Spring Security 4@PreAuthorize（"hasRole（）"）不工作

Question

在过去的几天里，我一直在进行故障排除，我似乎无法让表达式hasRole工作。我使用的是sping-Security 4.0.1

我的Spring Securityxml

<bean id="expressionHandler" class="org.springframework.security.web.access.expression.DefaultWebSecurityExpressionHandler"/>
<security:global-method-security pre-post-annotations="enabled">
    <security:expression-handler ref="expressionHandler"/>
</security:global-method-security>


<security:http auto-config="true" use-expressions="true">
    <security:access-denied-handler error-page="/403" />
    <security:intercept-url pattern="/login" access="permitAll" />
    <security:intercept-url pattern="/logout" access="permitAll" />
    <security:intercept-url pattern="/css/**/*.css" access="permitAll" />
    <security:intercept-url pattern="/fonts/*.*" access="permitAll" />

    <security:intercept-url pattern="/**" access="isAuthenticated()" />

    <security:form-login login-page="/login" login-processing-url="/login" default-target-url="/landing" authentication-failure-url="/login?error" authentication-success-handler-ref="loginSuccesHandler" />
    <security:logout logout-success-url="/login?logout" logout-url="/logout" invalidate-session="true" />

    <security:session-management session-fixation-protection="none"/>
</security:http>
<security:authentication-manager>
    <security:authentication-provider user-service-ref="userDetailsService">
       <security:password-encoder ref="passwordEncoder"/>
    </security:authentication-provider>
</security:authentication-manager>


<bean id="daoAuthenticationProvider" class="org.springframework.security.authentication.dao.DaoAuthenticationProvider">
    <property name="userDetailsService" ref="userDetailsService" />
    <property name="passwordEncoder" ref="passwordEncoder" />
</bean>

我的所有角色都存储在数据库中，其模式类似于此链接中的1。在自定义的userDetailService中，我将从数据库中加载它。我的角色价值观是这样的

PYRL-EMPPF-01
PYRL-EMPPF-02
PYRL-EMPPF-03

我甚至试着加上前缀“ROLE\uux”，但我似乎无法实现。

下面是关于如何使用hasRole表达式的示例代码。我正试图用它来保护我的控制器方法。

@RequestMapping(value = "/URLABC", method = RequestMethod.GET)
@PreAuthorize("hasRole('ROLE_PYRL-EMPPF-01')")
public ModelAndView search(HttpSession session) throws Exception {
...
}

我尝试过预授权（“hasRole（'ROLE\u PYRL-empf-01'）”）和预授权（“hasRole（'PYRL-empf-01'）”）两种方法都不起作用。

Answer 1

不知何故，我设法找到了答案

<bean id="expressionHandler" class="org.springframework.security.access.expression.method.DefaultMethodSecurityExpressionHandler"/>
<security:global-method-security pre-post-annotations="enabled">
    <security:expression-handler ref="expressionHandler"/>
</security:global-method-security>

我只需要将这个spring配置从我的Spring Securityxml配置放到spring servlet配置中。

这是我的web.xml.以前上面的配置在application-security.xml现在我把它移动到dispatcher-servlet.xml.

<context-param>
    <param-name>contextConfigLocation</param-name>
    <param-value>
        /WEB-INF/dispatcher-servlet.xml
        /WEB-INF/application-security.xml
    </param-value>
</context-param>

也不用组织。springframework。安全网状物通道表示DefaultWebSecurityExpressionHandler。我把它改成了使用org。springframework。安全通道表示方法DefaultMethodSecurityExpressionHandler。

如果有人能解释2 ExpressionHandler类之间的区别，那就太好了。