Spring Security注释禁用登录表单功能

Question

我正在尝试使用Spring Security通过注释来保护我的RESTful Web服务的一个方法调用。 在我的方法上放置@Secured注释时，我遇到了一个奇怪的行为，阻止登录表单被重定向到，而我立即得到403响应。

我放在我的配置下面，可能你可以向我解释什么是错的？

<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security"
         xmlns:beans="http://www.springframework.org/schema/beans"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://www.springframework.org/schema/beans
       http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
       http://www.springframework.org/schema/security
       http://www.springframework.org/schema/security/spring-security-3.1.xsd">

<global-method-security secured-annotations="enabled" />

<http auto-config="true">
    <http-basic/>
    <form-login/>

    <!-- With the following line login form is shown -->
    <!--<intercept-url pattern="/rest/secured/" access="ROLE_USER"/>-->

</http>

<authentication-manager alias="myAuthenticationManager">
    <authentication-provider>
        <user-service>
            <user name="user" password="user" authorities="ROLE_USER"/>
        </user-service>
    </authentication-provider>
</authentication-manager>

</beans:beans>

这是我的服务界面：

@Produces({"application/xml"})
public interface KinoteatrService
{
    @GET
    @Path("/secured")
    @Secured("ROLE_USER")
    String testSecuredMethod();
}

这是一个实现：

@Path("/")
public class KinoteatrServiceImpl implements KinoteatrService
{
    @Override
    public String testSecuredMethod() {
        return "<html><body>Success, timestamp: " + new Date() + "</body></html>";
    }
}

我试图调查原因并启用DEBUG级别的日志记录，这就是我所拥有的...我不确定我是否正确读取了日志但似乎它说客户端已经注册为ANONYMOUS所以它立即抛出403错误代码。

2012-11-12 15:00:56,545 DEBUG [phase.PhaseInterceptorChain] : Invoking handleMessage on interceptor org.apache.cxf.ws.policy.PolicyInInterceptor@55d0f2b6
2012-11-12 15:00:56,545 DEBUG [phase.PhaseInterceptorChain] : Invoking handleMessage on interceptor org.apache.cxf.transport.https.CertConstraintsInterceptor@78e9282b
2012-11-12 15:00:56,545 DEBUG [phase.PhaseInterceptorChain] : Invoking handleMessage on interceptor org.apache.cxf.jaxrs.interceptor.JAXRSInInterceptor@6c29b061
2012-11-12 15:00:56,547 DEBUG [utils.JAXRSUtils] : Trying to select a resource class, request path : /secured/
2012-11-12 15:00:56,547 DEBUG [utils.JAXRSUtils] : Trying to select a resource operation on the resource class com.kinoteatr.ua.service.KinoteatrServiceImpl
...
...
2012-11-12 15:00:56,558 DEBUG [utils.JAXRSUtils] : Resource operation testSecuredMethod on the resource class com.kinoteatr.ua.service.KinoteatrServiceImpl has been selected
2012-11-12 15:00:56,559 DEBUG [interceptor.JAXRSInInterceptor] : Request path is: /secured/
2012-11-12 15:00:56,559 DEBUG [interceptor.JAXRSInInterceptor] : Request HTTP method is: GET
2012-11-12 15:00:56,559 DEBUG [interceptor.JAXRSInInterceptor] : Request contentType is: */*
2012-11-12 15:00:56,559 DEBUG [interceptor.JAXRSInInterceptor] : Accept contentType is: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
2012-11-12 15:00:56,559 DEBUG [interceptor.JAXRSInInterceptor] : Found operation: testSecuredMethod
2012-11-12 15:00:56,559 DEBUG [phase.PhaseInterceptorChain] : Invoking handleMessage on interceptor org.apache.cxf.interceptor.OneWayProcessorInterceptor@2221deec
2012-11-12 15:00:56,559 DEBUG [phase.PhaseInterceptorChain] : Invoking handleMessage on interceptor org.apache.cxf.interceptor.ServiceInvokerInterceptor@8eeb6be
2012-11-12 15:00:56,561 DEBUG [aopalliance.MethodSecurityInterceptor] : Secure object: ReflectiveMethodInvocation: public java.lang.String com.kinoteatr.ua.service.KinoteatrServiceImpl.testSecuredMethod(); target is of class [com.kinoteatr.ua.service.KinoteatrServiceImpl]; Attributes: [ROLE_USER]
2012-11-12 15:00:56,561 DEBUG [aopalliance.MethodSecurityInterceptor] : Previously Authenticated: org.springframework.security.authentication.AnonymousAuthenticationToken@9055e4a6: Principal: anonymousUser; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@957e: RemoteIpAddress: 127.0.0.1; SessionId: null; Granted Authorities: ROLE_ANONYMOUS
2012-11-12 15:00:56,562 DEBUG [vote.AffirmativeBased] : Voter: org.springframework.security.access.vote.RoleVoter@13961789, returned: -1
2012-11-12 15:00:56,562 DEBUG [vote.AffirmativeBased] : Voter: org.springframework.security.access.vote.AuthenticatedVoter@62e32d6a, returned: 0
2012-11-12 15:00:56,563 DEBUG [support.DefaultListableBeanFactory] : Returning cached instance of singleton bean 'cxf'
2012-11-12 15:00:56,566 DEBUG [phase.PhaseInterceptorChain] : Invoking handleMessage on interceptor org.apache.cxf.interceptor.OutgoingChainInterceptor@701f7886
2012-11-12 15:00:56,566 DEBUG [interceptor.OutgoingChainInterceptor] : Interceptors contributed by bus: [org.apache.cxf.interceptor.LoggingOutInterceptor@315b222e, org.apache.cxf.ws.policy.PolicyOutInterceptor@56211352]
2012-11-12 15:00:56,566 DEBUG [interceptor.OutgoingChainInterceptor] : Interceptors contributed by service: []
2012-11-12 15:00:56,566 DEBUG [interceptor.OutgoingChainInterceptor] : Interceptors contributed by endpoint: [org.apache.cxf.interceptor.MessageSenderInterceptor@65640d91, org.apache.cxf.transport.common.gzip.GZIPOutInterceptor@bb6de98]
2012-11-12 15:00:56,566 DEBUG [interceptor.OutgoingChainInterceptor] : Interceptors contributed by binding: [org.apache.cxf.jaxrs.interceptor.JAXRSOutInterceptor@12cfd32a]
2012-11-12 15:00:56,567 DEBUG [phase.PhaseInterceptorChain] : Chain org.apache.cxf.phase.PhaseInterceptorChain@a4553e4 was created. Current flow:
    setup [PolicyOutInterceptor]
    prepare-send [MessageSenderInterceptor, GZIPOutInterceptor]
    pre-stream [LoggingOutInterceptor]
    marshal [JAXRSOutInterceptor]

2012-11-12 15:00:56,567 DEBUG [phase.PhaseInterceptorChain] : Invoking handleMessage on interceptor org.apache.cxf.ws.policy.PolicyOutInterceptor@56211352
2012-11-12 15:00:56,567 DEBUG [policy.PolicyOutInterceptor] : No binding operation info.
2012-11-12 15:00:56,567 DEBUG [phase.PhaseInterceptorChain] : Invoking handleMessage on interceptor org.apache.cxf.interceptor.MessageSenderInterceptor@65640d91
2012-11-12 15:00:56,567 DEBUG [phase.PhaseInterceptorChain] : Adding interceptor org.apache.cxf.interceptor.MessageSenderInterceptor$MessageSenderEndingInterceptor@43300672 to phase prepare-send-ending
2012-11-12 15:00:56,567 DEBUG [phase.PhaseInterceptorChain] : Chain org.apache.cxf.phase.PhaseInterceptorChain@a4553e4 was modified. Current flow:
   setup [PolicyOutInterceptor]
   prepare-send [MessageSenderInterceptor, GZIPOutInterceptor]
   pre-stream [LoggingOutInterceptor]
   marshal [JAXRSOutInterceptor]
   prepare-send-ending [MessageSenderEndingInterceptor]

2012-11-12 15:00:56,567 DEBUG [phase.PhaseInterceptorChain] : Invoking handleMessage on interceptor org.apache.cxf.transport.common.gzip.GZIPOutInterceptor@bb6de98
2012-11-12 15:00:56,567 DEBUG [gzip.GZIPOutInterceptor] : Response role, checking accept-encoding
2012-11-12 15:00:56,567 DEBUG [gzip.GZIPOutInterceptor] : Accept-Encoding header: [gzip,deflate,sdch]
2012-11-12 15:00:56,567 DEBUG [gzip.GZIPOutInterceptor] : gzip permitted: YES
2012-11-12 15:00:56,567 DEBUG [phase.PhaseInterceptorChain] : Invoking handleMessage on interceptor org.apache.cxf.interceptor.LoggingOutInterceptor@315b222e
2012-11-12 15:00:56,567 DEBUG [phase.PhaseInterceptorChain] : Invoking handleMessage on interceptor org.apache.cxf.jaxrs.interceptor.JAXRSOutInterceptor@12cfd32a
2012-11-12 15:00:56,567 DEBUG [phase.PhaseInterceptorChain] : Invoking handleMessage on interceptor org.apache.cxf.interceptor.MessageSenderInterceptor MessageSenderEndingInterceptor@43300672
2012-11-12 15:00:56,567 INFO  [interceptor.LoggingOutInterceptor] : Outbound Message
---------------------------
ID: 2
Response-Code: 403
Content-Type: text/xml
Headers: {Date=[Mon, 12 Nov 2012 13:00:56 GMT], Content-Length=[0]}
--------------------------------------
2012-11-12 15:00:56,567 DEBUG [gzip.GZIPOutInterceptor] : Message is smaller than compression threshold, not compressing.
2012-11-12 15:00:56,567 DEBUG [context.HttpSessionSecurityContextRepository] : SecurityContext is empty or contents are anonymous - context will not be stored in HttpSession.
2012-11-12 15:00:56,567 DEBUG [servlet.ServletController] : Finished servicing http request on thread: Thread[http-bio-8080-exec-64,5,main]
2012-11-12 15:00:56,567 DEBUG [access.ExceptionTranslationFilter] : Chain processed normally
2012-11-12 15:00:56,567 DEBUG [context.SecurityContextPersistenceFilter] : SecurityContextHolder now cleared, as request processing completed

Answer 1

登录页面仅针对安全URL显示，但不针对安全方法显示

安全方法是保护应用程序安全的附加层，它要求用户已经过身份验证。 因此，您必须使用intersept-url ...来显示登录页面。

PS以防万一。 如Spring Security文档中所述：

只有在定义为Spring bean的实例 （在启用了method-security的同一应用程序上下文中） 才能保护带注释的方法。 如果要保护不是由Spring创建的实例（例如，使用new运算符），则需要使用AspectJ。