Spring 3.1 내 @Secured Annotations를 무시합니다.

좋습니다. "Spring에서 내 @Secured 주석을 무시하고 있습니다."중 하나가 있습니다. 여기 다른 곳에서 여러 가지 해결책을 읽었으며 아무도 내 문제를 해결하지 못하는 것 같습니다.Spring 3.1 내 @Secured Annotations를 무시합니다.

저는 Netbeans 7.4beta를 Spring 3.1.1 및 Spring Security 3.1.4와 함께 사용하고 있습니다.

내가 로그인 한 사용자로 제한되어야 컨트롤러있어 :

package my.phonedirectory.mvc.controllers; 

import javax.annotation.Resource; 
import org.apache.log4j.Logger; 
import javax.servlet.http.HttpServletRequest; 
import javax.servlet.http.HttpServletResponse; 
import my.phonedirectory.mvc.services.PhoneDirectoryService; 
import org.springframework.security.access.annotation.Secured; 
import org.springframework.security.core.Authentication; 
import org.springframework.security.core.context.SecurityContext; 
import org.springframework.security.core.context.SecurityContextHolder; 
import org.springframework.security.core.userdetails.User; 
import org.springframework.stereotype.Controller; 
import org.springframework.web.bind.annotation.RequestMapping; 
import org.springframework.web.servlet.ModelAndView; 

@Controller 
public class IndexController { 

    protected static void debug(String msg) { 
     Logger logger = Logger.getLogger("Controller"); 
     System.out.println("Logger Category: " + logger.getParent().toString()); 
     logger.debug(new Object() { }.getClass().getEnclosingClass().getSimpleName() + ": " + msg); 
    } 

    @Resource(name="phoneDirectoryService") 
    PhoneDirectoryService phoneDirectoryService; 
    public void setPhoneDirectoryService(PhoneDirectoryService phoneDirectoryService) { 
     this.phoneDirectoryService = phoneDirectoryService; 
    } 

    @RequestMapping("/index.html") 
    @Secured("ROLE_USER") 
    protected ModelAndView handleRequestInternal(HttpServletRequest request, 
               HttpServletResponse response) 
      throws Exception { 
     debug("handleRequestInternal"); 

     String username; 


     SecurityContext sc = SecurityContextHolder.getContext(); 
     Authentication auth = sc.getAuthentication(); 
     if (auth == null) { 
      username = "SecurityContextHolder.getAuthentication() returned NULL"; 
     } else { 
      Object principal = auth.getPrincipal(); 
      if (principal == null) { 
       username = "SecurityContextHolder.getAuthentication().getPrincipal() returned NULL"; 
      } else { 
       if (principal instanceof User) { 
        User user = (User)principal; 
        debug("User logged in: " + user.getUsername()); 
        username = user.getUsername(); 
       } else { 
        debug("No user logged in: " + principal.toString()); 
        username = principal.toString(); 
       } 
      } 
     } 


     ModelAndView mv = new ModelAndView("index"); 
     mv.addObject("message", "Hello " + username);   
     return mv; 
    } 

}

을 그리고 내의 index.jsp 파일은 다음과 같습니다

<%@page contentType="text/html" pageEncoding="UTF-8"%> 
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" 
    "http://www.w3.org/TR/html4/loose.dtd"> 

<html> 
    <head> 
     <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> 
     <title>Phone Directory</title> 
    </head> 

    <body> 
     <h1> Welcome to the Phone Directory</h1> 
    <h2><%= (String)request.getAttribute("message") %></h2> 
    <p> 
     To see the Phone Directory, click <a href="list.html">HERE</a>. 
    </body> 
</html>

내가 로컬 호스트를로드 할 때 : 8080/PhoneDirectory/index.html, 얻을 수 :

Welcome to the Phone Directory 
Hello anonymousUser 

To see the Phone Directory, click HERE.

그래서, 볼 수 있듯이 강제로 로그인 시도가 아니라 대신 onymous 사용자가 @Secured ("ROLE_USER")에 의해 보호되어야하는 메소드에 액세스 할 수 있습니다. 이것은 내가 봄 보안에 대한 디버그 로깅을 활성화 할 때 내 로그에 표시 무엇

...

INFO: PhoneDirectory was successfully deployed in 5,899 milliseconds. 
INFO: 16:15:25,889 DEBUG web.FilterChainProxy:337 - /index.html at position 1 of 10 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter' 
INFO: 16:15:25,891 DEBUG context.HttpSessionSecurityContextRepository:139 - HttpSession returned null object for SPRING_SECURITY_CONTEXT 
INFO: 16:15:25,891 DEBUG context.HttpSessionSecurityContextRepository:85 - No SecurityContext was available from the HttpSession: [email protected] A new one will be created. 
INFO: 16:15:25,900 DEBUG web.FilterChainProxy:337 - /index.html at position 2 of 10 in additional filter chain; firing Filter: 'LogoutFilter' 
INFO: 16:15:25,901 DEBUG web.FilterChainProxy:337 - /index.html at position 3 of 10 in additional filter chain; firing Filter: 'UsernamePasswordAuthenticationFilter' 
INFO: 16:15:25,901 DEBUG web.FilterChainProxy:337 - /index.html at position 4 of 10 in additional filter chain; firing Filter: 'BasicAuthenticationFilter' 
INFO: 16:15:25,902 DEBUG web.FilterChainProxy:337 - /index.html at position 5 of 10 in additional filter chain; firing Filter: 'RequestCacheAwareFilter' 
INFO: 16:15:25,902 DEBUG web.FilterChainProxy:337 - /index.html at position 6 of 10 in additional filter chain; firing Filter: 'SecurityContextHolderAwareRequestFilter' 
INFO: 16:15:25,904 DEBUG web.FilterChainProxy:337 - /index.html at position 7 of 10 in additional filter chain; firing Filter: 'AnonymousAuthenticationFilter' 
INFO: 16:15:25,907 DEBUG authentication.AnonymousAuthenticationFilter:102 - Populated SecurityContextHolder with anonymous token: 'org.sprin[email protected]6faeba70: Principal: anonymousUser; Credentials: [PROTECTED]; Authenticated: true; Details: org.sprin[email protected]fffbcba8: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: 33784332ecf862dfef93485b8bbf; Granted Authorities: ROLE_ANONYMOUS' 
INFO: 16:15:25,907 DEBUG web.FilterChainProxy:337 - /index.html at position 8 of 10 in additional filter chain; firing Filter: 'SessionManagementFilter' 
INFO: 16:15:25,908 DEBUG web.FilterChainProxy:337 - /index.html at position 9 of 10 in additional filter chain; firing Filter: 'ExceptionTranslationFilter' 
INFO: 16:15:25,908 DEBUG web.FilterChainProxy:337 - /index.html at position 10 of 10 in additional filter chain; firing Filter: 'FilterSecurityInterceptor' 
INFO: 16:15:25,909 DEBUG intercept.FilterSecurityInterceptor:185 - Public object - authentication not attempted 
INFO: 16:15:25,910 DEBUG web.FilterChainProxy:323 - /index.html reached end of additional filter chain; proceeding with original chain 
INFO: Logger Category: [email protected] 
INFO: 16:15:25,967 DEBUG Controller:32 - IndexController: handleRequestInternal 
INFO: Logger Category: [email protected] 
INFO: 16:15:25,968 DEBUG Controller:32 - IndexController: No user logged in: anonymousUser 
INFO: 16:15:25,976 DEBUG support.DefaultListableBeanFactory:1498 - Invoking afterPropertiesSet() on bean with name 'index' 
INFO: 16:15:25,993 DEBUG support.DefaultListableBeanFactory:245 - Returning cached instance of singleton bean 'org.springframework.security.methodSecurityMetadataSourceAdvisor' 
INFO: 16:15:26,151 DEBUG context.HttpSessionSecurityContextRepository:269 - SecurityContext is empty or contents are anonymous - context will not be stored in HttpSession. 
INFO: 16:15:26,152 DEBUG context.HttpSessionSecurityContextRepository:269 - SecurityContext is empty or contents are anonymous - context will not be stored in HttpSession. 
INFO: 16:15:26,155 DEBUG access.ExceptionTranslationFilter:115 - Chain processed normally 
INFO: 16:15:26,156 DEBUG context.SecurityContextPersistenceFilter:97 - SecurityContextHolder now cleared, as request processing completed

그리고 여기 내 web.xml 파일 (주 : 나는 보통 applicationContext.xml 이름을 변경했습니다 와 ApplicationContext에-security.xml 루트-context.xml에 뿌리-security.xml에) :

<?xml version="1.0" encoding="UTF-8"?> 
<web-app version="3.0" 
     xmlns="http://java.sun.com/xml/ns/javaee" 
     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
     xsi:schemaLocation="http://java.sun.com/xml/ns/javaee 
          http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"> 

    <filter> 
     <filter-name>springSecurityFilterChain</filter-name> 
     <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class> 
    </filter> 

    <filter-mapping> 
     <filter-name>springSecurityFilterChain</filter-name> 
     <url-pattern>/*</url-pattern> 
    </filter-mapping> 



    <context-param> 
     <param-name>contextConfigLocation</param-name> 
     <param-value>/WEB-INF/root-context.xml 
        /WEB-INF/root-security.xml 
     </param-value> 
    </context-param> 


    <listener> 
     <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class> 
    </listener> 

    <servlet> 
     <servlet-name>phoneDirectory</servlet-name> 
     <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class> 
     <load-on-startup>2</load-on-startup> 
    </servlet> 

    <servlet-mapping> 
     <servlet-name>phoneDirectory</servlet-name> 
     <url-pattern>*.html</url-pattern> 
    </servlet-mapping> 

    <session-config> 
     <session-timeout> 
      30 
     </session-timeout> 
    </session-config> 

    <welcome-file-list> 
     <welcome-file>redirect.jsp</welcome-file> 
    </welcome-file-list> 

</web-app>

그리고 내 루트의 context.xml 파일 :

<?xml version="1.0" encoding="UTF-8"?> 
<beans xmlns="http://www.springframework.org/schema/beans" 
     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
     xmlns:p="http://www.springframework.org/schema/p" 
     xmlns:aop="http://www.springframework.org/schema/aop" 
     xmlns:tx="http://www.springframework.org/schema/tx" 
     xsi:schemaLocation="http://www.springframework.org/schema/beans 
          http://www.springframework.org/schema/beans/spring-beans-3.1.xsd 
          http://www.springframework.org/schema/aop 
          http://www.springframework.org/schema/aop/spring-aop-3.1.xsd 
          http://www.springframework.org/schema/tx 
          http://www.springframework.org/schema/tx/spring-tx-3.1.xsd"> 





</beans>

그리고 내 루트-security.xml 파일 :

이

<beans:beans xmlns="http://www.springframework.org/schema/security" 
    xmlns:beans="http://www.springframework.org/schema/beans" 
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
    xsi:schemaLocation="http://www.springframework.org/schema/beans 
          http://www.springframework.org/schema/beans/spring-beans-3.1.xsd 
          http://www.springframework.org/schema/security 
          http://www.springframework.org/schema/security/spring-security-3.1.xsd"> 


    <global-method-security secured-annotations="enabled" /> 

    <http auto-config="true" 
       use-expressions="true" 
       access-denied-page="/PhoneDirectory/accessDenied" > 



     <form-login 
      login-page="/PhoneDirectory/login" 
      authentication-failure-url="/PhoneDirectory/login?error=true" 
      default-target-url="/PhoneDirectory/list"/> 

     <logout 
      invalidate-session="true" 
      logout-success-url="/PhoneDirectory/login" 
      logout-url="/PhoneDirectory/logout"/> 

    </http> 

    <authentication-manager> 
     <authentication-provider user-service-ref="userDetailsService"> 
     </authentication-provider> 
    </authentication-manager> 

    <user-service id="userDetailsService"> 
    <user name="user" password="user_password" authorities="ROLE_USER, ROLE_ADMIN" /> 
    <user name="admin" password="admin_password" authorities="ROLE_USER" /> 
    </user-service> 



</beans:beans>

그리고 내 phoneDirectory-servlet.xml 파일 :

<?xml version="1.0" encoding="UTF-8"?> 
<beans xmlns="http://www.springframework.org/schema/beans" 
     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
     xmlns:p="http://www.springframework.org/schema/p" 
     xmlns:aop="http://www.springframework.org/schema/aop" 
     xmlns:tx="http://www.springframework.org/schema/tx" 
     xmlns:context="http://www.springframework.org/schema/context" 
     xmlns:security="http://www.springframework.org/schema/security" 
     xsi:schemaLocation="http://www.springframework.org/schema/beans 
          http://www.springframework.org/schema/beans/spring-beans-3.1.xsd 
          http://www.springframework.org/schema/aop 
          http://www.springframework.org/schema/aop/spring-aop-3.1.xsd 
          http://www.springframework.org/schema/tx 
          http://www.springframework.org/schema/tx/spring-tx-3.1.xsd 
          http://www.springframework.org/schema/context 
          http://www.springframework.org/schema/context/spring-context-3.1.xsd 
          http://www.springframework.org/schema/security 
          http://www.springframework.org/schema/security/spring-security-3.1.xsd"> 

    <security:global-method-security secured-annotations="enabled" /> 

    <bean id="appService" 
      class="my.phonedirectory.mvc.services.PhoneDirectoryService">   
    </bean> 

    <bean class="org.springframework.web.servlet.mvc.annotation.DefaultAnnotationHandlerMapping"/> 

    <context:component-scan base-package="my.phonedirectory.mvc" /> 

    <bean id="viewResolver" 
      class="org.springframework.web.servlet.view.InternalResourceViewResolver" 
      p:prefix="/WEB-INF/jsp/" 
      p:suffix=".jsp" /> 



</beans>

내가 메인 조언을 항상 알고있다 "는을 myApp-서블릿의 태그를 넣어 .xml 파일을 최상위 applicationContext.xml (또는 예를 들어 root-context.xml) 대신 사용하십시오. 하지만 그건 내 문제가 해결되지 않는 ...

출처

2013-08-06 Doug

당신이 당신의 서비스 클래스 (PhoneDirectoryService)에 직접 @Secured 주석을 사용하고

출처

2013-08-06 17:39:29 coder

, 나는를 이동했다.xml을 추가하고 PhoneDirectoryService 메소드 중 하나에 @Secured를 추가했지만 여전히 보안 확인을 적용하지 못했습니다. 나는 심지어 global-method-security 태그를 root-context.xml 파일로 옮겨서 (새로 @ Secure'd bean이 정의 된 곳이기 때문에) 도움이되지 않았다. – Doug

봄 루트 애플리케이션 컨텍스트에 PhoneDirectoryService의 콩을 이동보십시오 수있는 것은 문제가있는 것 @Resource (javax.annotation.Resource) 주석을 올바르게 처리합니다. 우리는 자원의 선언 된 범위가 무시 된 것을 관찰했습니다.

해결 방법은 리소스 대신 자동 전화를 사용하는 것입니다. 다음을 시도 할 수 있습니다 :

import org.springframework.beans.factory.annotation.Autowired; 
import org.springframework.beans.factory.annotation.Qualifier; 
... 
    @Autowired 
    @Qualifier("phoneDirectoryService") 
    PhoneDirectoryService phoneDirectoryService;

출처

2013-11-04 09:11:03

그것은 Spring Security+MVC annotations Illegal argument exception

관련이있을 수가 해결되는지, 설명을 참조하십시오. ` <콩 ID = "appService"클래스 = "my.phonedirectory.mvc.services.PhoneDirectoryService"/> 루트 컨텍스트에` : 당신이 요청으로 http://sergey-karpushin.blogspot.com/2012/10/spring-mvc-security-secured-annotation.html

출처

2013-12-15 08:51:16

Spring 3.1 내 @Secured Annotations를 무시합니다.

답변

관련 문제