Làm cách nào để bật chú thích được bảo mật bằng cấu hình dựa trên Java?

Question

Tôi muốn sử dụng các chú thích @Secured cho các tác vụ điều khiển của mình. Vì tôi có cấu hình dựa trên java, tôi cần biết cách tôi có thể đặt tùy chọn

<security:global-method-security secured-annotations="enabled" /> 

tùy chọn không có tệp xml.

Upate 1:

tôi addeed @EnableGlobalMethodSecurity(securedEnabled = true) đến lớp an ninh cấu hình của tôi:

@Configuration 
@EnableWebMvcSecurity 
@EnableGlobalMethodSecurity(securedEnabled = true) 
public class LIRSecurityConfig extends WebSecurityConfigurerAdapter { 

    @Override 
    protected void configure(HttpSecurity http) throws Exception { 
     http 
      .authenticationProvider(preAuthenticatedAuthenticationProvider()) 
      .addFilter(cookiePreAuthenticationFilter()) 
      .authorizeRequests() 
      .antMatchers("/**") 
      .hasAnyAuthority("ROLE_USER") 
      ; 
    } 

    ... 
} 

Up khi khởi động này gây ra ngoại lệ này

Jul 21, 2014 3:32:54 PM org.apache.catalina.core.StandardContext listenerStart 
SEVERE: Exception sending context initialized event to listener instance of class org.springframework.web.context.ContextLoaderListener 
org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'methodSecurityInterceptor' defined in class path resource [org/springframework/security/config/annotation/method/configuration/GlobalMethodSecurityConfiguration.class]: Invocation of init method failed; nested exception is java.lang.IllegalArgumentException: An AuthenticationManager is required 
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1512) 
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:521) 
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:458) 
    at org.springframework.beans.factory.support.AbstractBeanFactory$1.getObject(AbstractBeanFactory.java:296) 
    at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:223) 
    at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:293) 
    at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:194) 
    at org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingletons(DefaultListableBeanFactory.java:633) 
    at org.springframework.context.support.AbstractApplicationContext.finishBeanFactoryInitialization(AbstractApplicationContext.java:932) 
    at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:479) 
    at org.springframework.web.context.ContextLoader.configureAndRefreshWebApplicationContext(ContextLoader.java:410) 
    at org.springframework.web.context.ContextLoader.initWebApplicationContext(ContextLoader.java:306) 
    at org.springframework.web.context.ContextLoaderListener.contextInitialized(ContextLoaderListener.java:112) 
    at org.apache.catalina.core.StandardContext.listenerStart(StandardContext.java:4937) 
    at org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5434) 
    at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:150) 
    at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1559) 
    at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1549) 
    at java.util.concurrent.FutureTask$Sync.innerRun(FutureTask.java:303) 
    at java.util.concurrent.FutureTask.run(FutureTask.java:138) 
    at java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:895) 
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:918) 
    at java.lang.Thread.run(Thread.java:695) 
Caused by: java.lang.IllegalArgumentException: An AuthenticationManager is required 
    at org.springframework.util.Assert.notNull(Assert.java:112) 
    at org.springframework.security.access.intercept.AbstractSecurityInterceptor.afterPropertiesSet(AbstractSecurityInterceptor.java:121) 
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.invokeInitMethods(AbstractAutowireCapableBeanFactory.java:1571) 
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1509) 
    ... 22 more 
Jul 21, 2014 3:32:54 PM org.apache.catalina.core.StandardContext 

Cập nhật 2:

Sau khi thêm

@Bean 
@Override 
public AuthenticationManager authenticationManagerBean() throws Exception { 
    return super.authenticationManagerBean(); 
} 

tôi nhận được một ngoại lệ khác:

Caused by: org.springframework.beans.FatalBeanException: A dependency cycle was detected when trying to resolve the AuthenticationManager. Please ensure you have configured authentication. 
    at org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter$AuthenticationManagerDelegator.validateBeanCycle(WebSecurityConfigurerAdapter.java:462) 
    at org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter$AuthenticationManagerDelegator.<init>(WebSecurityConfigurerAdapter.java:430) 
    at org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter.authenticationManagerBean(WebSecurityConfigurerAdapter.java:220) 
    at com.galexis.lir.config.LIRSecurityConfig.authenticationManagerBean(LIRSecurityConfig.java:36) 
    at com.galexis.lir.config.LIRSecurityConfig$$EnhancerBySpringCGLIB$$88306f96.CGLIB$authenticationManagerBean$3(<generated>) 
    at com.galexis.lir.config.LIRSecurityConfig$$EnhancerBySpringCGLIB$$88306f96$$FastClassBySpringCGLIB$$a4d1ea33.invoke(<generated>) 
    at org.springframework.cglib.proxy.MethodProxy.invokeSuper(MethodProxy.java:228) 
    at org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:293) 
    at com.galexis.lir.config.LIRSecurityConfig$$EnhancerBySpringCGLIB$$88306f96.authenticationManagerBean(<generated>) 
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) 
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39) 
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25) 
    at java.lang.reflect.Method.invoke(Method.java:597) 
    at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:160) 
    ... 77 more 

Answer 1

Bạn cần phải sử dụng các chú thích

@EnableGlobalMethodSecurity(securedEnabled = true) 

, theo quy định tại docs.

Answer 2

Bạn cũng nên thêm một bean cho Trình quản lý. Check this out:

@Configuration 
@EnableWebMvcSecurity 
@EnableGlobalMethodSecurity(securedEnabled = true) 
public class SecurityConfiguration extends WebSecurityConfigurerAdapter { 

    @Resource(name = "authService") 
    private UserDetailsService userDetailsService; 

    @Bean 
    @Override 
    public AuthenticationManager authenticationManagerBean() throws Exception { 
     return super.authenticationManagerBean(); 
    } 

    @Override 
    protected void configure(AuthenticationManagerBuilder auth) throws Exception { 
     Md5PasswordEncoder encoder = new Md5PasswordEncoder(); 
     auth.userDetailsService(userDetailsService).passwordEncoder(encoder); 
    } 

    @Override 
    protected void configure(HttpSecurity http) throws Exception { 
     http 
      .formLogin() 
      .loginPage("/login") 
      .and() 
      .logout() 
      .logoutSuccessUrl("/"); 
    } 
} 

điều quan trọng là

@Bean 
    @Override 
    public AuthenticationManager authenticationManagerBean() throws Exception { 
     return super.authenticationManagerBean(); 
    } 

Answer 3

Stefan là đúng, thêm

@EnableGlobalMethodSecurity(securedEnabled = true) 

hiện các trick.

Trong trường hợp cụ thể của tôi, tôi phải thêm vào để loại bỏ các hành vi.

@Autowired 
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception { 
    auth 
     .inMemoryAuthentication() 
      .withUser("user").password("password").authorities("ROLE_USER"); 
} 

Answer 4

Chỉ dành cho những người khác sẽ cố gắng giải quyết "Đã phát hiện chu trình phụ thuộc khi cố gắng giải quyết Trình quản lý xác thực. Vui lòng đảm bảo bạn đã định cấu hình xác thực". vấn đề.

Giải pháp là để thêm phương pháp follwing:

@Override 
@Autowired 
public void configure(AuthenticationManagerBuilder auth) throws Exception { 
    // do NOT call super.configure() ! 
    ... 
} 

Answer 5

Vì vậy, đây đã làm công việc:

@Configuration 
@EnableWebSecurity 
@EnableGlobalMethodSecurity(prePostEnabled = true) 
public class SecurityConfiguration extends WebSecurityConfigurerAdapter { 

    @Bean 
    @Override 
    public AuthenticationManager authenticationManagerBean() throws Exception { 
     return super.authenticationManagerBean(); 
    } 

    @Autowired 
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception { 
     auth.inMemoryAuthentication(). 
       withUser("user").password("user").roles("USER").and(). 
       withUser("admin").password("admin").roles("USER", "ADMIN"); 
    } 

    @Override 
    protected void configure(HttpSecurity http) throws Exception { 
     http 
       .authorizeRequests() 
       .anyRequest().authenticated() 
       .and() 
       .httpBasic(); 
    } 

    @Override 
    public void configure(WebSecurity web) throws Exception { 
     super.configure(web); 
    } 
} 

những phần quan trọng là

@Bean 
    @Override 
    public AuthenticationManager authenticationManagerBean() throws Exception { 
     return super.authenticationManagerBean(); 
    } 

    @Autowired 
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception { 
     auth.inMemoryAuthentication(). 
       withUser("user").password("user").roles("USER").and(). 
       withUser("admin").password("admin").roles("USER", "ADMIN"); 
    }