Spring security：设置构造函数参数时无法解析对bean的引用

Question

我正在 Spring Security 中实现记住我。这是我的配置

<bean id="rememberMeServices"
          class="com.spring.security.service.WMPersistentTokenBasedRememberMeServices">
        <constructor-arg name="userDetailsService" ref="loginService"/>
        <property name="tokenValiditySeconds" value="300"></property>
 </bean>


<security:http auto-config="false" use-expressions="true" entry-point-ref="appAuthenticationEntryPoint">
        <!-- Interceptor urls -->
        <security:remember-me user-service-ref="#{rememberMeServices.getUserDetailsServiceInstance()}" token-repository-ref="#{rememberMeServices.getTokenRepository()}" />
</security:http>

我的 WMPersistentTokenBasedRememberMeServices 看起来像

public class WMPersistentTokenBasedRememberMeServices extends PersistentTokenBasedRememberMeServices {

    private static final String key = "WM_APP_KEY";

    private static final PersistentTokenRepository tokenRepository = new InMemoryTokenRepositoryImpl();

    public WMPersistentTokenBasedRememberMeServices(UserDetailsService userDetailsService) {
        super(key, userDetailsService, tokenRepository);
    }

    public PersistentTokenRepository getTokenRepository() {
        return tokenRepository;
    }

    public UserDetailsService getUserDetailsServiceInstance()
    {
        return getUserDetailsService();
    }
} 

但是当我使用上述配置部署应用程序时，我得到以下错误

Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name '(inner bean)#61fc8560': Cannot resolve reference to bean 'org.springframework.security.web.authentication.rememberme.PersistentTokenBasedRememberMeServices#0' while setting bean property 'logoutHandlers' with key [0]; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.springframework.security.web.authentication.rememberme.PersistentTokenBasedRememberMeServices#0': Cannot resolve reference to bean '#{rememberMeServices.getTokenRepository()}' while setting constructor argument; nested exception is org.springframework.beans.factory.NoSuchBeanDefinition
Exception: No bean named 'org.springframework.security.web.authentication.rememberme.InMemoryTokenRepositoryImpl@2a13c5e' is defined


Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.springframework.security.web.authentication.rememberme.PersistentTokenBasedRememberMeServices#0': Cannot resolve reference to bean '#{rememberMeServices.getTokenRepository()}' while setting constructor argument; nested exception is org.springframework.beans.factory.NoSuchBeanDefinitionException: No bean named 'org.springframework.security.web.authentication.rememberme.InMemoryTokenRepositoryImpl@2a13c5e' is defined

当我在

中使用 spring 表达式语言删除时

 <security:remember-me ...>

标记并提供有效的用户引用实例，它工作正常。

但是当我使用 spring 表达式语言时，它会因上述错误而失败。我怀疑 bean 创建的顺序。

任何人对此错误有想法？

Answer 1

错误信息说明了一切：

Exception: No bean named 'org.springframework.security.web.authentication.rememberme.InMemoryTokenRepositoryImpl@2a13c5e' is defined

令牌存储库不是 bean。事实上，如果您查看您的代码，TokenRepository 是一个静态字段。不要使用静态字段，而是将其声明为 bean：在您的 xml 配置中，添加类似：

<bean id="tokenRepository"
      class="org.springframework.security.web.authentication.rememberme.InMemoryTokenRepositoryImpl"/>

并用类似的东西替换静态字段：

@Autowired
private PersistentTokenRepository tokenRepository;

Spring，作为一个依赖注入框架，提供了有用的机制来避免使用静态引用：只需使用这些机制。