1

我正在使用 spring boot 来创建 RESTful Web 服务。为了安全起见，我通过扩展 AbstractUserDetailsAuthenticationProvider 来使用 BasicAuthenticationFilter 和自定义 AuthenticationProvider。我在控制器类中使用带有@Secured 注释的方法级安全性。一切都很好，除了我想让弹簧执行器也能正常工作。

执行器的问题是我在尝试对请求进行身份验证时遇到休眠异常，因为没有打开会话。所以当我去http://localhost:8081/info我得到一个休眠异常。

似乎执行器正在使用与应用程序其余部分不同的过滤器链。如果是这样的话，我相信这是有充分理由的。但是，我不知道如何注册我的 OpenSessionInViewFilter 以便它成为每个过滤器链中的第一个过滤器。我的 OpenSessionInViewFilter 是通过我的 @Configuration 类之一中的 FilterRegistrationBean 注册的。

Spring boot 很棒，但在幕后有很多神奇之处，我还没有弄清楚如何深入研究他们的代码，看看它从哪里开始并遵循它。

这是我的一些配置。我试图包括我认为重要的内容。如果您想看另一件作品，请告诉我。

任何帮助表示赞赏。

@EnableWebSecurity
@Configuration
public class WebSecurityConfig extends WebSecurityConfigurerAdapter
{
    @Override
    protected void configure(HttpSecurity http) throws Exception
    {
        http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
        http.authorizeRequests().anyRequest().fullyAuthenticated()
            .and().httpBasic().authenticationDetailsSource(new WebAuthenticationDetailsSource()
            {
                @Override
                public WebAuthenticationDetails buildDetails(HttpServletRequest context)
                {
                    return new ThirdPartyAuthenticationDetails(context);
                }
            })
            .and().csrf().disable();
    }
} 

@Configuration
public class WebSecurityConfiguration extends GlobalAuthenticationConfigurerAdapter
{
    @Autowired
    private DataSource dataSource;

    @Autowired
    @Qualifier("thirdPartySystemDAO")
    private EntityDAO<ThirdPartySystem> thirdPartySystemDAO;

    @Override
    public void init(AuthenticationManagerBuilder auth) throws Exception
    {
        auth.authenticationProvider(authenticationProvider());
    }

    @Bean
    public AuthenticationProvider authenticationProvider()
    {
        ThirdPartyAuthenticationProvider result = new ThirdPartyAuthenticationProvider();
        result.setSecurityService(thirdPartySecurityService());
        return result;
    }

    @Bean
    public ThirdPartySecurityService thirdPartySecurityService()
    {
        ThirdPartySecurityServiceImpl result = new ThirdPartySecurityServiceImpl();
        result.setJdbcTemplate(new JdbcTemplate(dataSource));
        result.setThirdPartySystemDAO(thirdPartySystemDAO);
        return result;
    }
}

这是尝试访问执行器的 /info 端点时的堆栈跟踪。

org.hibernate.HibernateException: Could not obtain transaction-synchronized Session for current thread
    at org.springframework.orm.hibernate4.SpringSessionContext.currentSession(SpringSessionContext.java:134) ~[spring-orm-4.1.4.RELEASE.jar:4.1.4.RELEASE]
    at org.hibernate.internal.SessionFactoryImpl.getCurrentSession(SessionFactoryImpl.java:988) ~[hibernate-core-4.2.2.Final.jar:4.2.2.Final]
    at com.redi.dao.hibernate.HibernateDAO.getCurrentSession(HibernateDAO.java:495) ~[redi-dao-4.3.0.jar:4.3.0]
    at com.redi.dao.hibernate.HibernateDAO.createQuery(HibernateDAO.java:460) ~[redi-dao-4.3.0.jar:4.3.0]
    at com.redi.dao.hibernate.HibernateDAO.findOneWhere(HibernateDAO.java:58) ~[redi-dao-4.3.0.jar:4.3.0]
    at com.mycompany.DefaultVerifiService.getInstitution(DefaultVerifiService.java:349) ~[classes/:na]
    at com.mycompany.thirdparty.ws.security.ThirdPartyAuthenticationProvider.retrieveUser(ThirdPartyAuthenticationProvider.java:36) ~[classes/:na]
    at org.springframework.security.authentication.dao.AbstractUserDetailsAuthenticationProvider.authenticate(AbstractUserDetailsAuthenticationProvider.java:143) ~[spring-security-core-4.0.3.RELEASE.jar:4.0.3.RELEASE]
    at org.springframework.security.authentication.ProviderManager.authenticate(ProviderManager.java:167) ~[spring-security-core-4.0.3.RELEASE.jar:4.0.3.RELEASE]
    at org.springframework.security.authentication.ProviderManager.authenticate(ProviderManager.java:192) ~[spring-security-core-4.0.3.RELEASE.jar:4.0.3.RELEASE]
    at org.springframework.security.web.authentication.www.BasicAuthenticationFilter.doFilter(BasicAuthenticationFilter.java:168) ~[spring-security-web-3.2.5.RELEASE.jar:3.2.5.RELEASE]
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342) ~[spring-security-web-3.2.5.RELEASE.jar:3.2.5.RELEASE]
    at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:110) ~[spring-security-web-3.2.5.RELEASE.jar:3.2.5.RELEASE]
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342) ~[spring-security-web-3.2.5.RELEASE.jar:3.2.5.RELEASE]
    at org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:57) ~[spring-security-web-3.2.5.RELEASE.jar:3.2.5.RELEASE]
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) ~[spring-web-4.1.4.RELEASE.jar:4.1.4.RELEASE]
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342) ~[spring-security-web-3.2.5.RELEASE.jar:3.2.5.RELEASE]
    at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:87) ~[spring-security-web-3.2.5.RELEASE.jar:3.2.5.RELEASE]
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342) ~[spring-security-web-3.2.5.RELEASE.jar:3.2.5.RELEASE]
    at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:50) ~[spring-security-web-3.2.5.RELEASE.jar:3.2.5.RELEASE]
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) ~[spring-web-4.1.4.RELEASE.jar:4.1.4.RELEASE]
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342) ~[spring-security-web-3.2.5.RELEASE.jar:3.2.5.RELEASE]
    at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:192) ~[spring-security-web-3.2.5.RELEASE.jar:3.2.5.RELEASE]
    at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:160) ~[spring-security-web-3.2.5.RELEASE.jar:3.2.5.RELEASE]
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239) ~[tomcat-embed-core-8.0.15.jar:8.0.15]
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) ~[tomcat-embed-core-8.0.15.jar:8.0.15]
    at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219) ~[tomcat-embed-core-8.0.15.jar:8.0.15]
    at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:106) [tomcat-embed-core-8.0.15.jar:8.0.15]
    at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:501) [tomcat-embed-core-8.0.15.jar:8.0.15]
    at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:142) [tomcat-embed-core-8.0.15.jar:8.0.15]
    at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:79) [tomcat-embed-core-8.0.15.jar:8.0.15]
    at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:88) [tomcat-embed-core-8.0.15.jar:8.0.15]
    at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:537) [tomcat-embed-core-8.0.15.jar:8.0.15]
    at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1085) [tomcat-embed-core-8.0.15.jar:8.0.15]
    at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:658) [tomcat-embed-core-8.0.15.jar:8.0.15]
    at org.apache.coyote.http11.Http11NioProtocol$Http11ConnectionHandler.process(Http11NioProtocol.java:222) [tomcat-embed-core-8.0.15.jar:8.0.15]
    at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1556) [tomcat-embed-core-8.0.15.jar:8.0.15]
    at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.run(NioEndpoint.java:1513) [tomcat-embed-core-8.0.15.jar:8.0.15]
    at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) [na:1.8.0_51]
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) [na:1.8.0_51]
    at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) [tomcat-embed-core-8.0.15.jar:8.0.15]
    at java.lang.Thread.run(Unknown Source) [na:1.8.0_51]
4

1 回答 1

1

注册 OpenSessionInViewFilter 将以下代码放在您的配置类中：

    @Bean
public FilterRegistrationBean registerOpenEntityManagerInViewFilterBean() {
    FilterRegistrationBean registrationBean = new FilterRegistrationBean();
    OpenEntityManagerInViewFilter filter = new OpenEntityManagerInViewFilter();
    registrationBean.setFilter(filter);
    registrationBean.setOrder(5);
    return registrationBean;
}

您必须记住...如果您使用的是 Hibernate，请声明 OpenSessionInViewFilter。但如果您使用 JPA，请声明 OpenEntityManagerInViewFilter。

祝你好运。

于 2016-11-15T13:34:49.990 回答