Spring 成功登录后：AuthenticationCredentialsNotFoundException:在SecurityContext中未找到身份验证对象_Spring_Spring Security

Spring 成功登录后：AuthenticationCredentialsNotFoundException:在SecurityContext中未找到身份验证对象

spring spring-security

Spring 成功登录后：AuthenticationCredentialsNotFoundException:在SecurityContext中未找到身份验证对象,spring,spring-security,Spring,Spring Security,我有一个奇怪的问题，在我登录后，我可以发出一个请求，之后每个请求都会抛出一个SpringAuthenticationCredentialsNotFoundException。我不知道为什么会这样在myLoginService中，我使用myAdminAuthenticationProvider让用户登录： public class LoginService { private AuthenticationProvider adminAuthenticationProvider;

我有一个奇怪的问题，在我登录后，我可以发出一个请求，之后每个请求都会抛出一个Spring

AuthenticationCredentialsNotFoundException

。我不知道为什么会这样

在my

LoginService

中，我使用my

AdminAuthenticationProvider

让用户登录：

public class LoginService {

    private AuthenticationProvider adminAuthenticationProvider;     

    public LoginService(DSLContext ctx, AuthenticationProvider adminAuthenticationProvider) {       
        this.adminAuthenticationProvider = adminAuthenticationProvider;
    }

    @Transactional
    public void login(String userId, String password) {

        CustomUserDetails user = new CustomUserDetails(userId, password, true, true, true, true, new ArrayList<GrantedAuthority>());

        Authentication auth = new UsernamePasswordAuthenticationToken(user, password,
                new ArrayList<GrantedAuthority>());     

        try {
            auth = this.adminAuthenticationProvider.authenticate(auth);
        } catch(BadCredentialsException e) {
            throw e;
        }

        SecurityContext sc = new SecurityContextImpl();
        sc.setAuthentication(auth);

        SecurityContextHolder.setContext(sc);       
    }
}

正如您看到的，这里没有任何内容真正得到检查，用户只是登录。然而，在那之后，我总是得到例外。目前我只使用

isAuthenticated（）

@PreAuthorize（“isAuthenticated（）”）
公共列表getAvailableStores（）{
// ..
返回结果；
}

这里有什么问题

这是我的配置applicationContext spring acl.xml

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:security="http://www.springframework.org/schema/security"
    xmlns:p="http://www.springframework.org/schema/p" xmlns:jdbc="http://www.springframework.org/schema/jdbc"

    xmlns:sec="http://www.springframework.org/schema/security"

    xsi:schemaLocation="http://www.springframework.org/schema/beans 
        http://www.springframework.org/schema/beans/spring-beans-4.0.xsd
        http://www.springframework.org/schema/security 
        http://www.springframework.org/schema/security/spring-security-4.0.xsd
        http://www.springframework.org/schema/jdbc 
        http://www.springframework.org/schema/jdbc/spring-jdbc-4.0.xsd">

    <!-- Imports -->
    <import resource="applicationContext-jooq.xml"/>

    <!-- See 15.3.2 Built-In Expression @http://static.springsource.org/spring-security/site/docs/3.0.x/reference/el-access.html#el-permission-evaluator -->
    <bean id="expressionHandler" class="org.springframework.security.access.expression.method.DefaultMethodSecurityExpressionHandler">
        <!-- To use hasPermission() in expressions, configure a PermissionEvaluator -->
        <property name="permissionEvaluator" ref="permissionEvaluator" />
        <property name="roleHierarchy" ref="roleHierarchy" />
    </bean>

    <bean class="com.mahlzeit.server.web.auth.permission.CustomAclPermissionEvaluator" id="permissionEvaluator">
        <constructor-arg ref="aclService" />
    </bean>

    <!-- Declare an acl service -->
    <bean class="org.springframework.security.acls.jdbc.JdbcMutableAclService"  id="aclService">
        <constructor-arg ref="dataSource" />
        <constructor-arg ref="lookupStrategy" />
        <constructor-arg ref="aclCache" />
    </bean>

    <!-- Declare a lookup strategy -->
    <bean id="lookupStrategy"
        class="org.springframework.security.acls.jdbc.BasicLookupStrategy">
        <constructor-arg ref="dataSource" />
        <constructor-arg ref="aclCache" />
        <constructor-arg ref="aclAuthorizationStrategy" />
        <constructor-arg ref="auditLogger" />
    </bean>

    <!-- Declare an acl cache -->
    <bean id="aclCache" class="org.springframework.security.acls.domain.EhCacheBasedAclCache">
        <constructor-arg>
            <bean class="org.springframework.cache.ehcache.EhCacheFactoryBean">
                <property name="cacheManager">
                    <bean class="org.springframework.cache.ehcache.EhCacheManagerFactoryBean" p:shared="true"/>
                </property>
                <property name="cacheName" value="aclCache" />
            </bean>
        </constructor-arg>
        <constructor-arg>
            <bean
                class="org.springframework.security.acls.domain.DefaultPermissionGrantingStrategy">
                <constructor-arg>
                    <bean class="org.springframework.security.acls.domain.ConsoleAuditLogger" />
                </constructor-arg>
            </bean>
        </constructor-arg>
        <constructor-arg>
            <bean
                class="org.springframework.security.acls.domain.AclAuthorizationStrategyImpl">
                <constructor-arg>
                    <list>
                        <bean
                            class="org.springframework.security.core.authority.SimpleGrantedAuthority">
                            <constructor-arg value="ROLE_ACL_ADMIN" />
                        </bean>
                    </list>
                </constructor-arg>
            </bean>
        </constructor-arg>      
    </bean>

    <!-- Declare an acl authorization strategy -->
    <bean id="aclAuthorizationStrategy" class="org.springframework.security.acls.domain.AclAuthorizationStrategyImpl">
        <constructor-arg>
            <list>
                <bean
                    class="org.springframework.security.core.authority.SimpleGrantedAuthority">
                    <constructor-arg value="ROLE_ADMIN" />
                </bean>
                <bean
                    class="org.springframework.security.core.authority.SimpleGrantedAuthority">
                    <constructor-arg value="ROLE_ADMIN" />
                </bean>
                <bean
                    class="org.springframework.security.core.authority.SimpleGrantedAuthority">
                    <constructor-arg value="ROLE_ADMIN" />
                </bean>
            </list>
        </constructor-arg>
    </bean>

    <!-- Declare an audit logger -->
    <bean id="auditLogger"
        class="org.springframework.security.acls.domain.ConsoleAuditLogger" />

    <!-- http://static.springsource.org/spring-security/site/docs/3.0.x/apidocs/org/springframework/security/access/hierarchicalroles/RoleHierarchyImpl.html -->
    <bean id="roleHierarchy"
        class="org.springframework.security.access.hierarchicalroles.RoleHierarchyImpl">
        <property name="hierarchy">
            <value>
                ROLE_ADMIN > ROLE_USER
                ROLE_USER > ROLE_VISITOR
            </value>
        </property>
    </bean>

    <sec:global-method-security authentication-manager-ref="authenticationManager" pre-post-annotations="enabled">   
        <sec:expression-handler ref="expressionHandler"/>       
    </sec:global-method-security>
</beans>

<beans xmlns="http://www.springframework.org/schema/beans"

    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 

    xmlns:sec="http://www.springframework.org/schema/security"

    xsi:schemaLocation="http://www.springframework.org/schema/beans 
    http://www.springframework.org/schema/beans/spring-beans-4.1.xsd
    http://www.springframework.org/schema/security 
    http://www.springframework.org/schema/security/spring-security-4.0.xsd"    
    >

    <!-- Imports -->
    <import resource="applicationContext-spring-acl.xml"/>

    <sec:http pattern="/**" auto-config="true" use-expressions="true"/>

    <bean id="httpSessionSecurityContextRepository" class='org.springframework.security.web.context.HttpSessionSecurityContextRepository'>
        <property name='allowSessionCreation' value='false' />
    </bean>

    <bean id="securityContextPersistenceFilter" class="org.springframework.security.web.context.SecurityContextPersistenceFilter">
        <constructor-arg ref="httpSessionSecurityContextRepository" />
    </bean>

    <bean id="filterChainProxy" class="org.springframework.security.web.FilterChainProxy">
        <constructor-arg>
            <list>
                <sec:filter-chain pattern="/**" filters="securityContextPersistenceFilter" />
            </list>
        </constructor-arg>
    </bean>

    <bean id="authenticationListener" class="com.mahlzeit.server.web.auth.CustomAuthenticationListener"/>

    <bean id="adminAuthenticationProvider" class="com.mahlzeit.server.web.auth.AdminAuthenticationProvider">
        <constructor-arg ref="dslContext" />
    </bean>

    <bean id="userDetailsService" class="com.mahlzeit.server.web.service.CustomUserDetailsService"/>

    <sec:authentication-manager alias="authenticationManager">
        <sec:authentication-provider ref="adminAuthenticationProvider"/>
    </sec:authentication-manager>

</beans>


角色\管理>角色\用户
角色用户>角色访问者

这是applicationContext-spring-security.xml

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:security="http://www.springframework.org/schema/security"
    xmlns:p="http://www.springframework.org/schema/p" xmlns:jdbc="http://www.springframework.org/schema/jdbc"

    xmlns:sec="http://www.springframework.org/schema/security"

    xsi:schemaLocation="http://www.springframework.org/schema/beans 
        http://www.springframework.org/schema/beans/spring-beans-4.0.xsd
        http://www.springframework.org/schema/security 
        http://www.springframework.org/schema/security/spring-security-4.0.xsd
        http://www.springframework.org/schema/jdbc 
        http://www.springframework.org/schema/jdbc/spring-jdbc-4.0.xsd">

    <!-- Imports -->
    <import resource="applicationContext-jooq.xml"/>

    <!-- See 15.3.2 Built-In Expression @http://static.springsource.org/spring-security/site/docs/3.0.x/reference/el-access.html#el-permission-evaluator -->
    <bean id="expressionHandler" class="org.springframework.security.access.expression.method.DefaultMethodSecurityExpressionHandler">
        <!-- To use hasPermission() in expressions, configure a PermissionEvaluator -->
        <property name="permissionEvaluator" ref="permissionEvaluator" />
        <property name="roleHierarchy" ref="roleHierarchy" />
    </bean>

    <bean class="com.mahlzeit.server.web.auth.permission.CustomAclPermissionEvaluator" id="permissionEvaluator">
        <constructor-arg ref="aclService" />
    </bean>

    <!-- Declare an acl service -->
    <bean class="org.springframework.security.acls.jdbc.JdbcMutableAclService"  id="aclService">
        <constructor-arg ref="dataSource" />
        <constructor-arg ref="lookupStrategy" />
        <constructor-arg ref="aclCache" />
    </bean>

    <!-- Declare a lookup strategy -->
    <bean id="lookupStrategy"
        class="org.springframework.security.acls.jdbc.BasicLookupStrategy">
        <constructor-arg ref="dataSource" />
        <constructor-arg ref="aclCache" />
        <constructor-arg ref="aclAuthorizationStrategy" />
        <constructor-arg ref="auditLogger" />
    </bean>

    <!-- Declare an acl cache -->
    <bean id="aclCache" class="org.springframework.security.acls.domain.EhCacheBasedAclCache">
        <constructor-arg>
            <bean class="org.springframework.cache.ehcache.EhCacheFactoryBean">
                <property name="cacheManager">
                    <bean class="org.springframework.cache.ehcache.EhCacheManagerFactoryBean" p:shared="true"/>
                </property>
                <property name="cacheName" value="aclCache" />
            </bean>
        </constructor-arg>
        <constructor-arg>
            <bean
                class="org.springframework.security.acls.domain.DefaultPermissionGrantingStrategy">
                <constructor-arg>
                    <bean class="org.springframework.security.acls.domain.ConsoleAuditLogger" />
                </constructor-arg>
            </bean>
        </constructor-arg>
        <constructor-arg>
            <bean
                class="org.springframework.security.acls.domain.AclAuthorizationStrategyImpl">
                <constructor-arg>
                    <list>
                        <bean
                            class="org.springframework.security.core.authority.SimpleGrantedAuthority">
                            <constructor-arg value="ROLE_ACL_ADMIN" />
                        </bean>
                    </list>
                </constructor-arg>
            </bean>
        </constructor-arg>      
    </bean>

    <!-- Declare an acl authorization strategy -->
    <bean id="aclAuthorizationStrategy" class="org.springframework.security.acls.domain.AclAuthorizationStrategyImpl">
        <constructor-arg>
            <list>
                <bean
                    class="org.springframework.security.core.authority.SimpleGrantedAuthority">
                    <constructor-arg value="ROLE_ADMIN" />
                </bean>
                <bean
                    class="org.springframework.security.core.authority.SimpleGrantedAuthority">
                    <constructor-arg value="ROLE_ADMIN" />
                </bean>
                <bean
                    class="org.springframework.security.core.authority.SimpleGrantedAuthority">
                    <constructor-arg value="ROLE_ADMIN" />
                </bean>
            </list>
        </constructor-arg>
    </bean>

    <!-- Declare an audit logger -->
    <bean id="auditLogger"
        class="org.springframework.security.acls.domain.ConsoleAuditLogger" />

    <!-- http://static.springsource.org/spring-security/site/docs/3.0.x/apidocs/org/springframework/security/access/hierarchicalroles/RoleHierarchyImpl.html -->
    <bean id="roleHierarchy"
        class="org.springframework.security.access.hierarchicalroles.RoleHierarchyImpl">
        <property name="hierarchy">
            <value>
                ROLE_ADMIN > ROLE_USER
                ROLE_USER > ROLE_VISITOR
            </value>
        </property>
    </bean>

    <sec:global-method-security authentication-manager-ref="authenticationManager" pre-post-annotations="enabled">   
        <sec:expression-handler ref="expressionHandler"/>       
    </sec:global-method-security>
</beans>

<beans xmlns="http://www.springframework.org/schema/beans"

    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 

    xmlns:sec="http://www.springframework.org/schema/security"

    xsi:schemaLocation="http://www.springframework.org/schema/beans 
    http://www.springframework.org/schema/beans/spring-beans-4.1.xsd
    http://www.springframework.org/schema/security 
    http://www.springframework.org/schema/security/spring-security-4.0.xsd"    
    >

    <!-- Imports -->
    <import resource="applicationContext-spring-acl.xml"/>

    <sec:http pattern="/**" auto-config="true" use-expressions="true"/>

    <bean id="httpSessionSecurityContextRepository" class='org.springframework.security.web.context.HttpSessionSecurityContextRepository'>
        <property name='allowSessionCreation' value='false' />
    </bean>

    <bean id="securityContextPersistenceFilter" class="org.springframework.security.web.context.SecurityContextPersistenceFilter">
        <constructor-arg ref="httpSessionSecurityContextRepository" />
    </bean>

    <bean id="filterChainProxy" class="org.springframework.security.web.FilterChainProxy">
        <constructor-arg>
            <list>
                <sec:filter-chain pattern="/**" filters="securityContextPersistenceFilter" />
            </list>
        </constructor-arg>
    </bean>

    <bean id="authenticationListener" class="com.mahlzeit.server.web.auth.CustomAuthenticationListener"/>

    <bean id="adminAuthenticationProvider" class="com.mahlzeit.server.web.auth.AdminAuthenticationProvider">
        <constructor-arg ref="dslContext" />
    </bean>

    <bean id="userDetailsService" class="com.mahlzeit.server.web.service.CustomUserDetailsService"/>

    <sec:authentication-manager alias="authenticationManager">
        <sec:authentication-provider ref="adminAuthenticationProvider"/>
    </sec:authentication-manager>

</beans>

[http-bio-8080-exec-3]调试com.mz.server.web.servlet.StoreServletImpl-请求的可用存储。
[http-bio-8080-exec-3]DEBUG org.springframework.security.access.intercept.aopalliance.MethodSecurityInterceptor-安全对象：ReflectiveMethodInvocation:public java.util.List com.mz.server.web.service.StoreService.getAvailableStores（）；目标是[com.mz.server.web.service.StoreService]类；属性：[[authorize:'isAuthenticated（）'，filter:'null'，filterTarget:'null']
[http-bio-8080-exec-3]跟踪org.springframework.context.support.ClassPathXmlApplicationContext-org.springframework.context.support中的发布事件。ClassPathXmlApplicationContext@19c3e3e：org.springframework.security.access.event.AuthenticationCredentialsNotFoundEvent[source=ReflectiveMethodInvocation:public java.util.List com.mz.server.web.service.RestaurantService.getAvailableStores（）；目标属于[com.mz.server.web.service.StoreService]类]
原因：org.springframework.security.authentication.AuthenticationCredentialsNotFoundException:在SecurityContext中找不到身份验证对象
位于org.springframework.security.access.intercept.AbstractSecurityInterceptor.credentialsNotFound（AbstractSecurityInterceptor.java:378）
位于org.springframework.security.access.intercept.AbstractSecurityInterceptor.beforeInvocation（AbstractSecurityInterceptor.java:222）
位于org.springframework.security.access.intercept.aopalliance.MethodSecurityInterceptor.invoke（MethodSecurityInterceptor.java:64）
在org.springframework.aop.framework.ReflectiveMethodInvocation.procedue（ReflectiveMethodInvocation.java:179）上
位于org.springframework.aop.framework.CglibAopProxy$DynamicAdvisedInterceptor.intercept（CglibAopProxy.java:655）
在com.mahlzeit.server.web.service.RestaurantService$$EnhancerBySpringCGLIB$$9012bad4_3.getAvailableRestaurants（）上
位于com.mahlzeit.server.web.servlet.RestaurantServletImpl.getAvailableRestaurants（RestaurantServletImpl.java:49）
在sun.reflect.NativeMethodAccessorImpl.invoke0（本机方法）处
位于sun.reflect.NativeMethodAccessorImpl.invoke（NativeMethodAccessorImpl.java:62）
在sun.reflect.DelegatingMethodAccessorImpl.invoke（DelegatingMethodAccessorImpl.java:43）中
位于java.lang.reflect.Method.invoke（Method.java:497）
位于com.google.gwt.user.server.rpc.rpc.invokeAndEncodeResponse（rpc.java:587）
…还有25个
 > p>我不知道您的Login Service是如何与Spring Security集成的。我将考虑自定义用户详细信息服务：
public class CustomUserDetailsService extends JdbcUserDetailsManager implements UserDetailsService {

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {

然后将其集成到您的SecurityConfig中：
@Autowired
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
    ....
    auth.userDetailsService(customUserDetailsService()).passwordEncoder(passwordEncoder);
    auth.authenticationProvider(authenticationProvider);
}

更改这些行：
SecurityContext sc = new SecurityContextImpl();
sc.setAuthentication(auth);
SecurityContextHolder.setContext(sc);

致：
如果使用了HttpSessionSecurityContextRepository
您想将此auth对象绑定到整个会话，.
对不起，我不太明白您在这里的意思。与其使用登录服务（Spring为您做了很多不必要的工作），不如使用普通的Spring用户详细信息服务（例如JdbcUserDetailsManager）或编写您自己的自定义版本。Gergely的回答是正确的。但感谢您的帮助！：）com.mahlzeit.server.web.service.CustomUserDetailsService已经在applicationContext-spring-security.xml中定义。好的，或多或少。是否有类似超时的情况？超时？？您能解释一下您的体验吗？我登录了，正在给您写信。一两分钟后，我发送了另一个请求，我收到了异常又一次。但可能那是另外一回事。我会测试几次，让你知道：）是的，又来了。我回答你的时间似乎足够了，如果我一直请求错误似乎没有发生，异常将返回O_O。嗯。抱歉。没有明确的答案，只是猜测：后台出现了一些不必要的重新启动？（自动发布或其他
SecurityContext sc = new SecurityContextImpl();
sc.setAuthentication(auth);
SecurityContextHolder.setContext(sc);

SecurityContextHolder.getContext().setAuthentication(auth);