阻止SpringSecurity创建基于cglib的代理

Question

我正在使用spring-boot 2.3.9和spring-security以及keycloak 12.0.4。

@Configuration
@KeycloakConfiguration
@ConditionalOnProperty("keycloak.enabled")
@Import(KeycloakSpringBootConfigResolver.class)
@EnableWebSecurity
@EnableGlobalMethodSecurity(securedEnabled = true, proxyTargetClass = false) // If I exclude this, no cglib based proxy is created, but @Secured is not applied either
public class SecurityConfig extends KeycloakWebSecurityConfigurerAdapter {

和我的服务bean创建配置

@Configuration(proxyBeanMethods = false)
public class EnvironmentConfig {

    @Bean
    // @Scope(proxyMode = ScopedProxyMode.INTERFACES) // Has no effect
    MyServiceInterfaceSecured myService() { new ImplA/ImplB/ImplC() }

}

09:56:38.828 DEBUG [,] --- [main] m.DelegatingMethodSecurityMetadataSource : Caching method [CacheKey[example.MyServiceImplA; ...] with attributes [...]
09:57:12.992  INFO [,] --- [main] o.s.a.f.CglibAopProxy                    : Unable to proxy interface-implementing method [public final java.util.List example.MyServiceImplA.sync()] because it is marked as final: Consider using interface-based JDK proxies instead!
09:57:12.992 DEBUG [,] --- [main] o.s.a.f.CglibAopProxy                    : Final method [public final java.util.List example.MyServiceImplA.sync()] cannot get proxied via CGLIB: Calls to this method will NOT be routed to the target instance and might lead to NPEs against uninitialized fields in the proxy instance.

编辑：这可能与Spring-Cloud-Starter-Sleuth有关。如果我移除这个依赖关系，所有的事情就会像预期的那样工作。但我也需要侦探。

Answer 1

我通过排除spring-boot-starter-aop和spring-cloud-starter-sleuth来修复它。

    <dependency>
        <groupId>org.springframework.cloud</groupId>
        <artifactId>spring-cloud-starter-sleuth</artifactId>
        <exclusions>
            <exclusion>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-starter-aop</artifactId>
            </exclusion>
        </exclusions>
    </dependency>