我如何使用 Spring java 安全配置获取对 AuthenticationManager 的引用？

Question

我正在使用 Spring 4.1.5.RELEASE 和 Spring 安全 3.2.5.RELEASE。我正在通过 Java（而不是 XML）进行所有安全配置。我正在努力获取对 AuthenticationManager 的引用，以便与我的自定义用户名密码身份验证过滤器一起使用……

@Configuration
@EnableWebSecurity
@ComponentScan(basePackages="com.mainco", excludeFilters=@ComponentScan.Filter(Controller.class))
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    private static final String ROLE3 = "ROLE3";
    private static final String ROLE2 = "ROLE2";
    private static final String ROLE1 = "ROLE1";

    @Resource(name="userDetailsService")
    private UserDetailsService userDetailsService;

    @Resource(name="myAuthenticationSuccessHandler")
    private MyAuthenticationSuccessHandler authSuccessHandler;

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userDetailsService).passwordEncoder(passwordEncoder());
    }

    @Override
    public void configure(HttpSecurity http) throws Exception {
        http.addFilterBefore(authenticationFilter(), MyUsernamePasswordAuthenticationFilter.class);
        http
            .authorizeRequests()
                .antMatchers("/403").permitAll()
                .antMatchers("/login/**").permitAll()
                .antMatchers("/resources/**").permitAll()
                .antMatchers("/ROLE1/**").hasRole(ROLE1)
                .antMatchers("/common/**").hasAnyRole(ROLE1, ROLE2, ROLE3)
                .antMatchers("/ROLE3/**").hasAnyRole(ROLE1, ROLE2, ROLE3)
                .antMatchers("/ROLE2/**").hasAnyRole(ROLE1, ROLE2)
                .antMatchers("/*/**").fullyAuthenticated()
            .and().formLogin()
                .loginPage("/login")
                .failureUrl("/login?error")
                .usernameParameter("username")
                .passwordParameter("password")
                .successHandler(authSuccessHandler)
            .and().logout().logoutSuccessUrl("/login?logout")
            .and().exceptionHandling().accessDeniedPage("/403")
            .and().csrf().disable();
    }

    @Bean(name="passwordEncoder")
    public PasswordEncoder passwordEncoder() {
        return new StandardPasswordEncoder();
    }

    @Bean
    public JSONUsernamePasswordAuthenticationFilter authenticationFilter() {
        final MyUsernamePasswordAuthenticationFilter authFilter = new MyUsernamePasswordAuthenticationFilter();
        authFilter.setAuthenticationSuccessHandler(authSuccessHandler);
        authFilter.setUsernameParameter("username");
        authFilter.setPasswordParameter("password");
        return authFilter;
    }

此配置在启动时失败并显示消息

“Caused by: java.lang.IllegalArgumentException: authenticationManager must be specified”.

如何获取对 AuthenticationManager 的引用以用于我的过滤器？

Answer 1

您可以覆盖 WebSecurityConfigurerAdapter 中的 authenticationManagerBean() 方法以将 AuthenticationManager 公开为一个 bean，如下所示：

@Bean
@Override
public AuthenticationManager authenticationManagerBean() throws Exception {
    return super.authenticationManagerBean();
}

我如何使用 Spring java 安全配置获取对 AuthenticationManager 的引用？

How do i get a reference to an AuthenticationManager using a Spring java security configuration?

spring

authentication

spring-security

autowired