12
所以最近我将Spring配置从XML迁移到了Java配置。 这是一个Spring OAuth 2服务器，一些端点通过客户端身份验证进行安全保护，一些端点（confirm_access）通过用户身份验证进行安全保护，该身份验证通过过滤器（“authenticationFilter”）进行重定向，委派给登录应用程序。 但我不能够做同样的春季安全的Java配置：Spring Security Java Config
这里我的工作安全性的XML配置：
<sec:http pattern="/token" create-session="stateless" authentication-manager-ref="clientAuthenticationManager"
entry-point-ref="oauthAuthenticationEntryPoint">
<sec:intercept-url pattern="/token" access="IS_AUTHENTICATED_FULLY" />
<sec:anonymous enabled="false" />
<sec:http-basic entry-point-ref="oauthAuthenticationEntryPoint" />
<!-- include this only if you need to authenticate clients via request parameters -->
<sec:custom-filter ref="clientCredentialsTokenEndpointFilter" before="BASIC_AUTH_FILTER" />
<sec:access-denied-handler ref="oauthAccessDeniedHandler" />
</sec:http>
<sec:http pattern="/css/**" security="none" />
<sec:http pattern="/js/**" security="none" />
<sec:http access-denied-page="/errors/access-denied.html" disable-url-rewriting="true" entry-point-ref="authenticationEntryPoint">
<sec:intercept-url pattern="/authorize" access="ROLE_USER" />
<sec:intercept-url pattern="confirm_access" access="ROLE_USER" />
<sec:intercept-url pattern="/device/authorize" access="ROLE_USER" />
<sec:intercept-url pattern="/**" access="IS_AUTHENTICATED_ANONYMOUSLY" />
<sec:custom-filter ref="authenticationFilter" before="ANONYMOUS_FILTER" />
<sec:anonymous />
</sec:http>
<sec:authentication-manager id="clientAuthenticationManager">
<sec:authentication-provider user-service-ref="clientDetailsUserService" />
</sec:authentication-manager>
<sec:authentication-manager alias="authenticationManager">
<sec:authentication-provider ref="authenticationProvider" />
</sec:authentication-manager>
<sec:global-method-security pre-post-annotations="enabled" proxy-target-class="true">
<sec:expression-handler ref="oauthExpressionHandler" />
</sec:global-method-security>
<oauth:expression-handler id="oauthExpressionHandler" />
<oauth:web-expression-handler id="oauthWebExpressionHandler" />
这里是我的Java配置的尝试：
@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled=true)
@Order(1)
@Import({WebSecurityConfig.TokenEndpointSecurityConfigurationAdapter.class,
WebSecurityConfig.ResourceSecurityConfigurationAdapter.class,
WebSecurityConfig.AnonymousSecurityConfigurationAdapter.class})
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
@Autowired
ClientDetailsUserDetailsService clientDetailsUserService;
@Bean(name = "clientAuthenticationManager")
@Override
public AuthenticationManager authenticationManagerBean() throws Exception {
return super.authenticationManagerBean();
}
@Override
protected void registerAuthentication(AuthenticationManagerBuilder auth) throws Exception {
auth.userDetailsService(clientDetailsUserService);
}
@Configuration
@Order(2)
public static class TokenEndpointSecurityConfigurationAdapter extends WebSecurityConfigurerAdapter {
@Autowired
ClientDetailsUserDetailsService clientDetailsUserService;
@Autowired
OAuth2AuthenticationEntryPoint oauthAuthenticationEntryPoint;
@Autowired
ClientCredentialsTokenEndpointFilter clientCredentialsTokenEndpointFilter;
@Autowired
OAuth2AccessDeniedHandler oauthAccessDeniedHandler;
@Override
protected void configure(HttpSecurity http) throws Exception {
http
.userDetailsService(clientDetailsUserService)
.anonymous().disable()
.authorizeUrls()
.antMatchers("/token")
.fullyAuthenticated()
.and()
.httpBasic()
.authenticationEntryPoint(oauthAuthenticationEntryPoint)
.and()
.addFilterBefore(clientCredentialsTokenEndpointFilter, BasicAuthenticationFilter.class)
.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.stateless)
.and()
.exceptionHandling().accessDeniedHandler(oauthAccessDeniedHandler);
}
}
@Configuration
@Order(3)
public static class ResourceSecurityConfigurationAdapter extends WebSecurityConfigurerAdapter{
@Override
public void configure(WebSecurity web) throws Exception {
web
.ignoring()
.antMatchers("/css/**","/js/**");
}
}
@Configuration
@Order(4)
public static class AnonymousSecurityConfigurationAdapter extends WebSecurityConfigurerAdapter{
@Autowired
OAuth2AuthenticationEntryPoint oauthAuthenticationEntryPoint;
@Autowired
AuthenticationFilter authenticationFilter;
@Autowired
PreAuthenticatedAuthenticationProvider authenticationProvider;
@Override
protected void configure(HttpSecurity http) throws Exception {
http
.authenticationProvider(authenticationProvider)
.addFilterBefore(authenticationFilter, AnonymousAuthenticationFilter.class)
.authorizeUrls().anyRequest().anonymous()
.and()
.authorizeUrls()
.antMatchers("/authorize","confirm_access","/custom/authorize")
.hasRole("USER")
.and()
.exceptionHandling().accessDeniedPage("/errors/access-denied.html");
}
}
}
使用此配置，Spring Security会尝试为所有端点验证用户，并显示生成登录表单，因此不会添加自定义过滤器。
我的错误在哪里？
需要两个AuthenticationManagers（一个用于OAuth用户端，一个用于用户）an example，但我能看到的只是一个在你的基于java的配置中。 –
你好@Eugen，这是一个很好的例子，帮助我。但我有一些问题，当我在HttpSecurity中使用'addFilterBefore（clientCredentialsTokenEndpointFilter，BasicAuthenticationFilter.class）'时，我得到了下面的编译器错误'他的方法addFilterBefore（Filter，Class <？extends Filter>）从类型HttpSecurity引用丢失类型过滤器“我如何解决这个问题？ –