尝试在spring security中配置自定义权限计算器的循环引用

Question

我正在尝试配置一个自定义权限评估器，但每当应用程序启动时，它就会抱怨循环引用。

配置代码为：

@Configuration
@EnableGlobalMethodSecurity(prePostEnabled = true, proxyTargetClass = true)
public class MethodSecurityConfig extends GlobalMethodSecurityConfiguration {
    private static Logger logger = LogManager.getLogger(MethodSecurityConfig.class.getName());

    @Autowired
    DataSource dataSource;

    @Autowired
    Environment env;

    @Autowired
    AuthenticationManager auth;

    public MethodSecurityConfig() {
        logger.debug("Loading method security config.");
    }


    @Override
    protected AuthenticationManager authenticationManager() throws Exception {
        return auth;
    }

    /**
     * Override to set up the custom expression handler.
     * @return The custom expression handler
     */
    @Override
    protected MethodSecurityExpressionHandler createExpressionHandler() {
        return expressionHandler();
    }

    /**
     * Defines a custom permission evaluator to evaluate the access permissions for Spring security.
     * @return The default expression handler configured with a custom permission evaluator.
     */
    @Bean
    public DefaultMethodSecurityExpressionHandler expressionHandler(){
        DefaultMethodSecurityExpressionHandler handler = new DefaultMethodSecurityExpressionHandler();
        handler.setPermissionEvaluator(permissionEvaluator());
        return handler;
    }

    /**
     * Custom implementation of a permission evaluator
     * @return An instance of {@link BasePermissionEvaluator}
     */
    @Bean
    public PermissionEvaluator permissionEvaluator() {
       return new BasePermissionEvaluator();
    }

}

Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'methodSecurityConfig': Injection of autowired dependencies failed; nested exception is org.springframework.beans.factory.BeanCreationException: Could not autowire method: public void org.springframework.security.config.annotation.method.configuration.GlobalMethodSecurityConfiguration.setPermissionEvaluator(java.util.List); nested exception is org.springframework.beans.factory.BeanCurrentlyInCreationException: Error creating bean with name 'permissionEvaluator': Requested bean is currently in creation: Is there an unresolvable circular reference?
    at org.springframework.beans.factory.annotation.AutowiredAnnotationBeanPostProcessor.postProcessPropertyValues(AutowiredAnnotationBeanPostProcessor.java:334) ~[AutowiredAnnotationBeanPostProcessor.class:4.2.1.RELEASE]
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.populateBean(AbstractAutowireCapableBeanFactory.java:1214) ~[AbstractAutowireCapableBeanFactory.class:4.2.1.RELEASE]
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:543) ~[AbstractAutowireCapableBeanFactory.class:4.2.1.RELEASE]
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:482) ~[AbstractAutowireCapableBeanFactory.class:4.2.1.RELEASE]
    at org.springframework.beans.factory.support.AbstractBeanFactory$1.getObject(AbstractBeanFactory.java:305) ~[AbstractBeanFactory$1.class:4.2.1.RELEASE]
    at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:230) ~[DefaultSingletonBeanRegistry.class:4.2.1.RELEASE]
    at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:301) ~[AbstractBeanFactory.class:4.2.1.RELEASE]
    at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:196) ~[AbstractBeanFactory.class:4.2.1.RELEASE]
    at org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:368) ~[ConstructorResolver.class:4.2.1.RELEASE]
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateUsingFactoryMethod(A

Answer 1

我也面临过同样的问题。在我的例子中，原因是有另一个具有@EnableGlobalMethodSecurity注释的安全配置类。删除该注释解决了这个问题。

这里描述了使用两个安全配置类的原因。

根据我的理解，这是在Spring第一次处理另一个配置类时发生的，因为@EnableGlobalMethodSecuritypermissionEvaluator和类似的bean是在那一次注册的，后来在处理这个配置类时，我们得到了这个错误。

看起来这种行为也是任意的，取决于根据类路径顺序首先处理哪个配置类。