【发布时间】：2013-11-11 09:13:39
【问题描述】：
我目前正在尝试在一个 cxf REST 服务上使用 spring-security（hmac 身份验证和授权），作为一个捆绑包部署在 Karaf 中。 （karaf 2.3、cxf 2.7.6 和 spring security 3.1.4） 我的问题是我总是得到一个
org.springframework.security.authentication.AuthenticationCredentialsNotFoundException: An Authentication object was not found in the SecurityContext
每当我尝试找到一种方法时。显然，我无法让过滤器链工作也许链接到这个https://issues.apache.org/jira/browse/DOSGI-183，因为我在我的弹簧安全日志中有这个：
Checking sorted filter chain: [Root bean: class[org.springframework.security.web.context.SecurityContextPersistenceFilter]; scope=; abstract=false; lazyInit=false; autowireMode=0; dependencyCheck=0; autowireCandidate=true; primary=false; factoryBeanName=null; factoryMethodName=null; initMethodName=null; destroyMethodName=null, order = 200, <hmacAuthenticationFilter>, order = 800, Root bean: class [org.springframework.security.web.savedrequest.RequestCacheAwareFilter]; scope=; abstract=false; lazyInit=false; autowireMode=0; dependencyCheck=0; autowireCandidate=true; primary=false; factoryBeanName=null; factoryMethodName=null; initMethodName=null; destroyMethodName=null, order = 1300, Root bean: class [org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter]; scope=; abstract=false; lazyInit=false; autowireMode=0; dependencyCheck=0; autowireCandidate=true; primary=false; factoryBeanName=null; factoryMethodName=null; initMethodName=null; destroyMethodName=null, order = 1400, Root bean: class [org.springframework.security.web.access.ExceptionTranslationFilter]; scope=; abstract=false; lazyInit=false; autowireMode=0; dependencyCheck=0; autowireCandidate=true; primary=false; factoryBeanName=null; factoryMethodName=null; initMethodName=null; destroyMethodName=null, order = 1900, <org.springframework.security.web.access.intercept.FilterSecurityInterceptor#0>, order = 2000]
无论如何，这是我的代码：
首先我在一个包A中得到了authenticationFilter和authenticationProvider，分别扩展了AbstractAuthenticationProcessingFilter和AbstractUserDetailsAuthenticationProvider。 过滤器被暴露为 osgi:service，authenticationManager 也是围绕提供者构建的
<security:authentication-manager alias="defaultAuthenticationManager" erase-credentials="true">
<security:authentication-provider ref="hmacAuthProvider"/>
</security:authentication-manager>
<osgi:service ref="hmacAuthenticationFilter" interface="com.security.auth.IHmacAuthenticationFilter"/>
<osgi:service ref="defaultAuthenticationManager" interface="org.springframework.security.authentication.AuthenticationManager"/>
这就是逻辑认证和授权逻辑所在。
现在服务： 一个简单的资源
@Path("test")
public class PocRessource {
@GET
@Produces(MediaType.TEXT_PLAIN)
@Path("m1")
@PreAuthorize("hasRole('ROLE_M1')")
public String m1() {
return "calling m - 1";
}
还有spring applicationContext
<beans --schema goes here --
default-lazy-init="false">
<context:annotation-config />
<context:component-scan base-package="com.security.webservice"/>
<osgi:reference id="hmacAuthenticationFilter" interface="com.security.auth.IHmacAuthenticationFilter"/>
<osgi:reference id="authenticationManager" interface="org.springframework.security.authentication.AuthenticationManager"/>
<bean id="logInbound" class="org.apache.cxf.interceptor.LoggingInInterceptor"/>
<bean id="logOutbound" class="org.apache.cxf.interceptor.LoggingOutInterceptor"/>
<bean id="pocRessource" class="com.security.webservice.PocRessource"/>
<bean id="forbiddenEntryPoint" class="org.springframework.security.web.authentication.Http403ForbiddenEntryPoint"/>
<security:global-method-security pre-post-annotations="enabled"/>
<security:http disable-url-rewriting="true" entry-point-ref="forbiddenEntryPoint" use-expressions="true"
create-session="never" authentication-manager-ref="authenticationManager">
<security:anonymous enabled="false"/>
<security:session-management session-fixation-protection="none"/>
<security:custom-filter ref="hmacAuthenticationFilter" position="FORM_LOGIN_FILTER"/>
<security:intercept-url pattern="/**" access="isFullyAuthenticated()"/>
</security:http>
<jaxrs:server id="pocsecurityWS" address="/pocs/security">
<jaxrs:inInterceptors>
<ref bean="logInbound"/>
</jaxrs:inInterceptors>
<jaxrs:outInterceptors>
<ref bean="logOutbound"/>
</jaxrs:outInterceptors>
<jaxrs:serviceBeans>
<ref bean="pocRessource"/>
</jaxrs:serviceBeans>
</jaxrs:server>
</beans>
bundle 是通过 maven 生成的
<plugin>
<groupId>org.apache.felix</groupId>
<artifactId>maven-bundle-plugin</artifactId>
<extensions>true</extensions>
<configuration>
<supportedProjectTypes>
<supportedProjectType>jar</supportedProjectType>
<supportedProjectType>bundle</supportedProjectType>
<supportedProjectType>war</supportedProjectType>
</supportedProjectTypes>
<instructions>
<Bundle-SymbolicName>${project.groupId}.${project.artifactId}</Bundle-SymbolicName>
<DynamicImport-Package>*</DynamicImport-Package>
<Web-FilterMappings>springSecurityFilterChain;url-patterns:="/*"</Web-FilterMappings>
</instructions>
</configuration>
</plugin>
我错过了什么？
谢谢！
【问题讨论】：
标签： spring-security cxf apache-karaf