我正在慢慢发疯,试图配置 Spring Security 3.0.0 来保护应用程序。
我已将服务器(码头)配置为要求客户端身份验证(使用智能卡)。但是,我似乎无法正确执行 applicationContext-security.xml 和 UserDetailsService 。
首先,从应用程序上下文文件中:
<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:context="http://www.springframework.org/schema/context"
xmlns:security="http://www.springframework.org/schema/security"
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.0.xsd
http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.0.xsd">
<security:global-method-security secured-annotations="enabled" />
<security:http auto-config="true">
<security:intercept-url pattern="/**" access="IS_AUTHENTICATED_ANONYMOUSLY" requires-channel="https"/>
<security:x509 subject-principal-regex="CN=(.*?)," user-service-ref="accountService" />
</security:http>
<bean id="accountService" class="com.app.service.AccountServiceImpl"/>
UserDetailsService 如下所示:
public class AccountServiceImpl implements AccountService, UserDetailsService {
private static final Log log = LogFactory.getLog(AccountServiceImpl.class);
private AccountDao accountDao;
@Autowired
public void setAccountDao(AccountDao accountDao) {
this.accountDao = accountDao;
}
public UserDetails loadUserByUsername(String s) throws UsernameNotFoundException, DataAccessException {
log.debug("called loadUserByUsername()");
System.out.println("called loadByUsername()");
Account result = accountDao.getByEdpi(s);
return result;
}
}
该应用程序有一个带有登录按钮的“首页”,因此访问该页面不需要任何类型的身份验证。
任何帮助表示赞赏。