如何在没有 HTTP 标签的情况下在 Spring Security 中设置基本身份验证？

Question

我正在设置需要在现有应用程序之上进行简单基本身份验证的 REST 服务。问题是安全上下文已经有一个来自实际应用程序的 http 标签，因此使用标签设置基本身份验证非常简单，我不能使用它，因为那里已经有一个具有完全不同的配置（看看为什么:https://jira.springsource.org/browse/SEC-1171我正在使用 3.0.4，等到 3.1 发布是可能的，但不受欢迎）。

如何从预先存在的配置中排除我的 REST 服务并为其提供基本身份验证？

这是我一直在教程示例应用程序之上玩弄的 aplicationContext-security.xml。事实上，它从未提示我输入我的凭据，而且我不知道要添加什么。

<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security"
xmlns:beans="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
                    http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.0.xsd">

<global-method-security pre-post-annotations="enabled">
</global-method-security>



<beans:bean id="filterChainProxy" class="org.springframework.security.web.FilterChainProxy">
    <filter-chain-map path-type="ant">
        <filter-chain pattern="/**" filters="basicAuthenticationFilter" />
    </filter-chain-map>
</beans:bean>

<beans:bean id="basicAuthenticationFilter"
    class="org.springframework.security.web.authentication.www.BasicAuthenticationFilter">
    <beans:property name="authenticationManager" ref="authManager" />
    <beans:property name="authenticationEntryPoint" ref="authenticationEntryPoint" />
</beans:bean>
<beans:bean id="authenticationEntryPoint" class="org.springframework.security.web.authentication.www.BasicAuthenticationEntryPoint">
    <beans:property name="realmName" value="ems" />
</beans:bean>
<beans:bean id="filterSecurityInterceptor" class="org.springframework.security.web.access.intercept.FilterSecurityInterceptor">
  <beans:property name="authenticationManager" ref="authManager"/>
  <beans:property name="accessDecisionManager" ref="accessDecisionManager"/>
  <beans:property name="securityMetadataSource">
    <filter-security-metadata-source>
      <intercept-url pattern="/secure/extreme/**" access="ROLE_SUPERVISOR"/>
      <intercept-url pattern="/secure/**" access="ROLE_USER" />
      <intercept-url pattern="/**" access="" />
    </filter-security-metadata-source>
  </beans:property>
</beans:bean>
<beans:bean id="accessDecisionManager" class="org.springframework.security.access.vote.AffirmativeBased">
    <beans:property name="decisionVoters">
        <beans:list>
            <beans:bean class="org.springframework.security.access.vote.RoleVoter" />
        </beans:list>
    </beans:property>
</beans:bean>
<beans:bean id="exceptionTranslationFilter"
 class="org.springframework.security.web.access.ExceptionTranslationFilter">
  <beans:property name="authenticationEntryPoint" ref="authenticationEntryPoint"/>
  <beans:property name="accessDeniedHandler" ref="accessDeniedHandler"/>
</beans:bean>
<beans:bean id="accessDeniedHandler" class="org.springframework.security.web.access.AccessDeniedHandlerImpl">
</beans:bean>
<beans:bean id="securityContextPersistenceFilter" class="org.springframework.security.web.context.SecurityContextPersistenceFilter"/>
<!--
Usernames/Passwords are
    rod/koala
    dianne/emu
    scott/wombat
    peter/opal
-->
<authentication-manager alias="authManager">
    <authentication-provider>
        <password-encoder hash="md5"/>
        <user-service>
            <user name="rod" password="a564de63c2d0da68cf47586ee05984d7" authorities="ROLE_SUPERVISOR, ROLE_USER, ROLE_TELLER" />
            <user name="dianne" password="65d15fe9156f9c4bbffd98085992a44e" authorities="ROLE_USER,ROLE_TELLER" />
            <user name="scott" password="2b58af6dddbd072ed27ffc86725d7d3a" authorities="ROLE_USER" />
            <user name="peter" password="22b5c9accc6e1ba628cedc63a72d57f8" authorities="ROLE_USER" />
        </user-service>
    </authentication-provider>
</authentication-manager>

Answer 1

我设法通过在 web.xml 上创建第二个 dispatcherServlet 和 filterChainProxy，然后在 servlet 上创建第二个 security-context.xml 来做到这一点，在这里我可以再次使用该标签，因为它是一个新标签语境。问题是在 web.xml 上设置过滤器的 servletContext 属性，以便它们属于适当的 spring 上下文。这是其中一个过滤器及其对应的 servlet 的示例。

<filter>
    <filter-name>filterChainProxy</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    <init-param>
        <param-name>contextAttribute</param-name>
        <param-value>org.springframework.web.servlet.FrameworkServlet.CONTEXT.servletName</param-value>
    </init-param>
</filter>
<filter-mapping>
    <filter-name>filterChainProxy</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

<servlet>
    <servlet-name>servletName</servlet-name>
    <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
    <init-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>
            pathTo/servletName-servlet.xml,
            pathTo/spring-security.xml
        </param-value>
    </init-param>
</servlet>