如何使用全局方法安全性使用分层决策投票器

Question

下面是我的Spring Security XML配置的完整代码。

<beans xmlns="http://www.springframework.org/schema/beans"
           xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
           xmlns:oauth="http://www.springframework.org/schema/security/oauth2"
           xmlns:sec="http://www.springframework.org/schema/security"
           xsi:schemaLocation="http://www.springframework.org/schema/beans
           http://www.springframework.org/schema/beans/spring-beans-4.2.xsd
           http://www.springframework.org/schema/security
           http://www.springframework.org/schema/security/spring-security-3.2.xsd
           http://www.springframework.org/schema/security/oauth2
           http://www.springframework.org/schema/security/spring-security-oauth2-1.0.xsd">

    <!-- Definition of the Authentication Service
     For Authenticating a User the Client application will send request to the URL "/oauth/token". This request will contain the clientId, client password, userName and user password details
     -->
    <http pattern="/oauth/token" create-session="stateless"  authentication-manager-ref="clientAuthenticationManager"
          xmlns="http://www.springframework.org/schema/security" >
        <intercept-url pattern="/oauth/token" access="IS_AUTHENTICATED_FULLY"/>
        <anonymous enabled="false"/>
        <http-basic entry-point-ref="clientAuthenticationEntryPoint"/>
        <!-- include this only if you need to authenticate clients via request parameters -->
        <custom-filter ref="clientCredentialsTokenEndpointFilter" after="BASIC_AUTH_FILTER"/> <!-- http/http-basic -->
        <access-denied-handler ref="oauthAccessDeniedHandler"/>
    </http>

    <http pattern="/**"  entry-point-ref="oauthAuthenticationEntryPoint"
          xmlns="http://www.springframework.org/schema/security" use-expressions="true" auto-config="true">
        <anonymous enabled="false"/>
        <custom-filter ref="specializedResourceServerFilter"
                       before="PRE_AUTH_FILTER" />
        <access-denied-handler ref="oauthAccessDeniedHandler"/>
    </http>

    <bean id="oauthAuthenticationEntryPoint"
          class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint"/>

    <bean id="clientAuthenticationEntryPoint"
          class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint">
        <property name="realmName" value="client"/>
        <property name="typeName" value="Basic"/>
    </bean>

    <bean id="oauthAccessDeniedHandler"
          class="org.springframework.security.oauth2.provider.error.OAuth2AccessDeniedHandler"/>
    <bean id="clientCredentialsTokenEndpointFilter"
          class="org.springframework.security.oauth2.provider.client.ClientCredentialsTokenEndpointFilter">
        <property name="authenticationManager" ref="clientAuthenticationManager"/>
    </bean>


    <bean id="oAuth2authenticationManager" class="org.springframework.security.oauth2.provider.authentication.OAuth2AuthenticationManager">
        <property name="tokenServices" ref="tokenServices"/>
        <property name="resourceId" value="myId"/>
    </bean>
    <bean id="specializedResourceServerFilter" class="com.my.backend.authentication.oauth2.OAuth2AuthenticationProcessingCustomFilter">
        <property name="authenticationManager" ref="oAuth2authenticationManager"/>
    </bean>

    <bean id="customAuthenticationManager"
          class="com.my.backend.read.rest.authentication.MyDBAuthenticationProvider"/>

    <bean id="myJDBCAuthenticationProvider"
          class="com.my.backend.authentication.MyJDBCAuthenticationProvider"/>

    <!-- Authentication in config file -->
    <authentication-manager id="clientAuthenticationManager" xmlns="http://www.springframework.org/schema/security">
        <authentication-provider user-service-ref="clientDetailsUserService"/>
    </authentication-manager>
    <!-- authentication Manager called auto and their provider is called -->
    <authentication-manager alias="authenticationManager" xmlns="http://www.springframework.org/schema/security">
        <authentication-provider ref="customAuthenticationManager"/>
        <authentication-provider ref="myJDBCAuthenticationProvider"/>
    </authentication-manager>

    <bean id="clientDetailsUserService"
          class="org.springframework.security.oauth2.provider.client.ClientDetailsUserDetailsService">
        <constructor-arg ref="clientDetails"/>
    </bean>

    <!-- Token Store  -->
    <bean id="tokenStore" class="org.springframework.security.oauth2.provider.token.store.JdbcTokenStore">
        <constructor-arg ref="jdbcDataSource" />
    </bean>

    <bean id="jdbcDataSource"
          class="org.springframework.jdbc.datasource.DriverManagerDataSource">
        <property name="driverClassName" value="com.mysql.jdbc.Driver"/>
        <property name="url" value="#{systemProperties['JDBC_CONNECTION_STRING']}/#{systemProperties['DATABASE']}?autoReconnect=true"/>
        <property name="username" value="#{systemProperties['USER_NAME']}"/>
        <property name="password" value="#{systemProperties['PASSWORD']}"/>
    </bean>


    <bean id="tokenServices" class="com.my.backend.authentication.oauth2.CustomTokenServices">
        <property name="tokenStore" ref="tokenStore"/>
        <property name="supportRefreshToken" value="true"/>
        <property name="clientDetailsService" ref="clientDetails"/>
        <!-- VIV -->
        <property name="accessTokenValiditySeconds" value="7776000"/>
    </bean>

    <bean id="userApprovalHandler"
          class="org.springframework.security.oauth2.provider.approval.TokenStoreUserApprovalHandler">
        <property name="tokenStore" ref="tokenStore"/>
        <property name="requestFactory" ref="oAuth2RequestFactory"/>
    </bean>

    <bean id="oAuth2RequestFactory"
          class="org.springframework.security.oauth2.provider.request.DefaultOAuth2RequestFactory">
        <constructor-arg ref="clientDetails"/>
    </bean>
    <!-- Token management -->
    <oauth:authorization-server   client-details-service-ref="clientDetails"  token-services-ref="tokenServices"
                                  user-approval-handler-ref="userApprovalHandler">
        <oauth:implicit/>
        <oauth:refresh-token/>
        <oauth:client-credentials/>
        <oauth:password/>
    </oauth:authorization-server>

    <oauth:resource-server  id="resourceServerFilter"
                            token-services-ref="tokenServices"/>


    <!-- Client Definition -->
    <bean id="clientDetails"
          class="com.my.backend.authentication.oauth2.JdbcClientDetailsService" >
        <constructor-arg name="dataSource" ref="jdbcDataSource" />
    </bean>

    <sec:global-method-security pre-post-annotations="enabled" proxy-target-class="true">
        <sec:expression-handler ref="oauthExpressionHandler"/>
    </sec:global-method-security>
    <oauth:expression-handler id="oauthExpressionHandler"/>
    <oauth:web-expression-handler id="oauthWebExpressionHandler"/>

</beans>

当我点击受限URL时，这些访问决策投票者会涉及到Affirmative访问决策管理器的授权：

0 = {PreInvocationAuthorizationAdviceVoter@11611} 
1 = {RoleVoter@11635} 
2 = {AuthenticatedVoter@11639} 

尽管我没有在上述XML配置中设置任何访问决策管理器，但我认为默认情况下调用它，但我不知道如何进行。 无论如何，我想添加分层访问决策投票器，所以我创建了自己的访问决策管理器，并在其中引用了分层结构，并在http元素中引用了它，如下所示：

 <http pattern="/**" access-decision-manager-ref="*myAccessDecisionManager*" entry-point-ref="oauthAuthenticationEntryPoint"
      xmlns="http://www.springframework.org/schema/security" use-expressions="true" auto-config="true">
    <anonymous enabled="false"/>
    <custom-filter ref="specializedResourceServerFilter"
                   before="PRE_AUTH_FILTER" />
    <access-denied-handler ref="oauthAccessDeniedHandler"/>
</http>

它会调用，但是之后这三个默认访问决策投票者也调用了，我不知道该如何覆盖它。 请帮忙 ...

编辑：

为了弄清楚如何设置访问决定投票者（下面将提到），现在我陷入了HirarichalRoleVoter的问题，我在下面提到了我想让客户访问具有公共角色@PreAuthorize（“ harRole（'ROLE_PUBLIC'）”的方法。它无法访问它。

 <bean id="accessDecisionManager" class="org.springframework.security.access.vote.AffirmativeBased"
          xmlns="http://www.springframework.org/schema/beans">
        <constructor-arg>
            <list>
                <ref bean="roleVoter" />
                <bean class="org.springframework.security.access.vote.AuthenticatedVoter"/>
            </list>
        </constructor-arg>
    </bean>
    <bean id="roleVoter" class="org.springframework.security.access.vote.RoleHierarchyVoter">
        <constructor-arg ref="roleHierarchy" />
    </bean>
    <bean id="roleHierarchy"
          class="org.springframework.security.access.hierarchicalroles.RoleHierarchyImpl">
        <property name="hierarchy">
            <value>
                ROLE_CUSTOMER > ROLE_PUBLIC
            </value>
        </property>
    </bean>
    <sec:global-method-security pre-post-annotations="enabled" access-decision-manager-ref="accessDecisionManager"  >
        <sec:expression-handler ref="methodSecurityExpressionHandler"/>
    </sec:global-method-security>


    <bean id = "methodSecurityExpressionHandler"
                class = "org.springframework.security.access.expression.method.DefaultMethodSecurityExpressionHandler">
        <property name = "roleHierarchy"  ref="roleHierarchy"/>
    </bean>

Answer 1

myAccessDecisionManager未显示，但我假设它扩展了org.springframework.security.access.vote.AffirmativeBased或其父AbstractAccessDecisionManager 。 如果是这样，那么您可以尝试使用如下的decisionVoters属性：

<bean id="accessDecisionManager" class="org.springframework.security.access.vote.AffirmativeBased">
    <property name="decisionVoters">
        <list>
            <bean class="org.springframework.security.access.vote.RoleVoter"/>
            <bean class="org.springframework.security.access.vote.AuthenticatedVoter"/>
        </list>
    </property>
</bean>

指定您喜欢的任何选民。

另一种选择是捷径化，避免使用投票者：只需在决策管理器实现中对您的决策逻辑进行硬编码。