未能與JavaConfig

Question

配置兩個HttpSecurity設置

我按照從official documentation如何配置兩個單獨的HttpSecurity情況下，建議：

@Configuration 
@EnableWebSecurity 
public class SoWebSecurityConfig 
{ 
    @Autowired public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception { 
    auth.userDetailsService(username -> { 
     log.info("\n\n\n ********* authenticating {} ************************************\n\n\n", username); 
     return new User(username, "", asList(new SimpleGrantedAuthority("TV"))); 
    }); 
    } 

    @Configuration 
    @Order(1) 
    public static class SwiperSecurityConfig extends WebSecurityConfigurerAdapter { 
    @Override 
    protected void configure(HttpSecurity http) throws Exception { configureHttpSec(http, "/swiper"); } 
    } 

    @Configuration 
    @Order(2) 
    public static class TvSecurityConfig extends WebSecurityConfigurerAdapter { 
    @Override 
    protected void configure(HttpSecurity http) throws Exception { configureHttpSec(http, "/tv"); } 
    } 

    static HttpSecurity configureHttpSec(HttpSecurity http, String urlBase) throws Exception { 
    http .csrf().disable() 
      .exceptionHandling().authenticationEntryPoint(new Http403ForbiddenEntryPoint()) 
    .and() .authorizeRequests().antMatchers(urlBase+"/**").authenticated() 
    .and() .httpBasic() 
    .and() .logout().logoutUrl(urlBase+"/logout").logoutSuccessHandler((req,resp,auth) -> {}) 
    ; 
    return http; 
    } 
} 

在日誌中我看到正在創建兩個過濾鏈：

2014-06-30 12:44:22 main INFO o.s.s.w.DefaultSecurityFilterChain - Creating filter chain: org.springframework.security.web.util.matcher.AnyRequestMatcher@1, [org.springframework.security.web.context.request.as 
ync.WebAsyncManagerIntegrationFilter@806996, org.springframework.security.web.context.SecurityContextPersistenceFilter@1937eaff, org.springframework.security.web.header.HeaderWriterFilter@71e4b308, org.springfr 
amework.security.web.authentication.logout.LogoutFilter@1d1cbd0f, org.springframework.security.web.authentication.www.BasicAuthenticationFilter@9b9a327, org.springframework.security.web.savedrequest.RequestCach 
eAwareFilter@4993febc, org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter@67064bdc, org.springframework.security.web.authentication.AnonymousAuthenticationFilter@78b612c6, org.s 
pringframework.security.web.session.SessionManagementFilter@6d11ceef, org.springframework.security.web.access.ExceptionTranslationFilter@6e7c351d, org.springframework.security.web.access.intercept.FilterSecurit 
yInterceptor@571a01f9] 
2014-06-30 12:44:22 main INFO o.s.s.w.DefaultSecurityFilterChain - Creating filter chain: org.springframework.security.web.util.matcher.AnyRequestMatcher@1, [org.springframework.security.web.context.request.as 
ync.WebAsyncManagerIntegrationFilter@30c1da48, org.springframework.security.web.context.SecurityContextPersistenceFilter@427ae189, org.springframework.security.web.header.HeaderWriterFilter@4784efd9, org.spring 
framework.security.web.authentication.logout.LogoutFilter@187e5235, org.springframework.security.web.authentication.www.BasicAuthenticationFilter@514de325, org.springframework.security.web.savedrequest.RequestC 
acheAwareFilter@16a9eb2e, org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter@76332405, org.springframework.security.web.authentication.AnonymousAuthenticationFilter@43a65cd8, or 
g.springframework.security.web.session.SessionManagementFilter@3fba233d, org.springframework.security.web.access.ExceptionTranslationFilter@376c7d7d, org.springframework.security.web.access.intercept.FilterSecu 
rityInterceptor@3b48e183] 

但只有我指定的一個Order(1)纔會真正被使用;與另一個URL匹配的URL將不會被認證。

我也嘗試過使用anyRequest()代替螞蟻匹配器來配置@Order(2)配置，但是結果相同。

我有什麼辦法可以解決這個問題？

我使用Spring 4.0.5，Spring Security 3.2.4。

Answer 1

您未能在一個關鍵方面遵循文檔。你有

http.authorizeRequests().antMatchers(urlBase+"/**").authenticated() 

這意味着你註冊這個HttpSecurity作爲一個全球性的安全模塊，它適用於所有網址，但只需要在那些螞蟻匹配選擇的認證。當你這樣做兩次時，你會得到兩個鏈式的全局安全模塊，所以自然只有第一個將負責所有的URL。

的文檔，而不是建議這樣的：

http.antMatcher(urlBase+"/**").authorizeRequests().anyRequest().authenticated() 

這意味着螞蟻匹配將用來選擇哪個URL這個安全模塊負責，並繞過它爲所有其他人。這樣，適當的時候，排隊的第二個模塊就有機會了。

因此，所有你需要做的就是調整您的靜態配置者的方法如下：

static HttpSecurity configureHttpSec(HttpSecurity http, String urlBase) throws Exception { 
    http .csrf().disable() 
      .exceptionHandling().authenticationEntryPoint(new Http403ForbiddenEntryPoint()) 
    .and() .antMatchers(urlBase+"/**").authorizeRequests().anyRequest().authenticated() 
    .and() .httpBasic() 
    .and() .logout().logoutUrl(urlBase+"/logout").logoutSuccessHandler((req,resp,auth) -> {}) 
    ; 
    return http; 
    }