我正在使用 spring boot 来创建 RESTful Web 服务。为了安全起见,我通过扩展 AbstractUserDetailsAuthenticationProvider 来使用 BasicAuthenticationFilter 和自定义 AuthenticationProvider。我在控制器类中使用带有@Secured 注释的方法级安全性。一切都很好,除了我想让弹簧执行器也能正常工作。
执行器的问题是我在尝试对请求进行身份验证时遇到休眠异常,因为没有打开会话。所以当我去http://localhost:8081/info我得到一个休眠异常。
似乎执行器正在使用与应用程序其余部分不同的过滤器链。如果是这样的话,我相信这是有充分理由的。但是,我不知道如何注册我的 OpenSessionInViewFilter 以便它成为每个过滤器链中的第一个过滤器。我的 OpenSessionInViewFilter 是通过我的 @Configuration 类之一中的 FilterRegistrationBean 注册的。
Spring boot 很棒,但在幕后有很多神奇之处,我还没有弄清楚如何深入研究他们的代码,看看它从哪里开始并遵循它。
这是我的一些配置。我试图包括我认为重要的内容。如果您想看另一件作品,请告诉我。
任何帮助表示赞赏。
@EnableWebSecurity
@Configuration
public class WebSecurityConfig extends WebSecurityConfigurerAdapter
{
@Override
protected void configure(HttpSecurity http) throws Exception
{
http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
http.authorizeRequests().anyRequest().fullyAuthenticated()
.and().httpBasic().authenticationDetailsSource(new WebAuthenticationDetailsSource()
{
@Override
public WebAuthenticationDetails buildDetails(HttpServletRequest context)
{
return new ThirdPartyAuthenticationDetails(context);
}
})
.and().csrf().disable();
}
}
@Configuration
public class WebSecurityConfiguration extends GlobalAuthenticationConfigurerAdapter
{
@Autowired
private DataSource dataSource;
@Autowired
@Qualifier("thirdPartySystemDAO")
private EntityDAO<ThirdPartySystem> thirdPartySystemDAO;
@Override
public void init(AuthenticationManagerBuilder auth) throws Exception
{
auth.authenticationProvider(authenticationProvider());
}
@Bean
public AuthenticationProvider authenticationProvider()
{
ThirdPartyAuthenticationProvider result = new ThirdPartyAuthenticationProvider();
result.setSecurityService(thirdPartySecurityService());
return result;
}
@Bean
public ThirdPartySecurityService thirdPartySecurityService()
{
ThirdPartySecurityServiceImpl result = new ThirdPartySecurityServiceImpl();
result.setJdbcTemplate(new JdbcTemplate(dataSource));
result.setThirdPartySystemDAO(thirdPartySystemDAO);
return result;
}
}
这是尝试访问执行器的 /info 端点时的堆栈跟踪。
org.hibernate.HibernateException: Could not obtain transaction-synchronized Session for current thread
at org.springframework.orm.hibernate4.SpringSessionContext.currentSession(SpringSessionContext.java:134) ~[spring-orm-4.1.4.RELEASE.jar:4.1.4.RELEASE]
at org.hibernate.internal.SessionFactoryImpl.getCurrentSession(SessionFactoryImpl.java:988) ~[hibernate-core-4.2.2.Final.jar:4.2.2.Final]
at com.redi.dao.hibernate.HibernateDAO.getCurrentSession(HibernateDAO.java:495) ~[redi-dao-4.3.0.jar:4.3.0]
at com.redi.dao.hibernate.HibernateDAO.createQuery(HibernateDAO.java:460) ~[redi-dao-4.3.0.jar:4.3.0]
at com.redi.dao.hibernate.HibernateDAO.findOneWhere(HibernateDAO.java:58) ~[redi-dao-4.3.0.jar:4.3.0]
at com.mycompany.DefaultVerifiService.getInstitution(DefaultVerifiService.java:349) ~[classes/:na]
at com.mycompany.thirdparty.ws.security.ThirdPartyAuthenticationProvider.retrieveUser(ThirdPartyAuthenticationProvider.java:36) ~[classes/:na]
at org.springframework.security.authentication.dao.AbstractUserDetailsAuthenticationProvider.authenticate(AbstractUserDetailsAuthenticationProvider.java:143) ~[spring-security-core-4.0.3.RELEASE.jar:4.0.3.RELEASE]
at org.springframework.security.authentication.ProviderManager.authenticate(ProviderManager.java:167) ~[spring-security-core-4.0.3.RELEASE.jar:4.0.3.RELEASE]
at org.springframework.security.authentication.ProviderManager.authenticate(ProviderManager.java:192) ~[spring-security-core-4.0.3.RELEASE.jar:4.0.3.RELEASE]
at org.springframework.security.web.authentication.www.BasicAuthenticationFilter.doFilter(BasicAuthenticationFilter.java:168) ~[spring-security-web-3.2.5.RELEASE.jar:3.2.5.RELEASE]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342) ~[spring-security-web-3.2.5.RELEASE.jar:3.2.5.RELEASE]
at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:110) ~[spring-security-web-3.2.5.RELEASE.jar:3.2.5.RELEASE]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342) ~[spring-security-web-3.2.5.RELEASE.jar:3.2.5.RELEASE]
at org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:57) ~[spring-security-web-3.2.5.RELEASE.jar:3.2.5.RELEASE]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) ~[spring-web-4.1.4.RELEASE.jar:4.1.4.RELEASE]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342) ~[spring-security-web-3.2.5.RELEASE.jar:3.2.5.RELEASE]
at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:87) ~[spring-security-web-3.2.5.RELEASE.jar:3.2.5.RELEASE]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342) ~[spring-security-web-3.2.5.RELEASE.jar:3.2.5.RELEASE]
at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:50) ~[spring-security-web-3.2.5.RELEASE.jar:3.2.5.RELEASE]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) ~[spring-web-4.1.4.RELEASE.jar:4.1.4.RELEASE]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342) ~[spring-security-web-3.2.5.RELEASE.jar:3.2.5.RELEASE]
at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:192) ~[spring-security-web-3.2.5.RELEASE.jar:3.2.5.RELEASE]
at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:160) ~[spring-security-web-3.2.5.RELEASE.jar:3.2.5.RELEASE]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239) ~[tomcat-embed-core-8.0.15.jar:8.0.15]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) ~[tomcat-embed-core-8.0.15.jar:8.0.15]
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219) ~[tomcat-embed-core-8.0.15.jar:8.0.15]
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:106) [tomcat-embed-core-8.0.15.jar:8.0.15]
at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:501) [tomcat-embed-core-8.0.15.jar:8.0.15]
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:142) [tomcat-embed-core-8.0.15.jar:8.0.15]
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:79) [tomcat-embed-core-8.0.15.jar:8.0.15]
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:88) [tomcat-embed-core-8.0.15.jar:8.0.15]
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:537) [tomcat-embed-core-8.0.15.jar:8.0.15]
at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1085) [tomcat-embed-core-8.0.15.jar:8.0.15]
at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:658) [tomcat-embed-core-8.0.15.jar:8.0.15]
at org.apache.coyote.http11.Http11NioProtocol$Http11ConnectionHandler.process(Http11NioProtocol.java:222) [tomcat-embed-core-8.0.15.jar:8.0.15]
at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1556) [tomcat-embed-core-8.0.15.jar:8.0.15]
at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.run(NioEndpoint.java:1513) [tomcat-embed-core-8.0.15.jar:8.0.15]
at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) [na:1.8.0_51]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) [na:1.8.0_51]
at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) [tomcat-embed-core-8.0.15.jar:8.0.15]
at java.lang.Thread.run(Unknown Source) [na:1.8.0_51]