使用Spring Security保护GWT Servlet

Question

我正在编写一个受Spring安全保护的GWT应用程序。 登录工作正常，但授权不成功。

我尝试在我的方法上使用@Secured和@PreAuthorize注释，但这些方法也不起作用。

例如，这是来自AppUserServiceImpl的代码段

@Secured("ROLE_ADMINISTRATOR")
    @Override
    public List<AppUser> fetch(Integer startRow, Integer endRow, Map criteria) {
        return appUserManagerBean.getUsers(criteria);
    }

applicationContext.xml中

<?xml version="1.0" encoding="UTF-8"?>

<beans:beans xmlns="http://www.springframework.org/schema/security"
             xmlns:beans="http://www.springframework.org/schema/beans"
             xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
             xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
                        http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.0.xsd">


<http auto-config="true">
    <intercept-url pattern="/testapplication/**" access="ROLE_USER"/>
    <intercept-url pattern="/gwt/**" access="ROLE_USER"/>
    <intercept-url pattern="/**/*.html" access="ROLE_USER"/>
    <intercept-url pattern="/**" access="IS_AUTHENTICATED_ANONYMOUSLY" />
    <intercept-url pattern="/security/*" access="IS_AUTHENTICATED_ANONYMOUSLY" />
    <intercept-url pattern="/testapplication/appUserService*" access="ROLE_ADMIN"/>

    <form-login
            login-page="/login.jsp"
            authentication-failure-url="/security/error.html"
            login-processing-url="/j_spring_security_check"
            />
</http>
<beans:bean id="appUserService" class="com.test.testapplication.server.admin.appuser.AppUserServiceImpl"/>


<beans:bean id="dataSource" class="org.springframework.jdbc.datasource.DriverManagerDataSource">
[DATASOURCE CONFIGURATION]
</beans:bean>
<global-method-security pre-post-annotations="enabled" secured-annotations="enabled" />
<authentication-manager>
    <authentication-provider>
        <password-encoder hash="sha" />
        <jdbc-user-service data-source-ref="dataSource"
                           users-by-username-query="select username,password,DECODE(enabled,'Y',1,'N',0) as enabled from APP_USER where username=?"

                           authorities-by-username-query="select u.username, ur.role from APP_USER u, APP_USER_ROLE ur
                                                          where u.id = ur.APP_USER_ID and u.username =?  "

                />
    </authentication-provider>
</authentication-manager>

为了测试，我正在尝试保护'appUserService'。

web.xml中

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns="http://java.sun.com/xml/ns/javaee"
           xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
           xsi:schemaLocation="http://java.sun.com/xml/ns/javaee
          http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
           version="2.5">

    <context-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>
            /WEB-INF/applicationContext.xml
        </param-value>
    </context-param>
    <servlet>
        <servlet-name>appUserService</servlet-name>
    <servlet-class>com.test.testapplication.server.admin.appuser.AppUserServiceImpl</servlet-class>
</servlet>

<!-- Spring security filter -->
<filter>
    <filter-name>springSecurityFilterChain</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>

<filter-mapping>
    <filter-name>springSecurityFilterChain</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>
<!-- Spring listener -->
<listener>
    <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>
<!-- Default page to serve -->
<welcome-file-list>
    <welcome-file>testapplication.html</welcome-file>
</welcome-file-list>

我正在寻找最简单的解决方案，并且我不想使用AspectJ，我们将不胜感激

Answer 1

您在哪里将servlet映射到特定路径？

我正在使用gwt-sl集成RemoteServiceServlet和Spring。 在您的web.xml中定义Dispatcher servlet：

<servlet>
    <servlet-name>gwtservice</servlet-name>
    <servlet-class> org.springframework.web.servlet.DispatcherServlet </servlet-class>
    <load-on-startup>1</load-on-startup>
</servlet>

并为您的gwt-servlet进行声明和映射：

<bean name="DeviceListenerServlet" class="your.package.your.SomeService"/>
<bean id="urlMappingGWT" class="org.gwtwidgets.server.spring.GWTHandler">
    <property name="mappings">
        <map>
            <entry key="/service" value-ref="DriverServiceImpl"/>
        </map>
    </property>
</bean>

并在您的RemoteService类中更改Annotation（在我的示例中为@RemoteServiceRelativePath（“ gwtservice / service”））。

现在，您可以使用@Secured批注（如果已添加）

希望对您有所帮助。