Spring MVC（5.0.8）与Spring Security（5.0.7）基本身份验证不工作

Question

我试图在我的SpringMVC应用程序中启用Spring Security性，该应用程序提供一些RESTWeb服务（Java8）。我的问题是，无论我做什么，授权根本不起作用。我可以在没有任何凭据的情况下访问我的RESTendpoint。我使用本手册：https://docs.spring.io/spring-security/site/docs/5.0.7.RELEASE/reference/htmlsingle/

Git repo与我的应用程序的完整代码在这里：https://github.com/SP8EBC/MKS_JG_ONLINE

证券配置。java如下所示

@EnableWebSecurity
@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        auth.inMemoryAuthentication()                 
            .withUser(Secret.user).password("{noop}" + Secret.password).roles("USER");       
    }
    @Override
    protected void configure(HttpSecurity http) throws Exception {
//         http
//           .csrf()
//               .disable()
//           .authorizeRequests().antMatchers("/**").permitAll()
//               .anyRequest().authenticated()
//           .and()
//           .httpBasic()
//               .realmName("test")
//               .authenticationEntryPoint(new CustomAuthenticationEntryPoint());
        http.authorizeRequests().anyRequest().denyAll();
    }
}

AppConfig.java

@Configuration
@Import(SecurityConfig.class)
@EnableWebMvc
@EnableSpringDataWebSupport
@EnableTransactionManagement
@EnableJpaRepositories(basePackages = {"pl.jeleniagora.mks.dao.repository"})
@ComponentScan("pl.jeleniagora.mks")
public class AppConfig{
// beans and app config
}

网状物xml

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://xmlns.jcp.org/xml/ns/javaee" xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd" id="WebApp_ID" version="3.1">
  <display-name>MKS_JG_ONLINE</display-name>
    <context-param>
      <param-name>contextClass</param-name>
      <param-value>
         org.springframework.web.context.support.AnnotationConfigWebApplicationContext
      </param-value>
   </context-param>
   <context-param>
      <param-name>contextConfigLocation</param-name>
      <param-value>pl.jeleniagora.mks.ws.config</param-value>
   </context-param>
   <listener>
      <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
   </listener>

   <servlet>
      <servlet-name>rest</servlet-name>
      <servlet-class>
         org.springframework.web.servlet.DispatcherServlet
      </servlet-class>
      <init-param>
         <param-name>contextClass</param-name>
         <param-value>
            org.springframework.web.context.support.AnnotationConfigWebApplicationContext
         </param-value>
      </init-param>
      <init-param>
         <param-name>contextConfigLocation</param-name>
         <param-value>pl.jeleniagora.mks.ws.controllers</param-value>
      </init-param>
      <load-on-startup>1</load-on-startup>
   </servlet>
   <servlet-mapping>
      <servlet-name>rest</servlet-name>
      <url-pattern>/*</url-pattern>
   </servlet-mapping>

   <welcome-file-list>
      <welcome-file />
   </welcome-file-list>

</web-app>

在调试模式下启动Tomcat 8.5时，我看到SecurityConfig加载（在configure和configureGlobal中的断点处停止执行）。我做错了什么？

Answer 1

Spring Security性要求在安全配置旁边注册一个servlet过滤器。

将以下内容添加到网站。xml（此处解释）。

<filter>
  <filter-name>springSecurityFilterChain</filter-name>
  <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>

<filter-mapping>
  <filter-name>springSecurityFilterChain</filter-name>
  <url-pattern>/*</url-pattern>
</filter-mapping>

这将添加筛选器，并将应用于所有请求。

然而，当您使用最新的servlet容器时，我建议您放弃web。xml并创建两个java类来执行引导。（另见此处）。

首先引导应用程序

public class MvcWebApplicationInitializer extends AbstractAnnotationConfigDispatcherServletInitializer {

    @Override
    public Class<?>[] getServletConfigClasses() {
      return new Class[] { WebConfig.class }; // or whatever it is called or return `null`
    }

    @Override
    protected Class<?>[] getRootConfigClasses() {
        return new Class[] { AppConfig.class };
    }
}

然后添加一个引导/配置Spring Security过滤器的过滤器

public class SecurityWebApplicationInitializer extends AbstractSecurityWebApplicationInitializer { }

现在一切都配置在Java，你可以做没有你的web.xml。