如何在春季启动时配置自定义AccessDecisionManager和自定义AuthenticationProvider

Question

Below is my security configuration file, which I want to change into java config

<beans:bean id="filterSecurityInterceptor" class="org.springframework.security.web.access.intercept.FilterSecurityInterceptor">
    <beans:property name="accessDecisionManager" ref="accessDecisionManager" />
    <beans:property name="authenticationManager" ref="authenticationManager" />
    <beans:property name="securityMetadataSource" ref="securityMetadataSource" />
</beans:bean>

<authentication-manager alias="authenticationManager" xmlns="http://www.springframework.org/schema/security">
        <authentication-provider ref="customAuthentication"></authentication-provider>
</authentication-manager>

<beans:bean name="accessDecisionManager" class="com.xy.security.CustomAccessDecisionManager" ></beans:bean>

<beans:bean name="securityMetadataSource" class="com..xy.security.InvocationSecurityMetadataSourceService">
</beans:bean>

<beans:bean id="customAuthentication" class="com.xy.security.CustomAuthentication" />

<beans:bean id="securityExceptionTranslationHandler" class="org.springframework.security.web.authentication.ExceptionMappingAuthenticationFailureHandler">
    <beans:property name="exceptionMappings">
        <beans:props>
            <beans:prop key="org.springframework.security.authentication.CredentialsExpiredException">/changepassword.xhtml</beans:prop>
        </beans:props>
    </beans:property>
    <beans:property name="defaultFailureUrl" value="/login.jsp" />
</beans:bean>    ====================================================        

I want to change this to java config below is my code but it's failing

@Configuration

@EnableWebSecurity

public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Autowired
    private CustomAuthentication customAuthentication;

    @Autowired
    private CustomAccessDecisionManager customAccessDecisionManager;

    @Autowired
    private InvocationSecurityMetadataSourceService invocationSecurityMetadataSourceService;

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.authenticationProvider(customAuthentication);
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {

        http.authorizeRequests()
            .antMatchers("/login*","/favicon.ico","/","/**/*.css" ,"/images/*.*","/js/*.js","/bt-fonts/*.*").permitAll()
            .anyRequest().authenticated()
            .and()
            .formLogin().loginPage("/login")
            .defaultSuccessUrl("/admin*")
            .failureUrl("/login?error=true")
            .and()
            .logout().logoutSuccessUrl("/login").invalidateHttpSession(true).deleteCookies("true")
            .and()
            .authenticationProvider(customAuthentication)
            //.accessDecisionManager(customAccessDecisionManager)
            //.authorizeRequests().accessDecisionManager(customAccessDecisionManager)
            //.csrf().disable()
            ;

    }

I have a class where I have custom Authentication logic

public class CustomAccessDecisionManager implements AccessDecisionManager{

  -@Override
    public Authentication authenticate(Authentication authentication){

// some code here }

}

and another class like below where I have custom Authorization logic

public class CustomAuthentication implements AuthenticationProvider{

  @Override
    public void decide(Authentication arg0, Object object, Collection<ConfigAttribute> arg2)

// some code here

}

Answer 1

The first (I would recommend) is to update your configuration to include a WebExpressionVoter. For example:

     @Bean
public AccessDecissionManager defaultAccessDecisionManager() {
    List<AccessDecisionVoter<FilterInvocation>> voters = new ArrayList<AccessDecisionVoter<FilterInvocation>>();
    voters.add(new WebExpressionVoter());
    voters.add(new CustomVoter());
    AccessDecissionManager result = new UnanimousBased();
    result.setDecisionVoters(voters);
    return result;
}

The second option is to change to not use expressions within Spring Security's url mappings. For example

protected void configure(HttpSecurity http) throws Exception {
 http
    .apply(new UrlAuthorizationConfigurer())
        .accessDecisionManager(defaultAccessDecisionManager())
        .antMatchers("/admin/**").hasRole("ADMINGROUP")
        .anyRequest().authenticated().and()
    ....

}

view the below link

Answer 2

@Configuration
@EnableWebMvcSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private CustomAuthenticationProvider customAuthenticationProvider;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        /**
         * Do your stuff here
         */
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.authenticationProvider(customAuthenticationProvider);
    }
}