Spring Boot、Spring Security-基于XML的配置

Question

Spring引导2.3.4，Spring安全，固定REST控制器（endpoint）。

public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
    public static final String USER = "USER";
    public static final String ADMIN = "ADMIN";

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth
            .inMemoryAuthentication()
                .withUser("user")
                .password("{noop}" + "user123")
                .roles(USER)
            .and()
                .withUser("admin")
                .password("{noop}" + "admin456")
                .roles(ADMIN, USER);
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .httpBasic()
            .and()
            .authorizeRequests()
                .antMatchers("/", "/login").permitAll()
                .antMatchers("/path1/**").hasRole(ADMIN)
                .antMatchers("/path2/**").hasRole(USER)
                .antMatchers(HttpMethod.DELETE, "/path3/{name}").hasRole(ADMIN)
                .antMatchers(HttpMethod.GET, "/path3/{name}").hasRole(USER)
                // more antMatchers...
            .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
            .and()
            .csrf().disable()
            .formLogin().disable();
    }    
}

Answer 1

@Configuration
@ImportResource({ "classpath:webSecurityConfig.xml" })
public class WebSecurityConfig {
    public WebSecurityConfig() {
        super();
    }    
}

<?xml version="1.0" encoding="UTF-8"?>

<beans:beans xmlns="http://www.springframework.org/schema/security" 
             xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
             xmlns:beans="http://www.springframework.org/schema/beans"
             xsi:schemaLocation="
                http://www.springframework.org/schema/security 
                http://www.springframework.org/schema/security/spring-security.xsd 
                http://www.springframework.org/schema/beans 
                http://www.springframework.org/schema/beans/spring-beans.xsd">

    <http create-session="stateless" use-expressions="true">        
        <intercept-url pattern="/" access="permitAll()"/>
        <intercept-url pattern="/login" access="permitAll()"/>
        <intercept-url pattern="/path1/**" access="hasAuthority('ROLE_ADMIN')"/>
        <intercept-url pattern="/path2/**" access="hasAuthority('ROLE_USER')"/>
        <intercept-url method="DELETE" pattern="/path3/{name}" access="hasAuthority('ROLE_ADMIN')"/>
        <intercept-url method="GET" pattern="/path3/{name}" access="hasAuthority('ROLE_USER')"/>

        <http-basic/>         
    </http>

    <authentication-manager>
        <authentication-provider>
            <user-service>
                <user name="user" password="{noop}user123" authorities="ROLE_USER"/>
                <user name="admin" password="{noop}admin456" authorities="ROLE_USER,ROLE_ADMIN"/>
            </user-service>
        </authentication-provider>
    </authentication-manager>
</beans:beans>

但在启动时会显示以下错误

***************************
APPLICATION FAILED TO START
***************************

Description:

Parameter 0 of method setObjectPostProcessor in org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter required a bean of type 'org.springframework.security.config.annotation.ObjectPostProcessor' that could not be found.

Action:

Consider defining a bean of type 'org.springframework.security.config.annotation.ObjectPostProcessor' in your configuration.

不确定有什么不对或遗漏了。到目前为止，谷歌并没有很大的帮助。