3

我有一个使用 Jersey 2.2 实现的 REST 服务，并希望保护它。我已经让 Apache Shiro 替补，没有任何重大问题。现在我想用 Spring Security 3 制作同样的东西（基本的 http 安全）原型。

问题是我真的迷失在混合两个框架所需的依赖关系之间。（球衣 2.2 没有弹簧球衣）。

因此，如果有人能指出我在一个 Maven 项目中说明任何类型的 spring-sec3/jersey2.2 集成的工作示例，我将非常感激。

感谢提前

4

1 回答 1

0

自从问题发布以来，我终于设法在一个应用程序中完成了工作：

  • 球衣 2.2
  • 春季赛 3.1
  • guice 3.0

maven pom.xml 文件中的相关属性和依赖项部分：

<properties>
  <spring.version>3.1.0.RELEASE</spring.version>
  <jersey.version>2.2</jersey.version>
  <guice.version>3.0</guice.version>
  <hk2.version>2.2.0-b14</hk2.version>
 </properties>

<dependencies>
 <dependency>
   <groupId>org.glassfish.jersey.containers</groupId>
   <artifactId>jersey-container-servlet</artifactId>
   <version>${jersey.version}</version>
 </dependency>
 <dependency>
  <groupId>org.glassfish.jersey.core</groupId>
  <artifactId>jersey-client</artifactId>
  <version>${jersey.version}</version>
 </dependency>
 <dependency>
  <groupId>org.codehaus.jackson</groupId>
  <artifactId>jackson-mapper-asl</artifactId>
  <version>1.9.12</version>
 </dependency>
 <dependency>
  <groupId>com.fasterxml.jackson.jaxrs</groupId>
  <artifactId>jackson-jaxrs-json-provider</artifactId>
  <version>2.2.1</version>
 </dependency>
 <dependency>
  <groupId>com.google.inject.extensions</groupId>
  <artifactId>guice-servlet</artifactId>
  <version>${guice.version}</version>
</dependency>
<dependency>
  <groupId>org.glassfish.hk2</groupId>
  <artifactId>guice-bridge</artifactId>
  <version>${hk2.version}</version>
</dependency>
<!-- SECURITY (start) -->
<dependency>
  <groupId>org.springframework.security</groupId>
  <artifactId>spring-security-core</artifactId>
  <version>${spring.version}</version>
</dependency>
<dependency>
  <groupId>org.springframework.security</groupId>
  <artifactId>spring-security-config</artifactId>
  <version>${spring.version}</version>
</dependency>
<dependency>
 <groupId>org.springframework.security</groupId>
 <artifactId>spring-security-web</artifactId>
 <version>${spring.version}</version>
</dependency>
<dependency>
  <groupId>org.springframework.security</groupId>
  <artifactId>spring-security-ldap</artifactId>
  <version>${spring.version}</version>
</dependency>
</dependencies>

现在在 web.xml 文件中，您需要注意过滤器顺序，以便在 spring 和 guice 之间进行和平交互：

<web-app version="2.5" xmlns="http://java.sun.com/xml/ns/javaee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns   /javaee/web-app_2_5.xsd">

<!-- Filter to secure Jersey (JAX-RS) services -->
<context-param>
    <param-name>contextConfigLocation</param-name>
    <param-value>/WEB-INF/applicationContext-security.xml</param-value>
</context-param>

<listener>
   <listener-class>org.springframework.web.context.ContextLoaderListener</listener-  class>
</listener>    

<!-- fist arm the spring security filters --->
<filter>
  <filter-name>springSecurityFilterChain</filter-name>
  <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
  <filter-name>springSecurityFilterChain</filter-name>
  <url-pattern>/*</url-pattern>
</filter-mapping> 

<!-- then filter all URLs through Guice Servlet -->
<filter>
  <filter-name>guiceFilter</filter-name>
  <filter-class>com.google.inject.servlet.GuiceFilter</filter-class>
</filter>
<filter-mapping>
   <filter-name>guiceFilter</filter-name>
   <url-pattern>/*</url-pattern>
</filter-mapping>
<listener>
    <listener-class>org.whatever.myapp.inject.GuiceServletConfig</listener-class>
</listener>

<!-- finaly define our rest app mapping -->
<servlet>
    <servlet-name>JerseyServletContainer</servlet-name>
    <servlet-class>org.glassfish.jersey.servlet.ServletContainer</servlet-class>
<init-param>
     <!-- Jersey would scan the specified package and register available    resources -->
          <param-name>jersey.config.server.provider.packages</param-name>
          <param-value>org.whatever.myapp.interfaces</param-value>
    </init-param>
    <init-param>
            <param-name>javax.ws.rs.Application</param-name>
    <param-value>org.whatever.myapp.inject.CurrentResourceConfig</param-value>
     </init-param>
     <load-on-startup>1</load-on-startup>
</servlet>

 <servlet-mapping>
    <servlet-name>JerseyServletContainer</servlet-name>
    <url-pattern>/webapi/*</url-pattern>
 </servlet-mapping>

 </web-app>

请注意，如果您希望同时使用 guice 和 hk2 注射器，您需要： - 注意您使用的 hk2 版本（来自 pom.xml 的版本有效） - 注意避免使用 guice Guice 类之外的注入注解，使用 guice 类之外的 javax 标准。

最后，您需要使用以下代码从 hk2 引导 guice：

package org.whatever.myapp.inject.CurrentResourceConfig;

public class CurrentResourceConfig extends ResourceConfig
 {
  @Inject
  public CurrentResourceConfig(ServiceLocator serviceLocator)
  {
      GuiceBridge.getGuiceBridge().initializeGuiceBridge(serviceLocator);
      GuiceIntoHK2Bridge guiceBridge = serviceLocator.getService(GuiceIntoHK2Bridge.class);
      guiceBridge.bridgeGuiceInjector(GuiceServletConfig.getInjectorInstance());
   }
  }
}
于 2013-10-29T10:42:57.493 回答