Spring Boot 中的 Spring 安全性

Question

I want to implement Spring Security in Spring Boot application. I've done this earlier using my Spring 4.0 application using JavaConfig. However, i am finding some differences in the style of examples given

In my case, user is preauthenticated and we have our own mechanism for authorization which contains the business activity.

In my prev application, i use to configure

<filter>
    <filter-name>springSecurityFilterChain</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>

This filter would actually enable the spring security in my application which inturn would pass the user token to further steps.

In the Spring Boot reference documentation, i did not get any trace of springSecurityFilterChain/DelegatingFilterProxy so i am confused on how to start the development of my module

So question here is, do i need to configure it manually? or has that been taken care of in the Autoconfiguration itself?

Secondly, i will need a lot of customizations in Spring Security, so i do not need the features provided by spring boot security like basic authentication. in that case just creating my own bean with @EnableWebSecurity will switch off the functionality?

Additional Info

4.2. Getting Started with Security Namespace Configuration In this section, we'll look at how you can build up a namespace configuration to use some of the main features of the framework. Let's assume you initially want to get up and running as quickly as possible and add authentication support and access control to an existing web application, with a few test logins. Then we'll look at how to change over to authenticating against a database or other security repository. In later sections we'll introduce more advanced namespace configuration options.

4.2.1. web.xml Configuration The first thing you need to do is add the following filter declaration to your web.xml file:

<filter>
  <filter-name>springSecurityFilterChain</filter-name>
  <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>

<filter-mapping>
  <filter-name>springSecurityFilterChain</filter-name>
  <url-pattern>/*</url-pattern>
</filter-mapping>

This provides a hook into the Spring Security web infrastructure. DelegatingFilterProxy is a Spring Framework class which delegates to a filter implementation which is defined as a Spring bean in your application context. In this case, the bean is named "springSecurityFilterChain", which is an internal infrastructure bean created by the namespace to handle web security. Note that you should not use this bean name yourself. Once you've added this to your web.xml, you're ready to start editing your application context file. Web security services are configured using the element.

Answer 1

Since Spring Security 3.2 (Dec 2013), it is no longer needed to configure springSecurityFilterChain yourself, the @EnableWebSecurity annotation will do that for you, provided you include the spring-security-config module (not included by spring-security-web , but Spring Boot includes it automatically):

    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-config</artifactId>
      <version>4.2.8.RELEASE</version>
    </dependency>

The WebSecurityConfiguration configurer activates on @EnableWebSecurity and delegates to WebSecurity builder class to actually build the configuration, which at the end instantiates FilterChainProxy with a bean name "springSecurityFilterChain" .

Just follow the docs to activate and configure web security. Eg:

@Configuration
@EnableWebSecurity
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.httpBasic().authorizeRequests()
            .anyRequest().hasAnyRole("USER", "ADMIN");
    }

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        auth.inMemoryAuthentication()
                .withUser("user").password("{noop}user").roles("USER")
                .and()
                .withUser("admin").password("{noop}admin").roles("ADMIN");
    }

}