Spring security hasRole（）给出错误403-访问被拒绝

Question

我正在尝试查看一个只有管理员才能查看的特定页面，但每次我提出请求时都会出现错误。它似乎与我的security-context文件中的hasRole（）在一起。

当我请求查看admin jsp页面时，错误只显示HTTP状态403-访问被拒绝

<security:http use-expressions="true">
    <security:intercept-url pattern="/admin" access="hasAnyRole('admin')" />
    <security:form-login login-page="/login"
        authentication-failure-url="/login?error=true" />
    <security:logout logout-success-url="/loogedout" />
    <security:intercept-url pattern="/createoffer" access="isAuthenticated()" />
    <security:intercept-url pattern="/docreate" access="isAuthenticated()" />
    <security:intercept-url pattern="/offercreated" access="isAuthenticated()" />
    <security:intercept-url pattern="/" access="permitAll" />
    <security:intercept-url pattern="/loggedout" access="permitAll" />
    <security:intercept-url pattern="/newaccount" access="permitAll" />
    <security:intercept-url pattern="/createaccount" access="permitAll" />
    <security:intercept-url pattern="/accountcreated" access="permitAll" />
    <security:intercept-url pattern="/static/**" access="permitAll" />
    <security:intercept-url pattern="/login" access="permitAll" />
    <security:intercept-url pattern="/offers" access="permitAll" />
    <security:intercept-url pattern="/**" access="denyAll" />
</security:http>

我数据库中的两个表是一个用户（用户名，电子邮件，启用，密码）和一个当局（用户名，当局）。

谁能建议一下我的错误是什么或者如何修复它？

Answer 1

默认情况下，spring添加了role_prefix，因此将hasanyrole('admin')更改为hasanyrole('role_admin')应该可以修复错误，除非您有自定义实现。

参考：

http://docs.spring.io/spring-security/site/docs/current-snapshot/apidocs/org/springframework/security/access/vote/rolevoter.html

https://docs.spring.io/spring-security/site/docs/3.2.3.release/apidocs/org/springframework/security/core/userdetails/jdbc/jdbcdaoimpl.html#setroleprefix（java.lang.string）