <?xml version="1.0" encoding="UTF-8"?>
        <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                 xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
          <modelVersion>4.0.0</modelVersion>
          <groupId>com.concretepage.app</groupId>
            <artifactId>SpringSecurity</artifactId>
            <packaging>war</packaging>
            <version>1.0-SNAPSHOT</version>
            <name>Spring Security App</name>

            <properties>
                <spring.version>3.1.4.RELEASE</spring.version>
            </properties>

            <dependencies>
                <dependency>
                    <groupId>org.springframework</groupId>
                    <artifactId>spring-core</artifactId>
                    <version>${spring.version}</version>
                </dependency>

                <dependency>
                    <groupId>org.springframework</groupId>
                    <artifactId>spring-webmvc</artifactId>
                    <version>${spring.version}</version>
                </dependency>

                <dependency>
                    <groupId>org.springframework</groupId>
                    <artifactId>spring-web</artifactId>
                    <version>${spring.version}</version>
                </dependency>

                <dependency>
                    <groupId>org.springframework.security</groupId>
                    <artifactId>spring-security-core</artifactId>
                    <version>${spring.version}</version>
                </dependency>

                <dependency>
                    <groupId>org.springframework.security</groupId>
                    <artifactId>spring-security-web</artifactId>
                    <version>${spring.version}</version>
                </dependency>

                <dependency>
                    <groupId>org.springframework.security</groupId>
                    <artifactId>spring-security-config</artifactId>
                    <version>${spring.version}</version>
                </dependency>

                <dependency>
                  <groupId>org.springframework</groupId>
                  <artifactId>spring-context</artifactId>
                  <version>${spring.version}</version>
               </dependency>

               <dependency>
                 <groupId>org.springframework.security</groupId>
                 <artifactId>spring-security-taglibs</artifactId>
                  <version>${spring.version}</version>
               </dependency>


                <dependency>
                    <groupId>jstl</groupId>
                    <artifactId>jstl</artifactId>
                    <version>1.2</version>
                </dependency>

                <dependency>
                     <groupId>commons-dbcp</groupId>
                     <artifactId>commons-dbcp</artifactId>
                     <version>1.2.2</version>
                </dependency>

                <dependency>
                     <groupId>mysql</groupId>
                     <artifactId>mysql-connector-java</artifactId>
                     <version>5.1.17</version>
               </dependency>

               <dependency>
                <groupId>log4j</groupId>
                <artifactId>log4j</artifactId>
                <version>1.2.17</version>
               </dependency>

               <dependency>
                 <groupId>org.aspectj</groupId>
                 <artifactId>aspectjweaver</artifactId>
                 <version>1.6.8</version>
              </dependency>

              <dependency>
                <groupId>javax.servlet</groupId>
                <artifactId>servlet-api</artifactId>
                <version>2.5</version>
              </dependency>

              <dependency>
                 <groupId>cglib</groupId>
                 <artifactId>cglib</artifactId>
                 <version>2.2</version>
               </dependency>

            </dependencies>

            <build>
                <finalName>SpringSecurity</finalName>
                <plugins>
                    <plugin>
                        <artifactId>maven-compiler-plugin</artifactId>
                        <configuration>
                            <source>1.6</source>
                            <target>1.6</target>
                        </configuration>
                    </plugin>
                </plugins>
            </build>

        </project>

dispatcher-servlet 是：

        <beans xmlns="http://www.springframework.org/schema/beans"
        xmlns:context="http://www.springframework.org/schema/context"
        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xsi:schemaLocation="http://www.springframework.org/schema/beans     
            http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
            http://www.springframework.org/schema/context 
            http://www.springframework.org/schema/context/spring-context-    3.1.xsd">

        <context:component-scan    base-package="com.concretepage.security.controller" />

        <bean     class="org.springframework.web.servlet.view.InternalResourceViewResolver">
          <property name="prefix" value="/pages/"/>
          <property name="suffix" value=".jsp"/> 
        </bean>

    </beans>

安全配置是：

        <?xml version="1.0" encoding="UTF-8"?>
        <beans:beans xmlns="http://www.springframework.org/schema/security"
         xmlns:beans="http://www.springframework.org/schema/beans"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://www.springframework.org/schema/beans
               http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
               http://www.springframework.org/schema/security
               http://www.springframework.org/schema/security/spring-security-3.1.xsd">

        <http auto-config="true">
            <intercept-url pattern="/login" access="ROLE_USER,ROLE_ADMIN" />
            <logout logout-success-url="/login" />
        </http>

        <authentication-manager>
          <authentication-provider>
           <user-service>
            <user name="ram" password="con1234" authorities="ROLE_ADMIN" />
            <user name="rahim" password="con1234" authorities="ROLE_USER" />
          </user-service>
          </authentication-provider>
        </authentication-manager>

       <global-method-security secured-annotations="enabled" />
       <beans:bean name="userService" class="com.concretepage.service.UserService"/>             
    </beans:beans>

web.xml 是：

<?xml version="1.0" encoding="ISO-8859-1" ?>
<web-app xmlns="http://java.sun.com/xml/ns/j2ee"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd"
    version="2.4">

    <display-name>Spring Security Application</display-name>

    <servlet>
        <servlet-name>dispatcher</servlet-name>
        <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
        <load-on-startup>1</load-on-startup>
    </servlet>

    <servlet-mapping>
        <servlet-name>dispatcher</servlet-name>
        <url-pattern>/</url-pattern>
    </servlet-mapping>

    <context-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>
           /WEB-INF/dispatcher-servlet.xml,
           /WEB-INF/security-config.xml
        </param-value>
    </context-param>

    <listener>
        <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
    </listener>

      <listener>
    <listener-class>org.springframework.security.web.session.HttpSessionEventPublisher</listener-class>
     </listener>

    <!-- Spring Security Configuration -->
    <filter>
        <filter-name>springSecurityFilterChain</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    </filter>

    <filter-mapping>
        <filter-name>springSecurityFilterChain</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

</web-app>

登录控制器是：

        package com.concretepage.security.controller;

    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.stereotype.Controller;
    import org.springframework.ui.ModelMap;
    import org.springframework.web.bind.annotation.RequestMapping;
    import org.springframework.web.bind.annotation.RequestMethod;
    import org.springframework.security.access.annotation.Secured;
    import com.concretepage.service.IUserService;

    @Controller
    public class LoginController {
        @Autowired
        public IUserService userService;

       @RequestMapping(value="/login", method = RequestMethod.GET)
        public String success(ModelMap map) {       
            return "success"; 
        }  

       @Secured("ROLE_ADMIN")
       @RequestMapping(value="/test", method = RequestMethod.GET)
        public String success1(ModelMap map) {      
            return "success"; 
        } 
    }

Answer 1

根据您的 web.xml 的结构，文件 dispatcher-servlet.xml 将被加载两次 - 一次是由于 <servlet>...</servlet> 标记，然后是一次由于 <context-param>...</context-param>。您应该从 <context-param>...</context-param> 部分删除对 dispatcher-servlet.xml 的引用。

您的 Spring 安全注释不起作用的原因是您在 Spring 配置中的任何地方都没有 <security:global-method-security jsr250-annotations="enabled" pre-post-annotations="enabled" secured-annotations="enabled"/>。由于您想保护您的控制器，因此应将此行添加到 dispatcher-servlet.xml。修改后的文件将如下所示：

<beans xmlns="http://www.springframework.org/schema/beans"
   xmlns:context="http://www.springframework.org/schema/context"
   xmlns:security="http://www.springframework.org/schema/security"
   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
   xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
        http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
        http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd">
  <context:component-scan base-package="com.concretepage.security.controller"/>

  <bean class="org.springframework.web.servlet.view.InternalResourceViewResolver">
    <property name="prefix" value="/pages/"/>
    <property name="suffix" value=".jsp"/>
  </bean>

  <security:global-method-security
    jsr250-annotations="enabled"
    pre-post-annotations="enabled"
    secured-annotations="enabled"/>
</beans>

Spring 在控制器中使用@security 注释的安全性

Spring security using @security annotation in controller

java

xml

spring

maven

spring-annotations