如何正确编写spring-security.xml文件？

Question

我是Spring安全新手，我试图将它应用到一个可用的spring-mvc项目中。 错误是：

cvc-complex-type.2.4.c: The matching wildcard is strict, 
but no declaration can be found for element http. 

弹簧security.xml文件：在pom.xml中

<beans:beans 
xmlns="http://www.springframework.org/schema/security" 
xmlns:beans="http://www.springframework.org/schema/beans" 
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
xmlns:context="http://www.springframework.org/schema/context"  
xsi:schemaLocation="http://www.springframework.org/schema/beans 
http://www.springframework.org/schema/beans/spring-beans.xsd 
http://www.springframework.org/schema/context 
http://www.springframework.org/schema/security 
http://www.springframework.org/schema/security/spring-security.xsd 
http://www.springframework.org/schema/context/spring-context.xsd"> 

<http auto-config='true'> 
<intercept-url pattern="/**" access="ROLE_USER" /> 
</http> 

<authentication-manager> 
<authentication-provider> 
    <user-service> 
    <user name="matt3o" password="secret" authorities="ROLE_USER" /> 
    <user name="admin" password="admin" authorities="ROLE_USER,ROLE_ADMIN" /> 
    </user-service> 
</authentication-provider> 

我加入了弹簧安全的依赖。

如果我删除

<http auto-config='true'> 
<intercept-url pattern="/**" access="ROLE_USER" /> 
</http> 

的错误是一样的，但是：

no declaration can be found for element authentication-manager. 

它看起来像命名空间不工作。

Answer 1

xml的默认命名空间是http://www.springframework.org/schema/beans，但它应该是http://www.springframework.org/schema/security。你也需要添加在xsi:schemaLocation

http://www.springframework.org/schema/security 
http://www.springframework.org/schema/security/spring-security.xsd 

以下内容，您必须配置如何为用户提供的凭据。最简单的有

1. 基于表单的登录

   用户使用HTML表单输入凭据。要使用表单登录将<form-login />放在<http>标签内，这会给你默认的登录页面，以后可以自己替换。

2. 基本认证。

   用户使用浏览器的登录对话框。在<http>标签内使用基本放<http-basic />。

所以你的最终spring-security.xml应该是。

<?xml version="1.0" encoding="UTF-8"?> 
<beans:beans xmlns="http://www.springframework.org/schema/security" 
     xmlns:beans="http://www.springframework.org/schema/beans" 
     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
     xmlns:context="http://www.springframework.org/schema/context"  
     xsi:schemaLocation="http://www.springframework.org/schema/beans 
          http://www.springframework.org/schema/beans/spring-beans.xsd 
          http://www.springframework.org/schema/context 
          http://www.springframework.org/schema/security 
          http://www.springframework.org/schema/security/spring-security.xsd 
          http://www.springframework.org/schema/context/spring-context.xsd"> 


    <http auto-config='true'> 
    <intercept-url pattern="/logged" access="ROLE_USER"/> 
    <!-- Replace the below with http-basic tag for basic authentication --> 
    <form-login/> 
    </http>  

    <authentication-manager> 
    <authentication-provider> 
     <user-service> 
     <user name="matt3o" password="secret" authorities="ROLE_USER" /> 
     <user name="admin" password="admin" authorities="ROLE_USER,ROLE_ADMIN" /> 
     </user-service> 
    </authentication-provider> 
    </authentication-manager> 

</beans:beans> 

注意：不要忘了加弹簧安全config.jar在类路径中。