在 JBoss 上使用 Spring MVC Security Java Config 时出现 404 错误

Question

我使用 Java Config 编写了一个小型 Spring MVC 应用程序，并使用 Spring Security 3.2.5 对其进行保护。它在 Tomcat 上运行良好，但在 JBoss EAP 6.2 上却不行。它成功部署在 JBoss 上，但是当我请求 Spring MVC 定义的任何页面并且在浏览器中出现 404 错误时，我收到此警告。

WARN [org.springframework.web.servlet.PageNotFound] (http-/127.0.0.1:8080-1) No mapping found for HTTP request with URI [/example-web/pages/login.jsp] in DispatcherServlet with name 'dispatcher'

由于使用了 Spring Security，对于任何需要经过身份验证的用户的请求，例如http://localhost:8080/example-web/start，Spring Security 重定向到 https://localhost:8443/example-web/login 那是我看到警告和 404 错误的时候。

在这里你可以看到我的代码：

public class WebApplicationInitializer extends AbstractAnnotationConfigDispatcherServletInitializer {

@Override
protected Class<?>[] getRootConfigClasses() {
    return new Class[] { RootConfiguration.class};
}

@Override
protected Class<?>[] getServletConfigClasses() {
    return new Class[] { WebMvcConfig.class };
}

@Override
protected String[] getServletMappings() {
    return new String[] { "/*" };
}

@Override
protected Filter[] getServletFilters() {
    return new Filter[] { new HiddenHttpMethodFilter() };
}
}

这是我的 Spring MVC 配置：

@EnableWebMvc
@ComponentScan("com.spring.example.w.controller")
@Configuration
public class WebMvcConfig extends WebMvcConfigurerAdapter {

    @Override
    public void addViewControllers(ViewControllerRegistry registry) {
        registry.addViewController("login").setViewName("login");
        registry.setOrder(Ordered.HIGHEST_PRECEDENCE);
    }

    @Bean
    public InternalResourceViewResolver getInternalResourceViewResolver(){
        InternalResourceViewResolver resolver = new InternalResourceViewResolver();
        resolver.setPrefix("/pages/");
        resolver.setSuffix(".jsp");
        return resolver;
    }
}

下面是我的 Spring Security 配置：

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception{

        http
            .addFilter(myUsernamePasswordAuthenticationFilter())
            .authorizeRequests()
                .antMatchers("/login").permitAll()
                .antMatchers("/admin/**").hasRole("Admin")
                .antMatchers("/start/**").hasRole("Viewer")
                .antMatchers("/user/**").hasRole("User")
                .antMatchers("/**").hasRole("User")
                .and()
            .httpBasic().authenticationEntryPoint(loginUrlAuthenticationEntryPoint())
                .and()
            .logout()
                .permitAll()
                .and()
            .requiresChannel()
                 .anyRequest().requiresSecure();
    }

    @Bean
    public LoginUrlAuthenticationEntryPoint loginUrlAuthenticationEntryPoint(){
        LoginUrlAuthenticationEntryPoint loginUrlAuthenticationEntryPoint = new LoginUrlAuthenticationEntryPoint("/login");
        return loginUrlAuthenticationEntryPoint;
    }


    @Bean
    public ActiveDirectoryLdapAuthenticationProvider activeDirectoryLdapAuthenticationProvider(){
        ActiveDirectoryLdapAuthenticationProvider authProvider = new ActiveDirectoryLdapAuthenticationProvider(my_domain, my_url);
        authProvider.setConvertSubErrorCodesToExceptions(true);
        authProvider.setUseAuthenticationRequestCredentials(true);
        authProvider.setUseAuthenticationRequestCredentials(true);
        authProvider.setUserDetailsContextMapper(userDetailsContextMapper());
        return authProvider;
    }

    @Bean
    public UserDetailsContextMapper userDetailsContextMapper(){
        CustomUserDetailsContextMapper myAuthoritiesPopulator = new CustomUserDetailsContextMapper();
        return myAuthoritiesPopulator;
    }

    @Bean
    public CustomUsernamePasswordAuthenticationFilter myUsernamePasswordAuthenticationFilter()
            throws Exception {
        CustomUsernamePasswordAuthenticationFilter usernamePasswordAuthenticationFilter = new CustomUsernamePasswordAuthenticationFilter();
        usernamePasswordAuthenticationFilter.setAuthenticationManager(authenticationManager());
        usernamePasswordAuthenticationFilter.setAllowSessionCreation(true);
        SavedRequestAwareAuthenticationSuccessHandler successHandler = new SavedRequestAwareAuthenticationSuccessHandler();
        usernamePasswordAuthenticationFilter.setAuthenticationSuccessHandler(successHandler);
        usernamePasswordAuthenticationFilter.setAuthenticationFailureHandler(new SimpleUrlAuthenticationFailureHandler("/login?error"));
        usernamePasswordAuthenticationFilter.afterPropertiesSet();
        return usernamePasswordAuthenticationFilter;
    }

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception{
        auth.authenticationProvider(activeDirectoryLdapAuthenticationProvider());
    }
}

然后是SecurityWebApplicationInitializer：

public class SecurityWebApplicationInitializer extends AbstractSecurityWebApplicationInitializer {
}

和 RootConfig：

@Configuration
@ComponentScan
public class RootConfiguration {
}

以下是我为 SSL 配置 JBoss 的方式：

<subsystem xmlns="urn:jboss:domain:web:1.5" default-virtual-server="default-host" native="false">
    <connector name="http" protocol="HTTP/1.1" scheme="http" socket-binding="http" redirect-port="8443"/>
    <connector name="https" protocol="HTTP/1.1" scheme="https" socket-binding="https" enable-lookups="false" secure="true">
        <ssl name="ssl" password="<my_password>" certificate-key-file="c:\mykeystore.jks" protocol="TLSv1" verify-client="false"/>
    </connector>
    <virtual-server name="default-host" enable-welcome-root="true">
        <alias name="localhost"/>
        <alias name="example.com"/>
    </virtual-server>
</subsystem>

在部署期间，我可以在日志中看到请求确​​实被映射：

INFO  [org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerMapping] (ServerService Thread Pool -- 71) Mapped "{[/start],methods=[GET],params=[],headers=[],consumes=[],produces=[],custom=[]}" onto public org.springframework.web.servlet.ModelAndView com.spring.example.w.controller.StartController.handleStart() throws javax.servlet.ServletException,java.io.IOException
INFO  [org.springframework.web.servlet.handler.SimpleUrlHandlerMapping] (ServerService Thread Pool -- 71) Mapped URL path [/login] onto handler of type [class org.springframework.web.servlet.mvc.ParameterizableViewController]
INFO  [org.springframework.web.context.ContextLoader] (ServerService Thread Pool -- 71) Root WebApplicationContext: initialization completed in 2530 ms
INFO  [org.apache.catalina.core.ContainerBase.[jboss.web].[default-host].[/example-web]] (ServerService Thread Pool -- 71) Initializing Spring FrameworkServlet 'dispatcher'
INFO  [org.springframework.web.servlet.DispatcherServlet] (ServerService Thread Pool -- 71) FrameworkServlet 'dispatcher': initialization started

任何关于为什么我得到 404 错误的帮助，我们非常感谢这个警告。我要再次强调它正在 Tomcat 上运行。提前致谢。

Answer 1

您能否检查是否为 SSL 启用了连接器端口。这个链接有一些细节。 Redirecting from non ssl port 8080 to ssl port 8443

希望对你有帮助