java - Spring Boot 中基于方法的授权

Question

我必须将方法发布为休息服务。 我想在一种方法上应用基本的授权安全性，以免说“gpnfeedback”。 我不想通过 sendgpn 申请任何授权 如何配置SecurityConfig.java？我已使用以下配置，但在调用 http://localhost:7071/gpns/rest/sendgpn 时仍然出现授权错误

Controller

@Controller
@RequestMapping("/gpns/rest/")
public class GpnsRestController {

   @CrossOrigin
   @RequestMapping(value = "/sendgpn", method = RequestMethod.POST, produces = MediaType.APPLICATION_JSON_VALUE, consumes = { MediaType.MULTIPART_FORM_DATA_VALUE, MediaType.APPLICATION_JSON_VALUE })
   public @ResponseBody
   GpnsResponse sendgpn(@Valid @RequestPart(value = "data", required = true) SendGpnMessageMsisdnListReq sendGpnMessageMsisdnListReq, @Valid @ModelAttribute(value = "photo") MultipartFile photo, @Valid @ModelAttribute(value = "video") MultipartFile video,
         @Valid @ModelAttribute(value = "videothumbnail") MultipartFile videothumbnail) {

   }

   @RequestMapping(method = RequestMethod.POST, value = "/gpnfeedback", consumes = MediaType.APPLICATION_JSON_VALUE, produces = MediaType.APPLICATION_JSON_VALUE)
   public @ResponseBody
   GpnsResponse gpnfeedback(HttpServletRequest http, @Valid @RequestBody GpnFeedbackReq gpnFeedbackReq) {
   }


}

安全性

@Configuration
@EnableWebSecurity(debug = true)
@EnableGlobalMethodSecurity(securedEnabled = true)
public class SecurityConfig extends WebSecurityConfigurerAdapter {


  public static final String ROLE_CLIENT = "CLIENT_USER";

  @Autowired
  private DatabaseAuthenticationProvider databaseAuthenticationProvider;

  @Autowired
  private GpnBasicAuthenticationEntryPoint basicAuthenticationEntryPoint;

   @Override
   public void configure(WebSecurity web) throws Exception {
   web.ignoring().antMatchers("/soap/lb/**");
   }

  @Override
  protected void configure(HttpSecurity http) throws Exception {

    http.csrf().disable();
    http.httpBasic().authenticationEntryPoint(this.basicAuthenticationEntryPoint);
    http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);


    // @formatter:off
    http.authorizeRequests()
      .antMatchers("/gpns/rest/gpnfeedback/**").hasRole(ROLE_CLIENT)           
      .anyRequest().authenticated().and().httpBasic();

    // @formatter:on
  }

  @Override
  protected void configure(AuthenticationManagerBuilder builder) throws Exception {

    //will be invoked in given order

    builder.authenticationProvider(this.databaseAuthenticationProvider);

  }

}

更新1: 我已经更改了以下规则。虽然我可以发送http://localhost:7071/gpns/rest/sendgpn 未经任何授权的方法，http://localhost:7071/gpns/rest/gpnfeedback不被 databaseAuthenticationProvider 处理

http.authorizeRequests()
      .antMatchers("/gpns/rest/gpnfeedback/**").hasRole(ROLE_CLIENT)  
      .antMatchers("/gpns/rest/sendgpn/**").permitAll()          
      .anyRequest().authenticated().and().httpBasic();

Answer 1

我认为您的问题与配置中的这一行有关:

.anyRequest().authenticated().and().httpBasic();

基本上，您在这里所说的是每个请求(除了被忽略的请求)都必须经过身份验证，但您不关心它具有什么角色。尝试使用这个:

.anyRequest().permitAll().and().httpBasic()

或者，如果您只想允许 sendgpn，您可以使用以下命令:

http.authorizeRequests()
      .antMatchers("/gpns/rest/gpnfeedback/**").hasRole(ROLE_CLIENT)  
      .antMatchers("/gpns/rest/sendgpn/**").permitAll()          
      .anyRequest().authenticated().and().httpBasic();

编辑 至于您的更新，我的猜测是您以某种方式错误配置了所提供的内容，或者数据库中的数据不正确。例如，如果 ROLE_CLIENT 的值为“CLIENT”，那么 Spring 会期望 DB 中的值为“ROLE_CLIENT”——它将“ROLE_”前缀添加到角色中。