java - spring 安全配置 xml 到 java

Question

有人可以帮助我从基于 xml 的 spring 配置迁移到基于 java 的配置吗？

这是我的 xml 配置:

<!--suppress SpringFacetInspection, SpringSecurityFiltersConfiguredInspection -->
<beans:beans xmlns="http://www.springframework.org/schema/security"
             xmlns:beans="http://www.springframework.org/schema/beans"
             xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
             xmlns:context="http://www.springframework.org/schema/context"
             xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-4.0.xsd
                                 http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.2.xsd http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd">


    <global-method-security pre-post-annotations="enabled"/>
    <context:annotation-config/>
    <context:spring-configured/>


    <beans:bean name="userLoginService" class="service.UserLoginService"/>

    <beans:bean name="standardPasswordEncoder"
                class="org.springframework.security.crypto.password.StandardPasswordEncoder">
        <beans:constructor-arg name="secret" value="supersecret"/>
    </beans:bean>

    <http auto-config="true" use-expressions="true">
        <intercept-url pattern="/javax.faces.resources/**" access="permitAll"/>
        <intercept-url pattern="/view/unsecured/**" access="permitAll"/>
        <intercept-url pattern="/view/secured/**" access="isAuthenticated()" />
        <intercept-url pattern="/view/admin/**" access="hasRole('ROLE_SUPERUSER')"/>
        <intercept-url pattern="/admin/**" access="hasRole('ROLE_SUPERUSER')"/>

        <form-login login-page="/view/unsecured/login.xhtml"/>
        <logout logout-success-url="/index.xhtml" invalidate-session="true" delete-cookies="true"/>
    </http>

    <authentication-manager alias="authenticationManager">
        <authentication-provider user-service-ref="userLoginService">
            <password-encoder ref="standardPasswordEncoder"/>
        </authentication-provider>
    </authentication-manager>

</beans:beans>

这是我的 Java 尝试:

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Bean(name = "standardPasswordEncoder")
    public PasswordEncoder standardPasswordEncoder() {
        return new StandardPasswordEncoder("supersecret");
    }

    @Bean(name = "userDetailService")
    @Override
    public UserDetailsService userDetailsServiceBean() {
        return new UserLoginService();
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
                //.userDetailsService(userDetailsService())
                .authorizeRequests()
                .antMatchers("/view/secured/**").fullyAuthenticated()
                .antMatchers("/admin/**", "/view/admin/**").access("hasRole('ROLE_SUPERUSER')")
                .antMatchers("/index.xhtml", "/view/unsecured/**", "/javax.faces.resources/**").permitAll()
                .and()
                .formLogin().loginPage("/view/unsecured/login.xhtml")
                .usernameParameter("email").passwordParameter("password")
                .and()
                .logout().logoutSuccessUrl("/index.xhtml").invalidateHttpSession(true).deleteCookies("JSESSIONID")
                .and()
                .exceptionHandling().accessDeniedPage("/error.xhtml")
                .and()
                .csrf().disable();
    }

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userDetailsService()).passwordEncoder(standardPasswordEncoder());
    }
}

当我尝试登录时出现异常

Caused by: java.lang.StackOverflowError: null
        at org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter$UserDetailsServiceDelegator.loadUserByUsername(WebSecurityConfigurerAdapter.java:386)
        at org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter$UserDetailsServiceDelegator.loadUserByUsername(WebSecurityConfigurerAdapter.java:387)
...

我错过了什么，或者出了什么问题？ 谢谢

Answer 1

覆盖 userDetailsS​​ervice() 方法，而不是 userDetailsS​​erviceBean() 方法。这就是导致无限递归的原因。然后不需要将其声明为 @Bean。

应该只是:

@Override
public UserDetailsService userDetailsService() {
    return new UserLoginService();
}

---

或者 - 如果您在 UserLoginService 上有一个 @Service 注释(以及一个将获取该类的组件扫描)，您可以避免手动创建 bean并将您的 UserLoginService 直接注入(inject)您的配置方法:

@Autowired
public void configureGlobal(AuthenticationManagerBuilder auth, UserLoginService userDetailsService) throws Exception {
    auth.userDetailsService(userDetailsService).passwordEncoder(standardPasswordEncoder());
}

那么您就不需要覆盖 userDetailsS​​erviceBean 或 userDetailsS​​ervice:因为它们所做的只是创建该 bean 的一个实例。