java - 如何使用全局方法安全性的分层决策投票器

Question

下面是我的 spring security XML 配置完整代码。

<beans xmlns="http://www.springframework.org/schema/beans"
           xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
           xmlns:oauth="http://www.springframework.org/schema/security/oauth2"
           xmlns:sec="http://www.springframework.org/schema/security"
           xsi:schemaLocation="http://www.springframework.org/schema/beans
           http://www.springframework.org/schema/beans/spring-beans-4.2.xsd
           http://www.springframework.org/schema/security
           http://www.springframework.org/schema/security/spring-security-3.2.xsd
           http://www.springframework.org/schema/security/oauth2
           http://www.springframework.org/schema/security/spring-security-oauth2-1.0.xsd">

    <!-- Definition of the Authentication Service
     For Authenticating a User the Client application will send request to the URL "/oauth/token". This request will contain the clientId, client password, userName and user password details
     -->
    <http pattern="/oauth/token" create-session="stateless"  authentication-manager-ref="clientAuthenticationManager"
          xmlns="http://www.springframework.org/schema/security" >
        <intercept-url pattern="/oauth/token" access="IS_AUTHENTICATED_FULLY"/>
        <anonymous enabled="false"/>
        <http-basic entry-point-ref="clientAuthenticationEntryPoint"/>
        <!-- include this only if you need to authenticate clients via request parameters -->
        <custom-filter ref="clientCredentialsTokenEndpointFilter" after="BASIC_AUTH_FILTER"/> <!-- http/http-basic -->
        <access-denied-handler ref="oauthAccessDeniedHandler"/>
    </http>

    <http pattern="/**"  entry-point-ref="oauthAuthenticationEntryPoint"
          xmlns="http://www.springframework.org/schema/security" use-expressions="true" auto-config="true">
        <anonymous enabled="false"/>
        <custom-filter ref="specializedResourceServerFilter"
                       before="PRE_AUTH_FILTER" />
        <access-denied-handler ref="oauthAccessDeniedHandler"/>
    </http>

    <bean id="oauthAuthenticationEntryPoint"
          class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint"/>

    <bean id="clientAuthenticationEntryPoint"
          class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint">
        <property name="realmName" value="client"/>
        <property name="typeName" value="Basic"/>
    </bean>

    <bean id="oauthAccessDeniedHandler"
          class="org.springframework.security.oauth2.provider.error.OAuth2AccessDeniedHandler"/>
    <bean id="clientCredentialsTokenEndpointFilter"
          class="org.springframework.security.oauth2.provider.client.ClientCredentialsTokenEndpointFilter">
        <property name="authenticationManager" ref="clientAuthenticationManager"/>
    </bean>


    <bean id="oAuth2authenticationManager" class="org.springframework.security.oauth2.provider.authentication.OAuth2AuthenticationManager">
        <property name="tokenServices" ref="tokenServices"/>
        <property name="resourceId" value="myId"/>
    </bean>
    <bean id="specializedResourceServerFilter" class="com.my.backend.authentication.oauth2.OAuth2AuthenticationProcessingCustomFilter">
        <property name="authenticationManager" ref="oAuth2authenticationManager"/>
    </bean>

    <bean id="customAuthenticationManager"
          class="com.my.backend.read.rest.authentication.MyDBAuthenticationProvider"/>

    <bean id="myJDBCAuthenticationProvider"
          class="com.my.backend.authentication.MyJDBCAuthenticationProvider"/>

    <!-- Authentication in config file -->
    <authentication-manager id="clientAuthenticationManager" xmlns="http://www.springframework.org/schema/security">
        <authentication-provider user-service-ref="clientDetailsUserService"/>
    </authentication-manager>
    <!-- authentication Manager called auto and their provider is called -->
    <authentication-manager alias="authenticationManager" xmlns="http://www.springframework.org/schema/security">
        <authentication-provider ref="customAuthenticationManager"/>
        <authentication-provider ref="myJDBCAuthenticationProvider"/>
    </authentication-manager>

    <bean id="clientDetailsUserService"
          class="org.springframework.security.oauth2.provider.client.ClientDetailsUserDetailsService">
        <constructor-arg ref="clientDetails"/>
    </bean>

    <!-- Token Store  -->
    <bean id="tokenStore" class="org.springframework.security.oauth2.provider.token.store.JdbcTokenStore">
        <constructor-arg ref="jdbcDataSource" />
    </bean>

    <bean id="jdbcDataSource"
          class="org.springframework.jdbc.datasource.DriverManagerDataSource">
        <property name="driverClassName" value="com.mysql.jdbc.Driver"/>
        <property name="url" value="#{systemProperties['JDBC_CONNECTION_STRING']}/#{systemProperties['DATABASE']}?autoReconnect=true"/>
        <property name="username" value="#{systemProperties['USER_NAME']}"/>
        <property name="password" value="#{systemProperties['PASSWORD']}"/>
    </bean>


    <bean id="tokenServices" class="com.my.backend.authentication.oauth2.CustomTokenServices">
        <property name="tokenStore" ref="tokenStore"/>
        <property name="supportRefreshToken" value="true"/>
        <property name="clientDetailsService" ref="clientDetails"/>
        <!-- VIV -->
        <property name="accessTokenValiditySeconds" value="7776000"/>
    </bean>

    <bean id="userApprovalHandler"
          class="org.springframework.security.oauth2.provider.approval.TokenStoreUserApprovalHandler">
        <property name="tokenStore" ref="tokenStore"/>
        <property name="requestFactory" ref="oAuth2RequestFactory"/>
    </bean>

    <bean id="oAuth2RequestFactory"
          class="org.springframework.security.oauth2.provider.request.DefaultOAuth2RequestFactory">
        <constructor-arg ref="clientDetails"/>
    </bean>
    <!-- Token management -->
    <oauth:authorization-server   client-details-service-ref="clientDetails"  token-services-ref="tokenServices"
                                  user-approval-handler-ref="userApprovalHandler">
        <oauth:implicit/>
        <oauth:refresh-token/>
        <oauth:client-credentials/>
        <oauth:password/>
    </oauth:authorization-server>

    <oauth:resource-server  id="resourceServerFilter"
                            token-services-ref="tokenServices"/>


    <!-- Client Definition -->
    <bean id="clientDetails"
          class="com.my.backend.authentication.oauth2.JdbcClientDetailsService" >
        <constructor-arg name="dataSource" ref="jdbcDataSource" />
    </bean>

    <sec:global-method-security pre-post-annotations="enabled" proxy-target-class="true">
        <sec:expression-handler ref="oauthExpressionHandler"/>
    </sec:global-method-security>
    <oauth:expression-handler id="oauthExpressionHandler"/>
    <oauth:web-expression-handler id="oauthWebExpressionHandler"/>

</beans>

当我点击这些访问决策投票者参与的受限制 URL 以获得肯定性访问决策管理器的授权时:

0 = {PreInvocationAuthorizationAdviceVoter@11611} 
1 = {RoleVoter@11635} 
2 = {AuthenticatedVoter@11639} 

虽然我没有在上面的 XML 配置中设置任何访问决策管理器，但我认为默认情况下会调用它，但我不知道如何调用。无论如何，我想添加分层访问决策投票者，所以我创建了自己的访问决策管理器，并在其中引用分层结构，并在 http 元素中引用它，如下所示:

 <http pattern="/**" access-decision-manager-ref="*myAccessDecisionManager*" entry-point-ref="oauthAuthenticationEntryPoint"
      xmlns="http://www.springframework.org/schema/security" use-expressions="true" auto-config="true">
    <anonymous enabled="false"/>
    <custom-filter ref="specializedResourceServerFilter"
                   before="PRE_AUTH_FILTER" />
    <access-denied-handler ref="oauthAccessDeniedHandler"/>
</http>

它确实调用了，但在那之后那三个默认访问决策投票者也调用了我不知道如何覆盖它。请帮忙...

编辑:

正如弄清楚如何设置下面提到的访问决策投票者一样，现在我陷入了 HirarichalRoleVoter 我在下面提到过，我希望允许客户在具有公共(public)角色时访问方法 @PreAuthorize("harRole('ROLE_PUBLIC') ”。 但无法访问。

 <bean id="accessDecisionManager" class="org.springframework.security.access.vote.AffirmativeBased"
          xmlns="http://www.springframework.org/schema/beans">
        <constructor-arg>
            <list>
                <ref bean="roleVoter" />
                <bean class="org.springframework.security.access.vote.AuthenticatedVoter"/>
            </list>
        </constructor-arg>
    </bean>
    <bean id="roleVoter" class="org.springframework.security.access.vote.RoleHierarchyVoter">
        <constructor-arg ref="roleHierarchy" />
    </bean>
    <bean id="roleHierarchy"
          class="org.springframework.security.access.hierarchicalroles.RoleHierarchyImpl">
        <property name="hierarchy">
            <value>
                ROLE_CUSTOMER > ROLE_PUBLIC
            </value>
        </property>
    </bean>
    <sec:global-method-security pre-post-annotations="enabled" access-decision-manager-ref="accessDecisionManager"  >
        <sec:expression-handler ref="methodSecurityExpressionHandler"/>
    </sec:global-method-security>


    <bean id = "methodSecurityExpressionHandler"
                class = "org.springframework.security.access.expression.method.DefaultMethodSecurityExpressionHandler">
        <property name = "roleHierarchy"  ref="roleHierarchy"/>
    </bean>

Answer 1

myAccessDecisionManager 未显示，但我假设它扩展了 org.springframework.security.access.vote.AffirmativeBased 或其父级 AbstractAccessDecisionManager 。如果是这样，那么您可以尝试使用 decisionVoters 属性，如下所示:

<bean id="accessDecisionManager" class="org.springframework.security.access.vote.AffirmativeBased">
    <property name="decisionVoters">
        <list>
            <bean class="org.springframework.security.access.vote.RoleVoter"/>
            <bean class="org.springframework.security.access.vote.AuthenticatedVoter"/>
        </list>
    </property>
</bean>

指定您喜欢的任何选民。

另一种选择是走捷径并避免使用投票者:只需在决策管理器实现中硬编码您的决策逻辑即可。