Java 具有多重身份验证的Spring安全性

您好，我如何为我的控制器和restController使用此命令。。。。 比如->html视图的顺序1和RESTAPI的顺序2 我想在春季使用rest和mvc将其用于webapp

具有多个HTTP元素的多个入口点

我想我应该在我的控制器类中使用顺序

@Configuration
@EnableWebMvcSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    UserDetailsService userDetailsService;

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userDetailsService);
    }

    @Configuration
    @Order(1)
    public static class ApiWebSecurityConfig extends WebSecurityConfigurerAdapter {

        @Override
        protected void configure(HttpSecurity http) throws Exception {
            http.authorizeRequests()
                    .antMatchers("/").permitAll()
                    .antMatchers("/user/**").hasRole("EMPLOYEE")
                    .anyRequest().authenticated()
                    .and()
                    .formLogin()
                    .loginPage("/LoginPage")
                    .loginProcessingUrl("/authenticateTheUser")
                    .successHandler(customAuthenticationSuccessHandler)
                    .permitAll()
                    .and()
                    .logout().permitAll() `enter code here`
                    .and()
                    .exceptionHandling().accessDeniedPage("/access-denied");
        }
    }

    @Configuration
    @Order(2)
    public class ApiWebSecurityConfig extends WebSecurityConfigurerAdapter {

        @Override
        protected void configure(AuthenticationManagerBuilder auth) throws Exception {
            auth.authenticationProvider(m.authenticationProvider());
        }

        @Override
        protected void configure(HttpSecurity http) throws Exception {

            http.authorizeRequests()
                    .antMatchers(HttpMethod.GET, "/api/**").hasRole("EMPLOYEE")
                    .and()
                    .httpBasic()
                    .and()
                    .csrf().disable()
                    .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);

        }

    }

}

---

我致力于解决这个问题，并找到了在单个应用程序中使用SpringRESTAPI和SpringMVC的方法 在一个没有安全性的项目中使用它们很容易 对于spring-rest-security和spring-mvc-security以及login-page和rest-basic-auth-registery，我们应该在项目中使用httpBasic（）

对于url使用

@Configuration
@EnableWebSecurity
public class MultipleEntryPointsSecurityConfig extends WebSecurityConfigurerAdapter {

   @Autowired
   private UserService userService;

   @Autowired
   private CustomAuthenticationSuccessHandler customAuthenticationSuccessHandler;

   @Override
   protected void configure(AuthenticationManagerBuilder auth) throws Exception {
       auth.authenticationProvider(authenticationProvider());
   }

// this is filter for mappings for api and mvc mappings
// http://username:password@localhost:8080/api/members/
   @Override
   protected void configure(HttpSecurity http) throws Exception {

       http.authorizeRequests()
               .antMatchers("/").hasRole("EMPLOYEE")
               .antMatchers("/leaders/**").hasRole("MANAGER")
               .antMatchers("/systems/**").hasRole("ADMIN")
               .antMatchers(HttpMethod.GET, "/api/**").hasRole("EMPLOYEE")
               .and()

               .httpBasic()
               .and()

               .formLogin()
               .loginPage("/showMyLoginPage")
               .loginProcessingUrl("/authenticateTheUser")
               .successHandler(customAuthenticationSuccessHandler)
               .permitAll()
               .and()
               .logout().permitAll()
               .and()
               .exceptionHandling().accessDeniedPage("/access-denied");

   }

   @Bean
   public BCryptPasswordEncoder passwordEncoder() {
       return new BCryptPasswordEncoder();
   }

   @Bean
   public DaoAuthenticationProvider authenticationProvider() {
       DaoAuthenticationProvider auth = new DaoAuthenticationProvider();
       auth.setUserDetailsService(userService); //set the custom user details service
       auth.setPasswordEncoder(passwordEncoder()); //set the password encoder - bcrypt
       return auth;
   }

}