[英]hasRole() not working error Http Status 403 - Access is denied
Following is configuration in my security-config file: 以下是我的security-config文件中的配置:
<security:http use-expressions="true">
<security:intercept-url pattern="/adminarea"
access="hasRole('admin')" />
<security:intercept-url pattern="/logincheck"
access="permitAll" />
<security:intercept-url pattern="/newaccount"
access="permitAll" />
<security:intercept-url pattern="/createnewaccount"
access="permitAll" />
<security:intercept-url pattern="/home"
access="isAuthenticated()" />
<security:intercept-url pattern="/static/**"
access="permitAll" />
<security:intercept-url pattern="/" access="permitAll" />
<security:intercept-url pattern="/**" access="denyAll" />
<security:form-login login-page="/"
authentication-failure-url="/?error=true" default-target-url="/home" />
</security:http>
I am using spring default login which is working fine. 我正在使用spring默认登录,效果很好。 But when I try to aceess
/adminarea
I get an Http Status 403 - Access is denied
error. 但是,当我尝试使用aceess
/adminarea
出现Http Status 403 - Access is denied
/adminarea
Http Status 403 - Access is denied
错误。 Any help. 任何帮助。
Edited: AuthenticationManager 编辑:AuthenticationManager
<security:authentication-manager>
<security:authentication-provider>
<security:jdbc-user-service
data-source-ref="dataSource" />
</security:authentication-provider>
</security:authentication-manager>
code on JSP: JSP上的代码:
<sec:authentication property="principal"/>
<sec:authorize access="hasRole('admin')">
<a href="${pageContext.request.contextPath}/adminarea">Admin Area</a>
</sec:authorize>
first tag outputs following 第一个标签输出如下
rg.springframework.security.core.userdetails.User@6d8e08d5: Username: zubi@yahoo.com;
rg.springframework.security.core.userdetails.User@6d8e08d5:用户名:zubi@yahoo.com; Password: [PROTECTED];
密码保护]; Enabled: true;
启用:true; AccountNonExpired: true;
AccountNonExpired:true; credentialsNonExpired: true;
certificateNonExpired:true; AccountNonLocked: true;
AccountNonLocked:true; Granted Authorities: admin
授予的权限:admin
second tag outputs nothing. 第二个标签什么也不输出。
I assume you have created the following tables 我假设您已经创建了以下表格
create table users(
username varchar_ignorecase(50) not null primary key,
password varchar_ignorecase(50) not null,
enabled boolean not null);
create table authorities (
username varchar_ignorecase(50) not null,
authority varchar_ignorecase(50) not null,
constraint fk_authorities_users foreign key(username) references users(username));
create unique index ix_auth_username on authorities (username,authority);
Which are required by above authentication manager configuration in your application context xml. 应用程序上下文xml中的以上身份验证管理器配置需要这些。
And you have inserted role admin
into authorities
table. 并且您已将角色
admin
插入authorities
表中。
I fixed the problem by setting role in DB as ROLE_XXX
or in my case ROLE_ADMIN
. 我通过将DB中的角色设置为
ROLE_XXX
或我的情况下ROLE_ADMIN
解决了该问题。 And then using the following code: 然后使用以下代码:
security configuration: 安全配置:
<security:intercept-url pattern="/adminarea"
access="hasRole('ROLE_ADMIN')" />
JSP: JSP:
<sec:authorize access="hasRole('ROLE_ADMIN')">
<a href="${pageContext.request.contextPath}/adminarea">Admin Area</a>
</sec:authorize>
From my experimenting to get it work. 通过我的尝试来使其正常工作。 I guess roles defined need to be in
CAPITAL
and should be prefixed with ROLE_
. 我猜定义的角色需要在
CAPITAL
并且应该以ROLE_
作为前缀。
Hope it helps anybody running into this problem. 希望它可以帮助遇到此问题的任何人。
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.