Spring Security PreAuthorize自定義方法Bean解析器未注冊？

Question

我只是學習Spring，通過教程和測試可能性來學習。 我的目標之一是使用自定義方法和PreAuthorize批注保護服務方法。 不幸的是，擁有自定義方法的Bean無法解析，我也不知道為什么。 也許有人一見鍾情。

持有自定義方法的Bean：

@Component("mySecurityService")
public class MySecurityService {
    public boolean hasPermission() {
        return true; //simple implementation just to look if has permission is called
    }
}

要保證的服務：

public interface OrderService {

  @PreAuthorize("@mySecurityService.hasPermission()")
  public AllOrdersEvent requestAllOrders(RequestAllOrdersEvent requestAllCurrentOrdersEvent);

  public OrderDetailsEvent requestOrderDetails(RequestOrderDetailsEvent requestOrderDetailsEvent);

  public OrderStatusEvent requestOrderStatus(RequestOrderStatusEvent requestOrderStatusEvent);

  public OrderCreatedEvent createOrder(CreateOrderEvent event);

  public OrderUpdatedEvent setOrderPayment(SetOrderPaymentEvent setOrderPaymentEvent);

  public OrderDeletedEvent deleteOrder(DeleteOrderEvent deleteOrderEvent);

}

Java安全配置：

@EnableWebSecurity
@Configuration
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class SecurityConfig extends WebSecurityConfigurerAdapter {

  @Override
  protected void registerAuthentication(AuthenticationManagerBuilder auth) throws Exception {
    auth.inMemoryAuthentication()
       .withUser("letsnosh").password("noshing").roles("USER");
  }

  @Override
  @Bean
  public AuthenticationManager authenticationManagerBean() throws Exception {
    return super.authenticationManagerBean();
  }

  @Bean(name = "mySecurityService")
  MySecurityService createSecurityService(){return new MySecurityService();}

@Override
  protected void configure(HttpSecurity http) throws Exception {
     /*
   http.authorizeUrls()
    .antMatchers("/aggregators*//**//**").hasRole("USER")
    .anyRequest().anonymous()
    .and()
    .httpBasic();
      */

  }
}

錯誤：

 No bean resolver registered in the context to resolve access to bean 'mySecurityService'

Answer 1

您好，我解決了這個問題。 它已連接到Spring Security版本。

我從官方的Spring Rest Tutotrial獲得了該版本： 3.2.0.M2

在此版本中，我必須聲明安全上下文，如下所示：

@EnableWebSecurity
@Configuration
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class SecurityConfig extends WebSecurityConfigurerAdapter {

  @Override
  protected void registerAuthentication(AuthenticationManagerBuilder auth) throws Exception {
    auth.inMemoryAuthentication()
        .withUser("letsnosh").password("noshing").roles("USER");
  }

  @Override
  protected void configure(HttpSecurity http) throws Exception {
    http.authorizeUrls()
        .antMatchers("/aggregators/**").hasRole("USER")
        .anyRequest().anonymous()
        .and()
        .httpBasic();
  }
}

在這里引發了錯誤。

但是使用較新版本的Spring Security： 3.2.5.RELEASE我可以這樣聲明Config：

@EnableWebSecurity
@Configuration
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        auth.inMemoryAuthentication().withUser("user").password("password").roles("USER");
    }

    @Override
  protected void configure(HttpSecurity http) throws Exception {

   http.authorizeUrls()
        .antMatchers("/aggregators*//**//**").hasRole("USER")
        .anyRequest().anonymous()
        .and()
        .httpBasic();


  }

可以通過直接在MySecurityService類上使用@Component Annotaions或在返回MySecurityService實例的config類方法上使用@Bean注釋來解析該bean。