0

我需要在我的 webapp 中添加 spring 安全性。我的应用程序在管理部分使用 spring 和 vaadin。我正在使用表单登录作为身份验证模式。所以我正在努力解决的问题是，当我尝试发布以下表格时：

<form name='f' action="j_spring_security_check"
    method='POST'>

    <table>
        <tr>
            <td>User:</td>
            <td><input type='text' name='j_username' value=''>
            </td>
        </tr>
        <tr>
            <td>Password:</td>
            <td><input type='password' name='j_password' />
            </td>
        </tr>
        <tr>
            <td colspan='2'><input name="submit" type="submit"
                value="submit" />
            </td>
        </tr>
        <tr>
            <td colspan='2'><input name="reset" type="reset" />
            </td>
        </tr>
    </table>

</form>

我得到一个 404 重定向。所以在这里我粘贴我的 web.xml

<?xml version="1.0" encoding="UTF-8"?>
<web-app version="2.5" xmlns="http://java.sun.com/xml/ns/javaee"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd">

    <!-- The definition of the Root Spring Container shared by all Servlets and Filters -->
    <context-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>/WEB-INF/spring/root-context.xml</param-value>
    </context-param>

    <context-param>
        <description>Vaadin production mode</description>
        <param-name>productionMode</param-name>
        <param-value>false</param-value>
    </context-param>

    <!-- Enables Spring Security -->
    <filter>
        <filter-name>springSecurityFilterChain</filter-name>
        <filter-class>
            org.springframework.web.filter.DelegatingFilterProxy
        </filter-class>
    </filter>
    <filter-mapping>
        <filter-name>springSecurityFilterChain</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

    <!-- Enables Spring internationalization -->
    <filter>
        <filter-name>encoding-filter</filter-name>
        <filter-class>
            org.springframework.web.filter.CharacterEncodingFilter
        </filter-class>
        <init-param>
            <param-name>encoding</param-name>
            <param-value>UTF-8</param-value>
        </init-param>
    </filter>

    <filter-mapping>
        <filter-name>encoding-filter</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

    <!-- Creates the Spring Container shared by all Servlets and Filters -->
    <listener>
        <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
    </listener>

    <!-- Processes application requests -->
    <servlet>
        <servlet-name>appServlet</servlet-name>
        <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
        <init-param>
            <param-name>contextConfigLocation</param-name>
            <param-value>/WEB-INF/spring/appServlet/servlet-context.xml</param-value>
        </init-param>
        <load-on-startup>1</load-on-startup>
    </servlet>

    <servlet>
        <servlet-name>Vaadin Application Servlet</servlet-name>
        <servlet-class>com.vaadin.terminal.gwt.server.ApplicationServlet</servlet-class>
        <init-param>
            <description>Vaadin application class to start</description>
            <param-name>application</param-name>
            <param-value>com.windy.server.admin.MyVaadinApplication</param-value>
        </init-param>
    </servlet>

    <servlet-mapping>
        <servlet-name>Vaadin Application Servlet</servlet-name>
        <url-pattern>/admin/*</url-pattern>
    </servlet-mapping>
    <servlet-mapping>
        <servlet-name>Vaadin Application Servlet</servlet-name>
         <url-pattern>/VAADIN/*</url-pattern>
    </servlet-mapping>

    <servlet-mapping>
        <servlet-name>appServlet</servlet-name>
        <url-pattern>*.do</url-pattern>
    </servlet-mapping>



    <error-page>
        <error-code>404</error-code>
        <location>/WEB-INF/views/page404.jsp</location>
    </error-page> 

</web-app>

这里是我的弹簧安全配置：

<security:http authentication-manager-ref="authenticatioManager" auto-config="true" pattern="/web/**">
    <security:intercept-url pattern="/web/**" access="ROLE_AUTH" />
    <security:form-login login-page="/loginTest.do" default-target-url="/loginWelcome.do"
        authentication-failure-url="/loginfailed.do" />
    <security:logout logout-success-url="/logout.do" invalidate-session="true"/> 
    <security:session-management>
        <security:concurrency-control max-sessions="1" error-if-maximum-exceeded="true" expired-url="/web/login" />
    </security:session-management>
</security:http>

<bean id="userDetailsService" class="com.ddelizia.server.service.core.impl.UserDetailsServiceImpl"/>

<security:authentication-manager id="authenticatioManager">
  <security:authentication-provider user-service-ref="userDetailsService">
    <!-- <security:password-encoder hash="md5"/> -->
  </security:authentication-provider> 
</security:authentication-manager>

我还尝试将参数 login-processing-url="/login_spring" 添加到表单登录中，并将表单操作更改为 login_spring

我的应用程序在地址为 localhost:8080/myapp 的 tomcat 上运行，并且在 localhost:8080/myapp/login_spring 上调用了登录操作，但我仍然收到相同的错误。

我还尝试修改我的 web.xml，更改 spring 安全过滤器映射，如下所示：

    <filter-mapping>
        <filter-name>springSecurityFilterChain</filter-name>
        <url-pattern>*.log</url-pattern>
    </filter-mapping>

并更改 login-processing-url="/login_spring.log" 但我仍然得到 404 页面。

然后我尝试切换到http-basic authentcation，但在这种情况下它可以工作......我不明白我做错了什么......

在此先感谢您的帮助

4

1 回答 1

1

将您的表单元素更改为：

<form name='f' action='<c:url value="/j_spring_security_check" />' method='POST'>

如果您没有 JSTL Core taglib，请在文件开头添加：

<%@ taglib uri="http://java.sun.com/jsp/jstl/core" prefix="c"%>

编辑：

我想我发现了问题的根源。pattern="/web/**"从<http>元素中移除，只留下<security:http authentication-manager-ref="authenticatioManager" auto-config="true">.

更重要的是，j_spring_security_check 必须在springSecurityFilterChain，所以将映射更改为：

<filter-mapping>
    <filter-name>springSecurityFilterChain</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

现在尝试不使用login-processing-urlin<form-login>但使用<c:url>. 我们的 Vaadin 应用程序中有类似的配置，它工作得很好。

于 2012-09-19T20:11:26.137 回答