Spring安全性：身份验证管理器和全局安全配置，使用xml配置中的Java配置

我使用的是spring security4.2.5.RELEASE和spring4.3.16.RELEASE 我的XML配置工作正常，如下所示

<security:global-method-security secured-annotations="enabled" pre-post-annotations="enabled" access-decision-manager-ref="methodAccessDecisionManager">
        <security:expression-handler ref="methodExpressionHandler"/>
    </security:global-method-security>
    <security:authentication-manager>
        <security:authentication-provider user-service-ref="userDetailsService">
            <security:password-encoder ref="passwordEncoder">
                <security:salt-source user-property="saltSource" />
            </security:password-encoder>
        </security:authentication-provider>         

        <security:authentication-provider user-service-ref="userDetailsService">
            <security:password-encoder ref="bcryptPasswordEncoder"/>
        </security:authentication-provider>
    </security:authentication-manager>

但在这里，我找到了任何东西：

access决策管理器ref=“methodAccessDecisionManager”，安全性：expression handler ref=methodExpressionHandler

和

---

security:salt-source-user-property=saltSource

要指定方法表达式处理程序和访问决策管理器，请使用基于

globalMethodSecurity配置的配置

：

@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
public class MyGlobalMethodSecurityConfiguration extends GlobalMethodSecurityConfiguration {

    @Autowired
    private MethodSecurityExpressionHandler methodExpressionHandler;

    @Autowired
    private AccessDecisionManager methodAccessDecisionManager;

    @Override
    protected MethodSecurityExpressionHandler createExpressionHandler() {
        return methodExpressionHandler;
    }

    @Override
    protected AccessDecisionManager accessDecisionManager() {
        return methodAccessDecisionManager;
    }

}

（从您的

SecurityConfig

中删除

@EnableGlobalMethodSecurity

）

另见

@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
public class MyGlobalMethodSecurityConfiguration extends GlobalMethodSecurityConfiguration {

    @Autowired
    private MethodSecurityExpressionHandler methodExpressionHandler;

    @Autowired
    private AccessDecisionManager methodAccessDecisionManager;

    @Override
    protected MethodSecurityExpressionHandler createExpressionHandler() {
        return methodExpressionHandler;
    }

    @Override
    protected AccessDecisionManager accessDecisionManager() {
        return methodAccessDecisionManager;
    }

}