Spring Security 4。指定访问决策管理器时出现异常

Question

我正在Java项目中使用Spring Security4。当我在http元素中指定标记access-decision-manager-ref时，我有以下异常：

org.springframework.beans.factory.beanCreationException：创建名为“org.springframework.security.filterchains”的bean时出错：使用键[0]设置bean属性“source list”时，无法解析对bean“org.springframework.security.web.defaultsecurityfilterchain#0”的引用；嵌套异常为org.SpringFramework.Beans.Factory.BeanCreationException：创建名为“org.SpringFramework.Security.Web.DefaultSecurityFilterChain#0”的bean时出错：使用键[13]设置构造函数参数时无法解析对bean“org.SpringFramework.Security.Web.Access.Intercept.FilterSecurityInterceptor#0”的引用；嵌套异常为org.SpringFramework.Beans.Factory.BeanCreationException：创建名为“org.SpringFramework.Security.Web.Access.Intercept.FilterSecurityInterceptor#0”的bean时出错：调用init方法失败；嵌套异常为java.lang.IllegalArgumentException：不支持的配置属性:[HasRole('Admin')]

下面是我的xml配置文件：

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:security="http://www.springframework.org/schema/security"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
                    http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd">

<security:http auto-config="true" access-decision-manager-ref="accessDecisionManager"
     use-expressions="true">
    <security:intercept-url pattern="/admin/*"
        access="hasRole('ADMIN')" />
    <security:remember-me key="terror-key" />
    <security:logout delete-cookies="JSESSIONID"
        success-handler-ref="logoutRedirectToAny" />
    <security:form-login login-page="/custom_login"
        authentication-failure-handler-ref="serverErrorHandler" />
</security:http>

<bean id="accessDecisionManager" class="org.springframework.security.access.vote.UnanimousBased">
    <constructor-arg>
        <list>
            <bean class="org.springframework.security.access.vote.RoleVoter" />
            <bean class="org.springframework.security.access.vote.AuthenticatedVoter" />
        </list>
    </constructor-arg>
</bean>

<security:authentication-manager>
    <security:authentication-provider
        user-service-ref="inMemoryUserServiceWithCustomUser" />
</security:authentication-manager>

<bean id="inMemoryUserServiceWithCustomUser"
    class="com.apress.pss.terrormovies.spring.CustomInMemoryUserDetailsManager">
    <constructor-arg>
        <list>
            <bean class="com.apress.pss.terrormovies.model.User">
                <constructor-arg value="admin" />
                <constructor-arg value="admin" />
                <constructor-arg>
                    <list>
                        <bean
                            class="org.springframework.security.core.authority.SimpleGrantedAuthority">
                            <constructor-arg value="ROLE_ADMIN" />
                        </bean>
                    </list>
                </constructor-arg>
                <constructor-arg value="Scarioni" />
            </bean>
        </list>
    </constructor-arg>
</bean>

<bean id="logoutRedirectToAny"
    class="org.springframework.security.web.authentication.logout.SimpleUrlLogoutSuccessHandler">
    <property name="targetUrlParameter" value="redirectTo" />
</bean>

<bean id="serverErrorHandler" class="com.apress.pss.terrormovies.security.ServerErrorFailureHandler"/>

</beans>

Answer 1

如果希望将表达式与自定义AccessDecisionManager一起使用，还需要一个表达式投票器，例如。

<bean id="accessDecisionManager" class="org.springframework.security.access.vote.UnanimousBased">
    <constructor-arg>
        <list>
            <bean class="org.springframework.security.web.access.expression.WebExpressionVoter" />

            <bean class="org.springframework.security.access.vote.RoleVoter" />
            <bean class="org.springframework.security.access.vote.AuthenticatedVoter" />
        </list>
    </constructor-arg>
</bean>