spring boot中如何配置自定义AccessDecisionManager和自定义AuthenticationProvider答案

【问题标题】：How to configure custom AccessDecisionManager and custom AuthenticationProvider in spring bootspring boot中如何配置自定义AccessDecisionManager和自定义AuthenticationProvider
【发布时间】：2018-12-11 20:10:24
【问题描述】：

下面是我的安全配置文件，我想改成java config

<beans:bean id="filterSecurityInterceptor" class="org.springframework.security.web.access.intercept.FilterSecurityInterceptor">
    <beans:property name="accessDecisionManager" ref="accessDecisionManager" />
    <beans:property name="authenticationManager" ref="authenticationManager" />
    <beans:property name="securityMetadataSource" ref="securityMetadataSource" />
</beans:bean>

<authentication-manager alias="authenticationManager" xmlns="http://www.springframework.org/schema/security">
        <authentication-provider ref="customAuthentication"></authentication-provider>
</authentication-manager>

<beans:bean name="accessDecisionManager" class="com.xy.security.CustomAccessDecisionManager" ></beans:bean>

<beans:bean name="securityMetadataSource" class="com..xy.security.InvocationSecurityMetadataSourceService">
</beans:bean>

<beans:bean id="customAuthentication" class="com.xy.security.CustomAuthentication" />

<beans:bean id="securityExceptionTranslationHandler" class="org.springframework.security.web.authentication.ExceptionMappingAuthenticationFailureHandler">
    <beans:property name="exceptionMappings">
        <beans:props>
            <beans:prop key="org.springframework.security.authentication.CredentialsExpiredException">/changepassword.xhtml</beans:prop>
        </beans:props>
    </beans:property>
    <beans:property name="defaultFailureUrl" value="/login.jsp" />
</beans:bean>    ====================================================

我想将其更改为 java config 下面是我的代码，但它失败了

@Configuration

@EnableWebSecurity

public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Autowired
    private CustomAuthentication customAuthentication;

    @Autowired
    private CustomAccessDecisionManager customAccessDecisionManager;

    @Autowired
    private InvocationSecurityMetadataSourceService invocationSecurityMetadataSourceService;

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.authenticationProvider(customAuthentication);
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {

        http.authorizeRequests()
            .antMatchers("/login*","/favicon.ico","/","/**/*.css" ,"/images/*.*","/js/*.js","/bt-fonts/*.*").permitAll()
            .anyRequest().authenticated()
            .and()
            .formLogin().loginPage("/login")
            .defaultSuccessUrl("/admin*")
            .failureUrl("/login?error=true")
            .and()
            .logout().logoutSuccessUrl("/login").invalidateHttpSession(true).deleteCookies("true")
            .and()
            .authenticationProvider(customAuthentication)
            //.accessDecisionManager(customAccessDecisionManager)
            //.authorizeRequests().accessDecisionManager(customAccessDecisionManager)
            //.csrf().disable()
            ;

    }

我有一个有自定义身份验证逻辑的类

public class CustomAccessDecisionManager implements AccessDecisionManager{

  -@Override
    public Authentication authenticate(Authentication authentication){

//这里有一些代码 }

还有一个像下面这样我有自定义授权逻辑的类

public class CustomAuthentication implements AuthenticationProvider{

  @Override
    public void decide(Authentication arg0, Object object, Collection<ConfigAttribute> arg2)

//这里有一些代码

【问题讨论】：

您收到异常了吗？如果是这样，请发布堆栈跟踪。
SecurityConfig 类中我的 customAutentication 和 customAccessMgr 配置有什么问题吗？
如果我正在配置 csrf().disable() 那么控制不会去任何地方它会再次回到我的登录页面。在删除 csrf() 并输入 userid 和 pwd 之后，控件将转到适当的 jsp 页面，但控件不会出现在我的 customAutentication 和 customAccessMgr 类中。在浏览器中它给出了错误-----这个应用程序没有明确的 /error 映射，所以你把它看作是一个后备。出现意外错误（类型=禁止，状态=403）。在请求参数“_csrf”或标头“X-CSRF-TOKEN”上发现无效的 CSRF 令牌“null”。

标签： java spring spring-mvc spring-boot spring-security

【解决方案1】：

第一个（我建议）是更新您的配置以包含 WebExpressionVoter。例如：

     @Bean
public AccessDecissionManager defaultAccessDecisionManager() {
    List<AccessDecisionVoter<FilterInvocation>> voters = new ArrayList<AccessDecisionVoter<FilterInvocation>>();
    voters.add(new WebExpressionVoter());
    voters.add(new CustomVoter());
    AccessDecissionManager result = new UnanimousBased();
    result.setDecisionVoters(voters);
    return result;
}

第二个选项是更改为在 Spring Security 的 url 映射中不使用表达式。例如

protected void configure(HttpSecurity http) throws Exception {
 http
    .apply(new UrlAuthorizationConfigurer())
        .accessDecisionManager(defaultAccessDecisionManager())
        .antMatchers("/admin/**").hasRole("ADMINGROUP")
        .anyRequest().authenticated().and()
    ....

}

view the below link

【讨论】：

【解决方案2】：

@Configuration
@EnableWebMvcSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private CustomAuthenticationProvider customAuthenticationProvider;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        /**
         * Do your stuff here
         */
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.authenticationProvider(customAuthenticationProvider);
    }
}

【讨论】：