struts2에서 스프링 보안을 적용하려고 시도했지만 작동하지 않습니다.

Question

struts2에 스프링 보안을 적용하는 데 다음 코드가 있지만 데이터 소스 부분을 구현하지 않아도 보안 페이지를 볼 수 있습니다.)하지만 아직 승인되지 않은 사용자가 페이지를 열 수는 없다고 생각합니다.

Web.xml

<?xml version="1.0" encoding="UTF-8"?> 
<web-app version="3.0" xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"> 

    <context-param> 
     <param-name>contextConfigLocation</param-name> 
     <param-value> 
      /WEB-INF/spring/*-context.xml 
     </param-value> 
    </context-param> 

    <filter> 
     <filter-name>springSecurityFilterChain</filter-name> 
     <filter-class> 
      org.springframework.web.filter.DelegatingFilterProxy 
     </filter-class> 
    </filter> 


    <context-param> 
     <param-name>org.apache.tiles.impl.BasicTilesContainer.DEFINITIONS_CONFIG</param-name> 
     <param-value>/WEB-INF/tiles.xml</param-value> 
    </context-param> 
    <listener> 
     <listener-class>org.apache.struts2.tiles.StrutsTilesListener</listener-class> 
    </listener> 
    <filter> 
     <filter-name>struts2</filter-name> 
     <filter-class>org.apache.struts2.dispatcher.ng.filter.StrutsPrepareAndExecuteFilter</filter-class> 
    </filter> 
    <filter-mapping> 
     <filter-name>struts2</filter-name> 
     <url-pattern>/*</url-pattern> 
    </filter-mapping> 
    <session-config> 
     <session-timeout> 
      30 
     </session-timeout> 
    </session-config> 
    <welcome-file-list> 
     <welcome-file>index.jsp</welcome-file> 
    </welcome-file-list> 
</web-app> 

내 JSP

<%@taglib uri="/struts-tags" prefix="s"%> 
    <sec:authorize ifAllGranted="ROLE_ADMIN"> 
     <a href="<s:url namespace ="/Profile" action="view.action"/>" >Profile</a> 
    </sec:authorize> 

내 보안 방법

import org.apache.struts2.convention.annotation.Action; 
import org.springframework.security.access.annotation.Secured; 

@Action 
public class Profile{ 

    @Secured ({"ROLE_ADMIN"}) 
    public String view(){ 
     System.out.println("view"); 
     return "View"; 
    } 

보안-context.xml에

<?xml version="1.0" encoding="UTF-8"?> 
<beans xmlns="http://www.springframework.org/schema/beans" 
     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
     xmlns:security="http://www.springframework.org/schema/security" 
     xsi:schemaLocation="http://www.springframework.org/schema/beans 
          http://www.springframework.org/schema/beans/spring-beans.xsd 
          http://www.springframework.org/schema/security 
          http://www.springframework.org/schema/security/spring-security-3.1.xsd"> 

    <security:global-method-security secured-annotations="enabled" /> 

    <security:http auto-config="true"> 
     <!-- Restrict URLs based on role --> 
     <security:intercept-url pattern="/index*" access="IS_AUTHENTICATED_ANONYMOUSLY" /> 
     <security:intercept-url pattern="/logoutSuccess*" access="IS_AUTHENTICATED_ANONYMOUSLY" /> 

     <security:intercept-url pattern="/css/main.css" access="IS_AUTHENTICATED_ANONYMOUSLY" /> 
     <security:intercept-url pattern="/resources/**" access="IS_AUTHENTICATED_ANONYMOUSLY" /> 

     <security:intercept-url pattern="/**" access="ROLE_USER" /> 

     <!-- Override default login and logout pages --> 
     <security:form-login login-page="/login.html" 
          login-processing-url="/loginProcess" 
          default-target-url="/index.jsp" 
          authentication-failure-url="/login.html?login_error=1" /> 
     <security:logout logout-url="/logout" logout-success-url="/logoutSuccess.html" /> 
    </security:http> 

    <security:authentication-manager> 
     <security:authentication-provider > 
      <security:jdbc-user-service data-source-ref="dataSource" /> 
     </security:authentication-provider> 
    </security:authentication-manager> 

</beans> 

Answer 1

URL을 기준으로 struts 애플리케이션을 보호하려면 struts2 이전에 for springSecurityFilterChain이 있어야합니다. 게시 한 구성에는 springSecurityFilterChain이 전혀 나타나지 않습니다. 즉, 다음과 같이 구성을 업데이트하십시오.

<filter> 
    <filter-name>springSecurityFilterChain</filter-name> 
    <filter-class> 
     org.springframework.web.filter.DelegatingFilterProxy 
    </filter-class> 
</filter> 
<filter> 
    <filter-name>struts2</filter-name> 
    <filter-class>org.apache.struts2.dispatcher.ng.filter.StrutsPrepareAndExecuteFilter</filter-class> 
</filter> 
<!-- The order of filter-mapping is important springSecurityFilterChain should be first! --> 
<filter-mapping> 
    <filter-name>springSecurityFilterChain</filter-name> 
    <url-pattern>/*</url-pattern> 
</filter-mapping> 
<filter-mapping> 
    <filter-name>struts2</filter-name> 
    <url-pattern>/*</url-pattern> 
</filter-mapping> 

위의 설정은 URL 기반 보안을 사용하여 응용 프로그램을 보호합니다. 그러나 메소드 기반 보안으로 애플리케이션을 보호하려면 @Secured로 주석 처리 된 객체를 Spring이 만들도록해야합니다. 이를 수행하려면 참조에 제공된 integrating Spring and Struts의 지시 사항을 수행했는지 확인하십시오.