6

这个问题在几篇博客文章和 SO 问题中得到了较好的讨论。尽管如此，我还是找不到一个专门解决 java 配置问题的方法。我怀疑我在我的 java 配置文件中做错了什么，因为我发现一些帖子表明可以通过删除调试 XML 标记来解决问题（https://jira.springsource.org/browse/ SEC-1885 )。

我正在使用 spring security 的 3.2.0.RELEASE 和 spring 框架的 3.2.6.RELEASE。在 spring security/mvc 配置和自定义 AuthenticationProvider 中使用的主要文件下方。

网络配置：

@Configuration
@EnableWebMvc
@ComponentScan(basePackages = {"com.mypackage"})
@ImportResource( { "classpath:/spring-data.xml", "classpath:/trace-context.xml" })
@EnableTransactionManagement  
public class WebConfig extends WebMvcConfigurerAdapter {

    @Override
    public void addViewControllers(ViewControllerRegistry registry) {
        registry.addViewController("/login").setViewName("login");
    }

    @Bean
    public StandardServletMultipartResolver multipartResolver() {
        return new StandardServletMultipartResolver();
    }

    @Bean(destroyMethod = "shutdown")
    public GraphDatabaseService graphDatabaseService() {
        return new GraphDatabaseFactory().newEmbeddedDatabase("target/temp.db");
    }

    @Bean
    public RepositoryInitializer repositoryInitializer() {
        return new RepositoryInitializer();
    }

    @Override
    public void addResourceHandlers(ResourceHandlerRegistry registry) {
        registry.addResourceHandler("/resources/**").addResourceLocations("/resources/");
    }

    @Override
    public void addInterceptors(InterceptorRegistry registry) {
        LocaleChangeInterceptor localeChangeInterceptor = new         LocaleChangeInterceptor();
        localeChangeInterceptor.setParamName("lang");
        registry.addInterceptor(localeChangeInterceptor);
    }

    @Bean
    public LocaleResolver localeResolver() {
        CookieLocaleResolver cookieLocaleResolver = new CookieLocaleResolver();
        cookieLocaleResolver.setDefaultLocale(StringUtils.parseLocaleString("en"));
        return cookieLocaleResolver;
    }

    @Bean
    public ViewResolver viewResolver() {
        InternalResourceViewResolver viewResolver = new InternalResourceViewResolver();
        viewResolver.setViewClass(JstlView.class);
        viewResolver.setPrefix("/WEB-INF/views/");
        viewResolver.setSuffix(".jsp");
        return viewResolver;
    }

    @Bean
    public MessageSource messageSource() {
        ReloadableResourceBundleMessageSource messageSource = new ReloadableResourceBundleMessageSource();
        messageSource.setBasenames("classpath:messages/messages", "classpath:messages/validation");
        // if true, the key of the message will be displayed if the key is not
        // found, instead of throwing a NoSuchMessageException
        messageSource.setUseCodeAsDefaultMessage(true);
        messageSource.setDefaultEncoding("UTF-8");
        // # -1 : never reload, 0 always reload
        messageSource.setCacheSeconds(0);
        return messageSource;
    }
}

网络初始化器：

public class WebInitializer extends AbstractAnnotationConfigDispatcherServletInitializer {

    @Override
    protected Class<?>[] getRootConfigClasses() {
        return new Class[] { WebSecurityConfig.class };
    }

    @Override
    protected Class<?>[] getServletConfigClasses() {
        return new Class<?>[] { WebConfig.class};
    }

    @Override
    protected String[] getServletMappings() {
        return new String[] { "/" };
    }

    @Override
    protected Filter[] getServletFilters() {
        CharacterEncodingFilter characterEncodingFilter = new CharacterEncodingFilter();
        characterEncodingFilter.setEncoding("UTF-8");
        return new Filter[] { characterEncodingFilter, new SiteMeshFilter()};
    }

    @Override
    public void onStartup(ServletContext servletContext) throws ServletException {
        super.onStartup(servletContext);
        //servletContext.addListener(new HttpSessionEventPublisher());
    }
}

网络安全配置：

@Configuration
@EnableWebSecurity
@Order(1)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .authorizeRequests().anyRequest().permitAll();
        //  .antMatchers("/", "/login").permitAll()
        //  .anyRequest().authenticated();
        http
            .formLogin()
                .defaultSuccessUrl("/hello")
                .loginPage("/login")
                .permitAll()
                .and()
            .logout()
                .logoutUrl("/logout")
                .permitAll();
        http    
            .sessionManagement()
            .maximumSessions(1)
            .maxSessionsPreventsLogin(true);

    }    

    @Override
    public void configure(WebSecurity web) throws Exception {
        web
            .ignoring()
            .antMatchers("/resources/**");
    }

    @Override
    protected void configure(AuthenticationManagerBuilder authManagerBuilder) throws Exception {
        authManagerBuilder.authenticationProvider(new ApplicationAuthenticationProvider());
    }
}

WebSecurityInitializer：

public class WebSecurityInitializer extends AbstractSecurityWebApplicationInitializer {

}

身份验证提供者：

@Component(value = "authenticationProvider")
public class ApplicationAuthenticationProvider implements AuthenticationProvider {

    @Autowired
    public UserService userService;

    public ApplicationAuthenticationProvider() {}

    @Override
    public Authentication authenticate(Authentication authentication) throws AuthenticationException {
        String username = authentication.getName();
        String password = (String) authentication.getCredentials();

        User user = userService.loadUserByUsername(username);

        if (user == null) {
            throw new BadCredentialsException("Username not found.");
        }

        if (!password.equals(user.getPassword())) {
            throw new BadCredentialsException("Wrong password.");
        }

        Collection<? extends GrantedAuthority> authorities = user.getAuthorities();

        return new UsernamePasswordAuthenticationToken(username, password, authorities);
    }

    @Override
    public boolean supports(Class<?> arg0) {
        return true;
    }
}

用户服务：

@Service
public class UserService implements UserDetailsService {

    @Autowired
    private UserRepository userRepository;


    @Override
    public User loadUserByUsername(String username) throws UsernameNotFoundException {
        return userRepository.findByUsername(username);
    }
}

Spring 在构建其应用程序上下文时（在应用程序初始化期间）抛出异常：

[ERROR] [main 11:53:37] (FrameworkServlet.java:initServletBean:467) Context     initialization failed
org.springframework.beans.factory.BeanCreationException: Error creating bean with name         'authenticationProvider': Injection of autowired dependencies failed; nested exception is     org.springframework.beans.factory.BeanCreationException: Could not autowire field: public     com.evidencefactory.service.UserService     com.evidencefactory.security.ApplicationAuthenticationProvider.userService; nested     exception is java.lang.IllegalArgumentException: Can not set     com.evidencefactory.service.UserService field     com.evidencefactory.security.ApplicationAuthenticationProvider.userService to     sun.proxy.$Proxy71

我不明白为什么会这样，但是如果我UserDetailsService从类中删除接口实现UserService，那么应用程序就会成功启动。但是，当ApplicationAuthenticationProvider被 Spring 调用时，UserService不会自动装配到其中，并且应用程序会抛出 NullPointerException。

java.lang.NullPointerException
at com.evidencefactory.security.ApplicationAuthenticationProvider.authenticate(ApplicationAuthenticationProvider.java:33)
4

2 回答 2

5

想出了如何让它发挥作用，尽管仍有一些问题没有得到解决。

1）我仍然不知道为什么在UserService实现时Spring上下文初始化失败UserDetailsService。鉴于我没有看到它的用途，因为我使用的是 custom AuthenticationProvider，所以我刚刚删除了这个实现，现在一切正常。据我所知（从我对 Spring Security 参考文档的第一次初步阅读中我可以理解）提供自定义AuthenticationProvider或UserDetailsService实现是唯一的替代方案。

2）正如一位受访者（@Sotirios Delimanolis）所注意到的，我是ApplicatinoAuthenticationProvider手动实例化的，因为它不是由 Spring 管理的，所以这个实例不会有一个UserService自动装配到其中的实例。基于此，我更改WebSecurityConfig为获取ApplicationAuthenticationProvider如下所示的自动装配实例：

@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private ApplicationAuthenticationProvider authenticationProvider;

    @Override
    protected void configure(AuthenticationManagerBuilder authManagerBuilder) throws Exception {
        authManagerBuilder.authenticationProvider(authenticationProvider);
    }
}

这还不够，因为ApplicationAuthenticationProvider没有自动连接到WebSecurityConfig. 基于这个链接Spring Security 3.1.3 @Autowired not Work when using WebApplicationInitializer我注意到这是因为安全配置也应该有一个组件扫描声明。添加@ComponentScan(basePackages = {"com.mypackage"})解决WebSecurityConfig问题。

于 2013-12-24T17:36:42.810 回答
3

我将假设它UserService是一个类，并且@Transactional在其自身或其方法之一上有一些注释。

您需要将 CGLIB 添加到您的类路径并将您的更改@EnableTransactionManagement为

@EnableTransactionManagement(proxyTargetClass = true)

因此 Spring 使用 CGLIB 代理（可以代理类）而不是 JKD 代理（不能）。

或者，您可以创建一个接口UserService并实现（并用 注释@Service）一个UserServiceImpl类。您的自动装配UserService字段将保持不变，但 Spring 将能够使用 JDK 代理。

于 2013-12-24T02:28:55.363 回答