Spring security 4@preauthorize（“hasRole（）”）不工作

Question

我的spring security xml

<bean id="expressionHandler" class="org.springframework.security.web.access.expression.DefaultWebSecurityExpressionHandler"/>
<security:global-method-security pre-post-annotations="enabled">
    <security:expression-handler ref="expressionHandler"/>
</security:global-method-security>


<security:http auto-config="true" use-expressions="true">
    <security:access-denied-handler error-page="/403" />
    <security:intercept-url pattern="/login" access="permitAll" />
    <security:intercept-url pattern="/logout" access="permitAll" />
    <security:intercept-url pattern="/css/**/*.css" access="permitAll" />
    <security:intercept-url pattern="/fonts/*.*" access="permitAll" />

    <security:intercept-url pattern="/**" access="isAuthenticated()" />

    <security:form-login login-page="/login" login-processing-url="/login" default-target-url="/landing" authentication-failure-url="/login?error" authentication-success-handler-ref="loginSuccesHandler" />
    <security:logout logout-success-url="/login?logout" logout-url="/logout" invalidate-session="true" />

    <security:session-management session-fixation-protection="none"/>
</security:http>
<security:authentication-manager>
    <security:authentication-provider user-service-ref="userDetailsService">
       <security:password-encoder ref="passwordEncoder"/>
    </security:authentication-provider>
</security:authentication-manager>


<bean id="daoAuthenticationProvider" class="org.springframework.security.authentication.dao.DaoAuthenticationProvider">
    <property name="userDetailsService" ref="userDetailsService" />
    <property name="passwordEncoder" ref="passwordEncoder" />
</bean>

我的所有角色都存储在数据库中，并且有一个类似于此链接中的1的模式。在我的自定义userdetailservice中，我将从数据库加载它。我的角色价值观是这样的

PYRL-EMPPF-01
PYRL-EMPPF-02
PYRL-EMPPF-03

我甚至尝试过把前缀“role_”，但我似乎不能让它工作。

@RequestMapping(value = "/URLABC", method = RequestMethod.GET)
@PreAuthorize("hasRole('ROLE_PYRL-EMPPF-01')")
public ModelAndView search(HttpSession session) throws Exception {
...
}

Answer 1

不知怎么的，我设法偶然找到了答案

<bean id="expressionHandler" class="org.springframework.security.access.expression.method.DefaultMethodSecurityExpressionHandler"/>
<security:global-method-security pre-post-annotations="enabled">
    <security:expression-handler ref="expressionHandler"/>
</security:global-method-security>

我只需要将这个spring配置从spring security xml配置放到spring servlet配置中。

这是我的web.xml。以前，上面的配置是application-security.xml中的，现在我将它移到dispatcher-servlet.xml中。

<context-param>
    <param-name>contextConfigLocation</param-name>
    <param-value>
        /WEB-INF/dispatcher-servlet.xml
        /WEB-INF/application-security.xml
    </param-value>
</context-param>