Spring Security，始終重定向到“登錄”頁面

Question

我有一個嚴重的問題...我正在嘗試使用Spring 3，Hibernate 3和AngularJS在weblogic 11g上創建一個應用程序。 在2天的時間里，讓我的應用正常工作非常困難。 終於，我能夠完成這項工作！

但是問題是當我對自己進行身份驗證並在應用程序的每個頁面上導航時，spring security會在登錄頁面上重定向我...而我真的不知道為什么...

Web.xml：

<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://java.sun.com/xml/ns/javaee" xmlns:jsp="http://java.sun.com/xml/ns/javaee/jsp" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd">
  <servlet>
    <servlet-name>dispatcher</servlet-name>
    <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
    <init-param>
      <param-name>contextConfigLocation</param-name>
      <param-value>/WEB-INF/spring/spring.xml</param-value>
    </init-param>
    <load-on-startup>1</load-on-startup>
  </servlet>

  <servlet-mapping>
    <servlet-name>dispatcher</servlet-name>
    <url-pattern>/</url-pattern>
  </servlet-mapping>

  <listener>
    <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
  </listener>
  <listener>
    <listener-class>com.bla.Init</listener-class>
</listener>

  <context-param>
    <param-name>contextConfigLocation</param-name>
    <param-value>
            /WEB-INF/spring/spring.xml
        </param-value>
  </context-param>

  <filter>
    <filter-name>springSecurityFilterChain</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
  </filter>
  <filter-mapping>
    <filter-name>springSecurityFilterChain</filter-name>
    <url-pattern>/*</url-pattern>
  </filter-mapping>
  <filter>
    <filter-name>encodingFilter</filter-name>
    <filter-class>org.springframework.web.filter.CharacterEncodingFilter</filter-class>
    <init-param>
      <param-name>encoding</param-name>
      <param-value>UTF-8</param-value>
    </init-param>
    <init-param>
      <param-name>forceEncoding</param-name>
      <param-value>true</param-value>
    </init-param>
  </filter>
  <filter-mapping>
    <filter-name>encodingFilter</filter-name>
    <servlet-name>dispatcher</servlet-name>
  </filter-mapping>
  <jsp-config>
    <jsp-property-group>
      <url-pattern>*.jsp</url-pattern>
      <page-encoding>UTF-8</page-encoding>
      <trim-directive-whitespaces>true</trim-directive-whitespaces>
    </jsp-property-group>
  </jsp-config>
</web-app>

Spring.xml

<beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xmlns:context="http://www.springframework.org/schema/context"
       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
                           http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.0.xsd
                           http://www.springframework.org/schema/context http://www.springframework.org/schema/task/spring-context-3.0.xsd">

    <!-- Basic Configurations -->
    <context:annotation-config/>

    <context:component-scan base-package="test.model"/>
    <context:component-scan base-package="test.repository"/>
    <context:component-scan base-package="test.service"/>
    <context:component-scan base-package="test.controller"/>

    <!-- SpringMVC -->
    <import resource="spring-mvc.xml"/>

    <!-- SpringData -->
    <import resource="spring-jpa.xml"/>

    <!-- SpringSecurity -->
    <import resource="spring-security.xml"/>
</beans>

spring-security.xml ：

<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xmlns:security="http://www.springframework.org/schema/security"
       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
       http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd">

    <security:global-method-security secured-annotations="enabled" />

    <security:http auto-config="true" use-expressions="true" access-denied-page="/login?error=403">

        <security:intercept-url pattern="/" access="permitAll" />
        <security:intercept-url pattern="/protected/**" access="isFullyAuthenticated()" />

        <security:form-login login-page="/login" authentication-failure-url="/login?error=403" default-target-url="/protected/home" />

        <security:logout invalidate-session="true" logout-success-url="/login" logout-url="/logout" />
    </security:http>

    <security:authentication-manager>
        <security:authentication-provider>
            <security:jdbc-user-service
                    data-source-ref="myRapportDataSource"
                    users-by-username-query="select nni, password, enabled from system_user where nni = ?"
                    authorities-by-username-query="select u.nni as login, u.user_role as role from system_user u where u.nni = ?" />
        </security:authentication-provider>
    </security:authentication-manager>
</beans>

我也添加了spring-mvc.xml ：

<beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xmlns:mvc="http://www.springframework.org/schema/mvc"
       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
                           http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc-3.0.xsd">

    <mvc:annotation-driven/>
    <mvc:default-servlet-handler/>

    <!-- Login Interceptor -->
    <mvc:interceptors>
        <mvc:interceptor>
            <mvc:mapping path="/protected/**"/>
            <bean class="gram.interceptor.LoginInterceptor"/>
        </mvc:interceptor>
        <!-- workaround to fix IE8 problem -->
        <bean id="webContentInterceptor"
              class="org.springframework.web.servlet.mvc.WebContentInterceptor">
            <property name="cacheSeconds" value="0"/>
            <property name="useExpiresHeader" value="true"/>
            <property name="useCacheControlHeader" value="true"/>
            <property name="useCacheControlNoStore" value="true"/>
        </bean>
    </mvc:interceptors>
</beans>

最初，此應用程序在Tomcat 6上運行良好，但我必須在weblogic 10.3.6上進行遷移

有任何想法嗎 ？ 我快要絕望了...

非常感謝大家看我的問題

Answer 1

同

<security:intercept-url pattern="/" access="permitAll" />

只有與/匹配的URL才具有permitAll訪問權限。 因此，您實際上需要的是：

<security:intercept-url pattern="/protected/**" access="isFullyAuthenticated()" />
<security:intercept-url pattern="/**" access="permitAll" />