使用 Spring Security 保护 GWT servlet

Question

我正在编写一个使用 Spring 安全性保护的 GWT 应用程序。登录正常，但授权不行。

我尝试在我的方法上使用 @Secured 和 @PreAuthorize 注释，但也没有用。

例如，这是来自 AppUserServiceImpl 的代码 sn-p

@Secured("ROLE_ADMINISTRATOR")
    @Override
    public List<AppUser> fetch(Integer startRow, Integer endRow, Map criteria) {
        return appUserManagerBean.getUsers(criteria);
    }

ApplicationContext.xml

<?xml version="1.0" encoding="UTF-8"?>

<beans:beans xmlns="http://www.springframework.org/schema/security"
             xmlns:beans="http://www.springframework.org/schema/beans"
             xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
             xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
                        http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.0.xsd">


<http auto-config="true">
    <intercept-url pattern="/testapplication/**" access="ROLE_USER"/>
    <intercept-url pattern="/gwt/**" access="ROLE_USER"/>
    <intercept-url pattern="/**/*.html" access="ROLE_USER"/>
    <intercept-url pattern="/**" access="IS_AUTHENTICATED_ANONYMOUSLY" />
    <intercept-url pattern="/security/*" access="IS_AUTHENTICATED_ANONYMOUSLY" />
    <intercept-url pattern="/testapplication/appUserService*" access="ROLE_ADMIN"/>

    <form-login
            login-page="/login.jsp"
            authentication-failure-url="/security/error.html"
            login-processing-url="/j_spring_security_check"
            />
</http>
<beans:bean id="appUserService" class="com.test.testapplication.server.admin.appuser.AppUserServiceImpl"/>


<beans:bean id="dataSource" class="org.springframework.jdbc.datasource.DriverManagerDataSource">
[DATASOURCE CONFIGURATION]
</beans:bean>
<global-method-security pre-post-annotations="enabled" secured-annotations="enabled" />
<authentication-manager>
    <authentication-provider>
        <password-encoder hash="sha" />
        <jdbc-user-service data-source-ref="dataSource"
                           users-by-username-query="select username,password,DECODE(enabled,'Y',1,'N',0) as enabled from APP_USER where username=?"

                           authorities-by-username-query="select u.username, ur.role from APP_USER u, APP_USER_ROLE ur
                                                          where u.id = ur.APP_USER_ID and u.username =?  "

                />
    </authentication-provider>
</authentication-manager>

为了测试，我正在尝试保护“appUserService”。

web.xml

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns="http://java.sun.com/xml/ns/javaee"
           xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
           xsi:schemaLocation="http://java.sun.com/xml/ns/javaee
          http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
           version="2.5">

    <context-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>
            /WEB-INF/applicationContext.xml
        </param-value>
    </context-param>
    <servlet>
        <servlet-name>appUserService</servlet-name>
    <servlet-class>com.test.testapplication.server.admin.appuser.AppUserServiceImpl</servlet-class>
</servlet>

<!-- Spring security filter -->
<filter>
    <filter-name>springSecurityFilterChain</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>

<filter-mapping>
    <filter-name>springSecurityFilterChain</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>
<!-- Spring listener -->
<listener>
    <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>
<!-- Default page to serve -->
<welcome-file-list>
    <welcome-file>testapplication.html</welcome-file>
</welcome-file-list>

我正在寻找最简单的解决方案，我不想使用 AspectJ，非常感谢您的帮助

Answer 1

您在哪里将您的 servlet 映射到特定路径？

我使用gwt-sl 来集成RemoteServiceServlets 和Spring。 在 web.xml 中定义 Dispatcher servlet：

<servlet>
    <servlet-name>gwtservice</servlet-name>
    <servlet-class> org.springframework.web.servlet.DispatcherServlet </servlet-class>
    <load-on-startup>1</load-on-startup>
</servlet>

以及您的 gwt-servlet 的声明和映射：

<bean name="DeviceListenerServlet" class="your.package.your.SomeService"/>
<bean id="urlMappingGWT" class="org.gwtwidgets.server.spring.GWTHandler">
    <property name="mappings">
        <map>
            <entry key="/service" value-ref="DriverServiceImpl"/>
        </map>
    </property>
</bean>

并更改 RemoteService 类中的注释（在我的示例中，它将是 @RemoteServiceRelativePath("gwtservice/service")）。

现在您可以使用 @Secured 注释（如果您添加了）

希望对您有所帮助。