Java 如何使用全局方法安全性的分层决策投票者
下面是我的SpringSecurityXML配置的完整代码Java 如何使用全局方法安全性的分层决策投票者,java,spring,spring-security,spring-security-oauth2,Java,Spring,Spring Security,Spring Security Oauth2,下面是我的SpringSecurityXML配置的完整代码 <beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:oauth="http://www.springframework.org/schema/security/oauth2" xml
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:oauth="http://www.springframework.org/schema/security/oauth2"
xmlns:sec="http://www.springframework.org/schema/security"
xsi:schemaLocation="http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans-4.2.xsd
http://www.springframework.org/schema/security
http://www.springframework.org/schema/security/spring-security-3.2.xsd
http://www.springframework.org/schema/security/oauth2
http://www.springframework.org/schema/security/spring-security-oauth2-1.0.xsd">
<!-- Definition of the Authentication Service
For Authenticating a User the Client application will send request to the URL "/oauth/token". This request will contain the clientId, client password, userName and user password details
-->
<http pattern="/oauth/token" create-session="stateless" authentication-manager-ref="clientAuthenticationManager"
xmlns="http://www.springframework.org/schema/security" >
<intercept-url pattern="/oauth/token" access="IS_AUTHENTICATED_FULLY"/>
<anonymous enabled="false"/>
<http-basic entry-point-ref="clientAuthenticationEntryPoint"/>
<!-- include this only if you need to authenticate clients via request parameters -->
<custom-filter ref="clientCredentialsTokenEndpointFilter" after="BASIC_AUTH_FILTER"/> <!-- http/http-basic -->
<access-denied-handler ref="oauthAccessDeniedHandler"/>
</http>
<http pattern="/**" entry-point-ref="oauthAuthenticationEntryPoint"
xmlns="http://www.springframework.org/schema/security" use-expressions="true" auto-config="true">
<anonymous enabled="false"/>
<custom-filter ref="specializedResourceServerFilter"
before="PRE_AUTH_FILTER" />
<access-denied-handler ref="oauthAccessDeniedHandler"/>
</http>
<bean id="oauthAuthenticationEntryPoint"
class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint"/>
<bean id="clientAuthenticationEntryPoint"
class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint">
<property name="realmName" value="client"/>
<property name="typeName" value="Basic"/>
</bean>
<bean id="oauthAccessDeniedHandler"
class="org.springframework.security.oauth2.provider.error.OAuth2AccessDeniedHandler"/>
<bean id="clientCredentialsTokenEndpointFilter"
class="org.springframework.security.oauth2.provider.client.ClientCredentialsTokenEndpointFilter">
<property name="authenticationManager" ref="clientAuthenticationManager"/>
</bean>
<bean id="oAuth2authenticationManager" class="org.springframework.security.oauth2.provider.authentication.OAuth2AuthenticationManager">
<property name="tokenServices" ref="tokenServices"/>
<property name="resourceId" value="myId"/>
</bean>
<bean id="specializedResourceServerFilter" class="com.my.backend.authentication.oauth2.OAuth2AuthenticationProcessingCustomFilter">
<property name="authenticationManager" ref="oAuth2authenticationManager"/>
</bean>
<bean id="customAuthenticationManager"
class="com.my.backend.read.rest.authentication.MyDBAuthenticationProvider"/>
<bean id="myJDBCAuthenticationProvider"
class="com.my.backend.authentication.MyJDBCAuthenticationProvider"/>
<!-- Authentication in config file -->
<authentication-manager id="clientAuthenticationManager" xmlns="http://www.springframework.org/schema/security">
<authentication-provider user-service-ref="clientDetailsUserService"/>
</authentication-manager>
<!-- authentication Manager called auto and their provider is called -->
<authentication-manager alias="authenticationManager" xmlns="http://www.springframework.org/schema/security">
<authentication-provider ref="customAuthenticationManager"/>
<authentication-provider ref="myJDBCAuthenticationProvider"/>
</authentication-manager>
<bean id="clientDetailsUserService"
class="org.springframework.security.oauth2.provider.client.ClientDetailsUserDetailsService">
<constructor-arg ref="clientDetails"/>
</bean>
<!-- Token Store -->
<bean id="tokenStore" class="org.springframework.security.oauth2.provider.token.store.JdbcTokenStore">
<constructor-arg ref="jdbcDataSource" />
</bean>
<bean id="jdbcDataSource"
class="org.springframework.jdbc.datasource.DriverManagerDataSource">
<property name="driverClassName" value="com.mysql.jdbc.Driver"/>
<property name="url" value="#{systemProperties['JDBC_CONNECTION_STRING']}/#{systemProperties['DATABASE']}?autoReconnect=true"/>
<property name="username" value="#{systemProperties['USER_NAME']}"/>
<property name="password" value="#{systemProperties['PASSWORD']}"/>
</bean>
<bean id="tokenServices" class="com.my.backend.authentication.oauth2.CustomTokenServices">
<property name="tokenStore" ref="tokenStore"/>
<property name="supportRefreshToken" value="true"/>
<property name="clientDetailsService" ref="clientDetails"/>
<!-- VIV -->
<property name="accessTokenValiditySeconds" value="7776000"/>
</bean>
<bean id="userApprovalHandler"
class="org.springframework.security.oauth2.provider.approval.TokenStoreUserApprovalHandler">
<property name="tokenStore" ref="tokenStore"/>
<property name="requestFactory" ref="oAuth2RequestFactory"/>
</bean>
<bean id="oAuth2RequestFactory"
class="org.springframework.security.oauth2.provider.request.DefaultOAuth2RequestFactory">
<constructor-arg ref="clientDetails"/>
</bean>
<!-- Token management -->
<oauth:authorization-server client-details-service-ref="clientDetails" token-services-ref="tokenServices"
user-approval-handler-ref="userApprovalHandler">
<oauth:implicit/>
<oauth:refresh-token/>
<oauth:client-credentials/>
<oauth:password/>
</oauth:authorization-server>
<oauth:resource-server id="resourceServerFilter"
token-services-ref="tokenServices"/>
<!-- Client Definition -->
<bean id="clientDetails"
class="com.my.backend.authentication.oauth2.JdbcClientDetailsService" >
<constructor-arg name="dataSource" ref="jdbcDataSource" />
</bean>
<sec:global-method-security pre-post-annotations="enabled" proxy-target-class="true">
<sec:expression-handler ref="oauthExpressionHandler"/>
</sec:global-method-security>
<oauth:expression-handler id="oauthExpressionHandler"/>
<oauth:web-expression-handler id="oauthWebExpressionHandler"/>
</beans>
虽然我没有在上述XML配置中设置任何访问决策管理器,但我认为它在默认情况下被调用,我不知道如何调用。总之,我想添加分层访问决策投票者,所以我创建了自己的访问决策管理器,并在其中引用分层,在http元素中引用,如下所示:
<http pattern="/**" access-decision-manager-ref="*myAccessDecisionManager*" entry-point-ref="oauthAuthenticationEntryPoint"
xmlns="http://www.springframework.org/schema/security" use-expressions="true" auto-config="true">
<anonymous enabled="false"/>
<custom-filter ref="specializedResourceServerFilter"
before="PRE_AUTH_FILTER" />
<access-denied-handler ref="oauthAccessDeniedHandler"/>
</http>
<bean id="accessDecisionManager" class="org.springframework.security.access.vote.AffirmativeBased">
<property name="decisionVoters">
<list>
<bean class="org.springframework.security.access.vote.RoleVoter"/>
<bean class="org.springframework.security.access.vote.AuthenticatedVoter"/>
</list>
</property>
</bean>
它确实调用了,但在那三个默认访问决策投票者也调用了之后,我不知道如何跳过它。请帮忙
编辑:
为了弄清楚下面提到的访问决策投票者是如何设置的,现在我陷入了我在下面提到的HiarichalRoleVoter中,我想允许客户访问具有public role@PreAuthorizeharRole'role_public'的方法。
但它无法访问它
<bean id="accessDecisionManager" class="org.springframework.security.access.vote.AffirmativeBased"
xmlns="http://www.springframework.org/schema/beans">
<constructor-arg>
<list>
<ref bean="roleVoter" />
<bean class="org.springframework.security.access.vote.AuthenticatedVoter"/>
</list>
</constructor-arg>
</bean>
<bean id="roleVoter" class="org.springframework.security.access.vote.RoleHierarchyVoter">
<constructor-arg ref="roleHierarchy" />
</bean>
<bean id="roleHierarchy"
class="org.springframework.security.access.hierarchicalroles.RoleHierarchyImpl">
<property name="hierarchy">
<value>
ROLE_CUSTOMER > ROLE_PUBLIC
</value>
</property>
</bean>
<sec:global-method-security pre-post-annotations="enabled" access-decision-manager-ref="accessDecisionManager" >
<sec:expression-handler ref="methodSecurityExpressionHandler"/>
</sec:global-method-security>
<bean id = "methodSecurityExpressionHandler"
class = "org.springframework.security.access.expression.method.DefaultMethodSecurityExpressionHandler">
<property name = "roleHierarchy" ref="roleHierarchy"/>
</bean>
未显示myAccessDecisionManager,但我假设它扩展了org.springframework.security.access.vote.AffirmativeBased或其父AbstractAccessDecisionManager。如果是这样,那么您可以尝试使用DecisionInvestors属性,如下所示:
<http pattern="/**" access-decision-manager-ref="*myAccessDecisionManager*" entry-point-ref="oauthAuthenticationEntryPoint"
xmlns="http://www.springframework.org/schema/security" use-expressions="true" auto-config="true">
<anonymous enabled="false"/>
<custom-filter ref="specializedResourceServerFilter"
before="PRE_AUTH_FILTER" />
<access-denied-handler ref="oauthAccessDeniedHandler"/>
</http>
<bean id="accessDecisionManager" class="org.springframework.security.access.vote.AffirmativeBased">
<property name="decisionVoters">
<list>
<bean class="org.springframework.security.access.vote.RoleVoter"/>
<bean class="org.springframework.security.access.vote.AuthenticatedVoter"/>
</list>
</property>
</bean>
指定你喜欢的选民
另一种选择是设置快捷方式并避免使用投票者:只需在决策管理器实现中硬编码您的决策逻辑。您可以显示您的myAccessDecisionManager代码和定义吗?这里再次询问正确的方式:我应该在哪里引用AccessDecisionManager对象?您已经这样做了,不是吗?access决策管理器ref=*myAccessDecisionManager*这些带有肯定的默认投票者是从基于肯定的全局方法安全性调用的。不管怎么说,它已经完成了,但现在我被困在了角色层次结构中。代码编码角色\客户>角色\公共代码