Spring Security无法识别我自己的权限

Question

我正在尝试使用自己的permissionEvaluator ，

但看起来像spring无法识别我的设置。

到目前为止，我做到了：

package com.brunorozendo.security;

import java.io.Serializable;
import java.util.Collection;

import javax.management.RuntimeErrorException;
import javax.persistence.EntityManager;
import javax.persistence.TypedQuery;

import org.springframework.security.access.PermissionEvaluator;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.stereotype.Component;
import com.brunorozendo.db.ConectaDatabase;
import com.brunorozendo.entity.Perfil;
import com.brunorozendo.entity.Permission;
import com.brunorozendo.entity.User;
@Component
public class BasePermissionEvaluator implements PermissionEvaluator {
    public Collection<? extends GrantedAuthority> getAuthorities() {
        Authentication auth = SecurityContextHolder.getContext().getAuthentication();
        return auth.getAuthorities();
    }
    //esse methodo  nunca está sendo chamando
    @Override
    public boolean hasPermission(Authentication authentication, Object targetDomainObject, Object permission) {
        boolean hasPermission = false;
        if (authentication != null && permission instanceof String) {
            System.out.println(String.valueOf(targetDomainObject));
            EntityManager em = ConectaDatabase.getConexao();
            TypedQuery<User> query = em.createNamedQuery("User.findAll", User.class);
            User user = query.getSingleResult();
            int sizePerfil = user.getTbPerfils().size();
            System.out.println("sizePerfil "+sizePerfil);
            for(int i = 0 ; i < sizePerfil && !hasPermission ; i++) {
                Perfil p = user.getTbPerfils().get(i);
                int sizePermission = p.getTbPermissions().size();
                System.out.println("sizePermissionsizePerfil "+sizePermission);
                for(int j = 0 ; j < sizePermission && !hasPermission ; j++) {
                    Permission perm = p.getTbPermissions().get(j);
                    System.out.println(String.valueOf(targetDomainObject)+" "+perm.getTxPermission() +" "+permission);
                    if(perm.getTxPermission().equals(permission)) {
                        hasPermission = true;
                    }
                }
            }
        } else {
            hasPermission = false;
        }
        return hasPermission;
    }
    //esse methodo  nunca está sendo chamando
    @Override
    public boolean hasPermission(Authentication authentication, Serializable targetId, String targetType, Object permission){
        throw new RuntimeErrorException (new Error("Id and Class permissions are not supperted by this application"));
    }
}

web.xml

<web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee 
         http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd"
         version="3.1">
    <display-name>Meu crud gradle</display-name>
    <welcome-file-list>
        <welcome-file>index.html</welcome-file>
    </welcome-file-list>
    <resource-ref>
        <res-ref-name>jdbc/h2db</res-ref-name>
        <res-type>javax.sql.DataSource</res-type>
        <res-auth>Container</res-auth>
        <res-sharing-scope>Shareable</res-sharing-scope>
    </resource-ref>
    <filter>  
        <filter-name>DBFilter</filter-name>  
        <filter-class>com.brunorozendo.filter.ConectaDatabaseFilter</filter-class>  
    </filter>  
    <filter-mapping>  
        <filter-name>DBFilter</filter-name>  
        <url-pattern>/*</url-pattern>  
    </filter-mapping>
    <!--Spring MVC -->
    <servlet>
        <servlet-name>spring</servlet-name>
        <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
        <load-on-startup>1</load-on-startup>
    </servlet>
    <servlet-mapping>
        <servlet-name>spring</servlet-name>
        <url-pattern>/</url-pattern>
    </servlet-mapping>
    <!--Fim Spring MVC -->
    <!--Spring Security -->
    <context-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>
            /WEB-INF/spring-security-datasource.xml
            /WEB-INF/spring-security.xml
        </param-value>
    </context-param>
    <filter>
        <filter-name>springSecurityFilterChain</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    </filter>
    <filter-mapping>
        <filter-name>springSecurityFilterChain</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>
    <listener>
        <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
    </listener>
    <!--Fim Spring Security -->
</web-app>

spring-security.xml

<?xml version="1.0" encoding="UTF-8"?>  

<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:context="http://www.springframework.org/schema/context"
       xmlns:mvc="http://www.springframework.org/schema/mvc"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xsi:schemaLocation="http://www.springframework.org/schema/beans   http://www.springframework.org/schema/beans/spring-beans-4.3.xsd
                           http://www.springframework.org/schema/mvc     http://www.springframework.org/schema/mvc/spring-mvc-4.3.xsd
                           http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-4.3.xsd">  


    <context:component-scan  base-package="com.brunorozendo" />

    <mvc:annotation-driven />

    <bean class="org.springframework.web.servlet.view.InternalResourceViewResolver">  
        <property name="prefix" value="/WEB-INF/jsp/" />  
        <property name="suffix" value=".jsp" />  
    </bean>  
</beans>

spring-security.xml

<?xml version="1.0"  encoding="UTF-8"?>
<b:beans xmlns="http://www.springframework.org/schema/security"
         xmlns:b="http://www.springframework.org/schema/beans"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://www.springframework.org/schema/beans    http://www.springframework.org/schema/beans/spring-beans-4.3.xsd
                             http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-4.2.xsd">
    <debug />
    <http auto-config="true" use-expressions="true">
        <intercept-url pattern="/**" access="isAnonymous() or isAuthenticated()" />
        <form-login 
            login-page="/login"
            always-use-default-target="true" 
            default-target-url="/"
            authentication-failure-url="/login?login_error=1"
            login-processing-url="/authenticate" />     
        <logout/>       
        <remember-me />
    </http>
    <global-method-security pre-post-annotations="enabled">
        <expression-handler ref="expressionHandler" />
    </global-method-security>
    <b:bean id="expressionHandler" class="org.springframework.security.access.expression.method.DefaultMethodSecurityExpressionHandler">
        <b:property name="permissionEvaluator" ref="customPermissionEvaluator" />
    </b:bean>
    <b:bean id="customPermissionEvaluator" class="com.brunorozendo.security.BasePermissionEvaluator"/>
    <authentication-manager>
        <authentication-provider>
            <jdbc-user-service 
                data-source-ref="dataSourceName" 
                authorities-by-username-query=" select 
                                                    u.tx_username, 
                                                    p.tx_perfil
                                                from 
                                                    tb_user u
                                                inner join 
                                                    tb_user_tb_perfil up 
                                                ON 
                                                    u.id_user = up.id_user
                                                inner join 
                                                    tb_perfil p 
                                                ON 
                                                    up.id_perfil = p.id_perfil
                                                where 
                                                u.tx_username = ?"
                users-by-username-query="select 
                                            u.tx_username, 
                                            HEXTORAW(u.tx_pass) as tx_pass, 
                                            true 
                                        from tb_user u 
                                        WHERE 
                                        u.tx_username = ?" 
                group-authorities-by-username-query = " select 
                                                            p.id_perfil, 
                                                            p.tx_perfil,
                                                            pm.tx_permission
                                                        from 
                                                            tb_permission pm
                                                        inner join 
                                                            tb_permission_tb_perfil pb 
                                                            ON  pb.id_permission = pm.id_permission
                                                        inner join
                                                            tb_perfil p
                                                            ON p.id_perfil = pb.id_perfil
                                                        inner join 
                                                            tb_user_tb_perfil up
                                                            ON up.id_perfil = p.id_perfil
                                                        inner join 
                                                            tb_user u
                                                            ON u.id_user = up.id_user
                                                        where 
                                                            u.tx_username = ?" />
        </authentication-provider>
    </authentication-manager>
</b:beans>

spring-security-datasource.xml

<?xml version="1.0" encoding="UTF-8"?>
<beans  xmlns="http://www.springframework.org/schema/beans"
        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
        xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-4.3.xsd">

    <bean id="dataSourceName" class="org.springframework.jndi.JndiObjectFactoryBean">
        <property name="jndiName">
            <value>java:comp/env/jdbc/h2db</value>
        </property>
    </bean>     
</beans>

Answer 1

终于我明白了：

spring-security.xml

<http auto-config="true" use-expressions="true">

    <expression-handler ref="expressionHandlerWeb" />

</http>



<b:bean id="permissionEvaluator" class="spring.security.BasePermissionEvaluator"/>

<b:bean id="expressionHandlerMethod" class="org.springframework.security.access.expression.method.DefaultMethodSecurityExpressionHandler">
    <b:property name="permissionEvaluator" ref="permissionEvaluator"/>
</b:bean>
<b:bean id="expressionHandlerWeb" class="org.springframework.security.web.access.expression.DefaultWebSecurityExpressionHandler">
    <b:property name="permissionEvaluator" ref="permissionEvaluator"/>
</b:bean>


<global-method-security pre-post-annotations="enabled">
    <expression-handler ref="expressionHandlerMethod"/>
</global-method-security>