Spring安全認證管理器無法解析循環引用

Question

我使用的是spring security 3.2.5。我有2個身份驗證提供者。 我有一個無法解析的循環引用問題。 第一的security.xml：

<security:http use-expressions="true" auto-config="false" 
    entry-point-ref="loginUrlAuthenticationEntryPoint"> 
    <security:intercept-url pattern="/**" access="permitAll" 
     method="OPTIONS" /> 
     <security:intercept-url pattern="/user/login" 
     access="permitAll" /> 
    <security:intercept-url pattern="/**" 
    access="isAuthenticated()" /> 

<security:custom-filter position="FORM_LOGIN_FILTER" 
    ref="twoFactorAuthenticationFilter" /> 


<security:logout logout-url="/user/logout" 
    logout-success-url="/demo/user/logoutSuccess" /> 

<security:session-management 
    session-authentication-strategy-ref="sas" /> 

</security:http> 

<bean id="sas" 
    class="org.springframework.security.web.authentication.session.SessionFixationProtectionStrategy"> 
    <property name="migrateSessionAttributes" value="false" /> 
</bean> 

<bean id="sessionRegistry" 
    class="org.springframework.security.core.session.SessionRegistryImpl" /> 

<bean id="loginUrlAuthenticationEntryPoint" 
    class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint"> 
    <property name="loginFormUrl" value="/demo/user/login" /> 
</bean> 

<bean id="twoFactorAuthenticationFilter" class="com.xxx.filter.TwoFactorAuthenticationFilter"> 
    <property name="authenticationManager" ref="authenticationManager" /> 
    <property name="authenticationFailureHandler" ref="failureHandler" /> 
    <property name="authenticationSuccessHandler" ref="userAuthenticationSuccessHandler" /> 
    <property name="postOnly" value="true" /> 
</bean> 


<bean id="failureHandler" 
    class="org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler"> 
    <property name="defaultFailureUrl" value="/login?login_error=true" /> 

</bean> 

<bean id="bCryptPasswordEncoder" 
    class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder" /> 

<security:authentication-manager alias="authenticationManager"> 
    <security:authentication-provider 
     ref="authenticationProvider"> 
    </security:authentication-provider> 
    <security:authentication-provider 
     ref="restAuthenticationProvider"> 
    </security:authentication-provider> 
</security:authentication-manager> 

休息，安全的context.xml：

<import resource="/rest-security-context.xml" /> 
<import resource="/security.xml" /> 

我得到這個錯誤：

<security:http create-session="stateless" 
     entry-point-ref="digestEntryPoint" pattern="/provider/**" 
     use-expressions="true"> 
     <security:intercept-url pattern="/provider/**" 
      access="isAuthenticated()" /> 


     <security:http-basic /> 
     <security:custom-filter ref="digestFilter" 
      after="BASIC_AUTH_FILTER" /> 
    </security:http> 

    <bean id="digestFilter" 
     class="org.springframework.security.web.authentication.www.DigestAuthenticationFilter"> 
     <property name="userDetailsService" ref="customerDetailsServiceImpl" /> 
     <property name="authenticationEntryPoint" ref="digestEntryPoint" /> 
    </bean> 

    <bean id="digestEntryPoint" 
     class="org.springframework.security.web.authentication.www.DigestAuthenticationEntryPoint"> 
     <property name="realmName" value="Contacts Realm via Digest Authentication" /> 
     <property name="key" value="acegi" /> 
    </bean> 

在application.xml的順序是

：

org.springframework.beans.factory.BeanCurrentlyInCreationException: Error creating bean with name 'org.springframework.security.authenticationManager': Requested bean is currently in creation: Is there an unresolvable circular reference? 

，如果我在應用程序上下文更改順序，我得到這個錯誤：

A universal match pattern ('/**') is defined before other patterns in the filter chain, causing them to be ignored. 

Answer 1

更改文件的順序，現在我看到了你的第二個錯誤的問題：

您有：

// Below url says, all urls must be permitted for everyone 
<security:intercept-url pattern="/**" access="permitAll" 
     method="OPTIONS" /> 
     <security:intercept-url pattern="/user/login" 
     access="permitAll" /> 
// Below line says, all URLS must be authenticated, how is that possible without reaching authentication page. remove below 
    <security:intercept-url pattern="/**" 
    access="isAuthenticated()" /> 

因此，它應該是這樣的：

// I wouldnt recomment the below URL to permit /** for all, not good. 
    <security:intercept-url pattern="/**" access="permitAll" 
      method="OPTIONS" /> 
      <security:intercept-url pattern="/user/login" 
      access="permitAll" /> 

這是我的猜測。試試看。讓我知道它是否有效，或刪除我的答案。