j_spring_security_check不可用

Question

我将Spring Security从2升级为3

以前的security.xml具有AuthenticationProcessingFilter和AuthenticationProcessingFilterEntryPoint

<beans:beans xmlns="http://www.springframework.org/schema/security"
    xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.springframework.org/schema/beans
    http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
    http://www.springframework.org/schema/security
    http://www.springframework.org/schema/security/spring-security-3.0.3.xsd">
<beans:bean id="userAuthenticationService"
    class="com.raykor.core.service.UserAuthenticationService" />

<beans:bean id="shaEncoder"
    class="org.springframework.security.authentication.encoding.ShaPasswordEncoder" />

<global-method-security />

<http auto-config="false" entry-point-ref="authenticationProcessingFilterEntryPoint">

    <intercept-url pattern="/resettingPassword.do**" access="ROLE_ADMIN" />
    <intercept-url pattern="/resetPassword.do**" access="ROLE_ADMIN" />
    <logout logout-success-url="/index.jsp" invalidate-session="true" />
</http>

<authentication-manager alias="authenticationManager">
    <authentication-provider user-service-ref="userAuthenticationService">
        <password-encoder ref="shaEncoder">
            <salt-source user-property="salt" />
        </password-encoder>
    </authentication-provider>
</authentication-manager>

<beans:bean id="authenticationFilter"
    class="org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter">
    <beans:property name="filterProcessesUrl" value="/j_spring_security_check" />
    <beans:property name="authenticationManager" ref="authenticationManager" />
    <beans:property name="authenticationFailureHandler"
        ref="failureHandler" />
    <beans:property name="authenticationSuccessHandler"
        ref="successHandler" />
</beans:bean>

<beans:bean id="successHandler"
    class="org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler">
    <beans:property name="alwaysUseDefaultTargetUrl" value="false" />
    <beans:property name="defaultTargetUrl" value="/home.do" />
</beans:bean>

<beans:bean id="failureHandler"
    class="org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler">
    <beans:property name="defaultFailureUrl" value="/login.do?error=true" />
</beans:bean>

<beans:bean id="authenticationProcessingFilterEntryPoint"
    class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint">
    <beans:property name="loginFormUrl" value="/login.do" />
    <beans:property name="forceHttps" value="false" />
</beans:bean>

Answer 1

您实例化了UsernamePasswordAuthenticationFilter，但它不会仅仅通过创建它就成为安全筛选器链的一部分。尝试从httpconfig元素中删除auto-config=“false”，并在其中包含一个 元素。我认为您通过bean定义完成的所有配置都可以使用更简洁的名称空间配置来完成，这应该是Spring Security3的首选配置。