Spring 安全性与给定角色不匹配

Question

我正在开发一个简单的 spring 安全应用程序，它有 3 个用户角色（emp、admin、man）。 我通过数据源读取用户数据，并且对于任何用户想要访问禁止页面的情况，我都有自己的拒绝访问页面。 在我以前在我的 java class DemoSecurityConfig 方法中定义我的用户信息（用户名、密码、角色）之前protected void configure ()和 Z2A2D595E6ED9A0B24F027F2B63B134D6从数据库中，我的所有用户都定向到拒绝访问页面，这意味着 spring 安全角色不起作用或无法读取给定角色

DemoSecurityConfig class

@Configuration
@EnableWebSecurity
@ComponentScan(basePackages = "com")
public class DemoSecurityConfig extends WebSecurityConfigurerAdapter {

@Autowired
   private DataSource securityDataSource;
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
       //use jdbc
        auth.jdbcAuthentication().dataSource(securityDataSource);

    }
    //configure of web patch in application login logout

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests().antMatchers("/").hasAnyRole("emp")
        .antMatchers("/leaders/**").hasAnyRole("man")
                .antMatchers("/systems/**").hasAnyRole("admin")
                .and().formLogin().loginPage("/showMyLoginPage")
                .loginProcessingUrl("/authenticateTheUser")
                .permitAll().and().logout().permitAll().and().exceptionHandling().accessDeniedPage("/access-denied");
    }

}

DemoAppConfig

@Configuration
@EnableWebMvc
@ComponentScan(basePackages = "com")
@PropertySource("classpath:persistence-mysql.properties")
public class DemoAppConfig  {
    //define a bean for view resolver
    @Bean
   public ViewResolver viewResolver(){
      InternalResourceViewResolver viewResolver=new InternalResourceViewResolver();
      viewResolver.setPrefix("/WEB-INF/view/");
      viewResolver.setSuffix(".jsp");
      return  viewResolver;
    }
        //reading properties file

    //set yp varible for holding a properties
    @Autowired
    private Environment env;
    private Logger logger=Logger.getLogger(getClass().getName());
    //define a bean for data source

    @Bean
    public DataSource securityDataSource(){
    //create data connection
        ComboPooledDataSource securityDataSource
                =new ComboPooledDataSource();
        //set up jdbc driver class
        try {
            securityDataSource.setDriverClass(env.getProperty("jdbc.driver"));
        } catch (PropertyVetoException exc) {
            throw  new RuntimeException(exc);
        }
        //log the connection for make sure
       logger.info(">> jdbc.url=" +env.getProperty("jdbc.url"));
        logger.info(">> jdbc.user=" +env.getProperty("jdbc.user"));
        //set up database connection properties
securityDataSource.setJdbcUrl(env.getProperty("jdbc.url"));
        securityDataSource.setUser(env.getProperty("jdbc.user"));
        securityDataSource.setPassword(env.getProperty("jdbc.password"));
        //set yp connection props
        securityDataSource.setInitialPoolSize(getIntProperty("connection.pool.initialPoolSize"));
        securityDataSource.setMinPoolSize(getIntProperty("connection.pool.minPoolSize"));
        securityDataSource.setMaxPoolSize(getIntProperty("connection.pool.maxPoolSize"));
        securityDataSource.setMaxIdleTime(getIntProperty("connection.pool.maxIdleTime"));




        return securityDataSource;
    }
//need a helper class
    //read env property and convert to int
    private int getIntProperty(String proName){
        String proVal=env.getProperty(proName);
        int intPropVal=Integer.parseInt(proVal);
                return intPropVal;
    }

}

主页.jsp

<html>
<head>
    <title>Title</title>
</head>
<body>
<h1>this is a main page</h1>
<!-- add link to point to leaders   -->
<security:authorize access="hasRole('admin')">
<p>
    <a href="${pageContext.request.contextPath}/systems">IT meeting</a>
    (only for admins)
</p>
<br/>
<p>

    </security:authorize>
    <security:authorize access="hasRole('man')">
    <a href="${pageContext.request.contextPath}/leaders">leaders meeting</a>
    (only for admins)
</p>
<br/>
</security:authorize>
<form:form action="${pageContext.request.contextPath}/logout"  method="post">
    <input type="submit" value="Logout">

    <hr>
        <-- display user -->
    User: <security:authentication property="principal.username"/>
    <br><br>
    roles <security:authentication property="principal.authorities"/>

    </hr>

</form:form>
</body>
</html>

Answer 1

从hasAnyRole() javadoc ：

指定 URL 的快捷方式需要多个角色中的任何一个。 如果您不想自动插入“ROLE_”，请参见 hasAnyAuthority(String...)

所以hasAnyRole("emp")期望用户拥有角色ROLE_emp但用户现在拥有角色emp 。

要么将数据库中的所有用户权限更新为前缀为ROLE_ ，例如ROLE_emp和ROLE_admin ，要么更改为使用不会添加ROLE_前缀的hasAnyAuthority() ：

    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
            .antMatchers("/").hasAnyAuthority("emp")
            .antMatchers("/leaders/**").hasAnyAuthority("man")
            .antMatchers("/systems/**").hasAnyAuthority("admin")
            ......

    }

Spring 安全性与给定角色不匹配

问题描述

1 个解决方案

解决方案1
2 已采纳 2020-06-14 18:36:40

Spring 安全性与给定角色不匹配

问题描述

1 个解决方案

解决方案1 2 已采纳 2020-06-14 18:36:40

解决方案1
2 已采纳 2020-06-14 18:36:40