在Spring Security中,我使用DefaultJaasAuthenticationProvider Configuration进行用户名/密码登录验证。 JpamLoginModule用于认证。我成功与身份验证,但我有授权问题(ROLE_USER,ROLE_ADMIN), 正在获取HTTP状态403 - 访问被拒绝错误。Spring Security JAAS身份验证授权问题
下面的配置我在弹簧security.xml文件中使用
<security:authentication-manager>
<security:authentication-provider ref="jaasAuthProvider" />
</security:authentication-manager>
<bean id="jaasAuthProvider" class="org.springframework.security.authentication.jaas.DefaultJaasAuthenticationProvider">
<property name="configuration">
<bean class="org.springframework.security.authentication.jaas.memory.InMemoryConfiguration">
<constructor-arg>
<map>
<entry key="SPRINGSECURITY">
<array>
<bean class="javax.security.auth.login.AppConfigurationEntry">
<constructor-arg value="net.sf.jpam.jaas.JpamLoginModule" />
<constructor-arg>
<util:constant static-field="javax.security.auth.login.AppConfigurationEntry$LoginModuleControlFlag.REQUIRED" />
</constructor-arg>
<constructor-arg>
<map></map>
</constructor-arg>
</bean>
</array>
</entry>
</map>
</constructor-arg>
</bean>
</property>
<property name="authorityGranters">
<list>
<bean class="it.webapps.pam.RoleGranter" />
</list>
</property>
</bean>
<bean id="userDetailsService" class="it.webapps.pam.UserDetailsServiceImpl">
</bean>
RoleGranter.java代码
public class RoleGranter implements AuthorityGranter {
public RoleGranter() {
System.out.print("=== Creating My Authority Granter ===");
}
@Override
public Set<String> grant(Principal principal) {
return Collections.singleton("ROLE_ADMIN");
}
}
的建议是非常有帮助的
我试过这个“return Collections.singleton(”ADMIN“)”,但HTTP状态403-访问被拒绝。我使用的是spring-security-core-3.1.0.RC3 jar。任何其他调试方法? – shakkir3435