Spring - 5 getAuthorities() 仍然使用“ROLE_”前缀答案

【问题标题】：Spring - 5 getAuthorities() still uses "ROLE_" prefixSpring - 5 getAuthorities() 仍然使用“ROLE_”前缀
【发布时间】：2020-07-01 00:11:17
【问题描述】：

亲爱的，我正在使用 spring 5 并且希望删除 ROLE_ 前缀。因此我使用了“grantedAuthorityDefaults”并将角色前缀设置为“”。不幸的是，当我稍后在没有登录（公共访问权限）的页面上调用 SecurityContextHolder.getContext().getAuthentication().getAuthorities() 时，我仍然得到带有“ROLE_”前缀“ROLE_ANONYMOUS”的值，并且我在 JSON Rest 控制器建议中的映射逻辑失败。

我需要在其他地方声明 ROLE 前缀 = "" 的任何命中？

@Configuration
@EnableWebSecurity(debug = true)
@EnableGlobalMethodSecurity(securedEnabled = true, prePostEnabled = true, jsr250Enabled = true)
public class WebSecurityJwtConfiguration extends WebSecurityConfigurerAdapter {
    ...
    @Bean
    public GrantedAuthorityDefaults grantedAuthorityDefaults() {
        return new GrantedAuthorityDefaults("");
    }
    ...
}

@RestControllerAdvice
public class CoreSecurityJsonViewControllerAdviceimplements ResponseBodyAdvice<Object> {

    protected void beforeBodyWriteInternal(MappingJacksonValue mappingJacksonValue, MediaType mediaType, MethodParameter methodParameter, ServerHttpRequest serverHttpRequest, ServerHttpResponse serverHttpResponse) {
        if (SecurityContextHolder.getContext().getAuthentication() != null && SecurityContextHolder.getContext().getAuthentication().getAuthorities() != null) {

           // HERE I still get values with "ROLE_" prefix

            Collection<? extends GrantedAuthority> authorities = SecurityContextHolder.getContext().getAuthentication().getAuthorities();
            Class prioritizedJsonView = this.getJsonViews(authorities);
            if (prioritizedJsonView != null) {
                mappingJacksonValue.setSerializationView(prioritizedJsonView);
            }
        }
    }

    protected Class getJsonViews(Collection<? extends GrantedAuthority> authorities) {
        Optional var10000 = authorities.stream().map(GrantedAuthority::getAuthority).map(Role::valueOf).max(Comparator.comparing(Enum::ordinal));
        Map var10001 = View.MAPPING;
        var10001.getClass();
        return (Class)var10000.map(var10001::get).orElse((Object)null);
    }

    @Override
    protected Class getJsonViews(Collection<? extends GrantedAuthority> authorities) {
        return authorities.stream()
                .map(GrantedAuthority::getAuthority)
                .map(Role::valueOf)
                .max(Comparator.comparing(Role::ordinal))
                .map(View.MAPPING::get)
                .orElse(null);
    }
}

【问题讨论】：

标签： java spring-security

【解决方案1】：

是的，那是因为 AnonymousAuthenticationFilter Spring Security 使用了 "ROLE_ANONYMOUS" 硬编码。

您可以在 WebSecurityConfigurerAdapter

中使用此覆盖来更改该行为

@Override
protected void configure(HttpSecurity http) throws Exception {
    http.anonymous().authorities("ANONYMOUS"); // or your custom role
}

【讨论】：