spring-security - 服务器启动时 Spring Security 配置错误

Question

如果我在 security.xml 文件中保留 Remember-me 元素并启动服务器，则会出现以下错误。

没有注册UserDetailsS​​ervice......

如果我删除这个记住我的元素，那么它就可以正常工作。

如何消除这个错误...

<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security"
    xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns:p="http://www.springframework.org/schema/p"
    xsi:schemaLocation="http://www.springframework.org/schema/beans 
        http://www.springframework.org/schema/beans/spring-beans-3.0.xsd 
    http://www.springframework.org/schema/security 
    http://www.springframework.org/schema/security/spring-security-3.0.xsd">

    <http auto-config="false" use-expressions="true"
        access-denied-page="/login.jsp?error=true" entry-point-ref="authenticationEntryPoint">
        <remember-me key="abcdefgh" />
        <logout invalidate-session="true" />
        <intercept-url pattern="/login.jsp" access="permitAll" />
        <intercept-url pattern="/index.jsp" access="permitAll" />
        <intercept-url pattern="/pub" access="isAuthenticated()" />
        <intercept-url pattern="/*" access="permitAll" />
        <custom-filter ref="authenticationFilter" position="FORM_LOGIN_FILTER" />
    </http>

    <beans:bean id="authenticationFilter"
        class="org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter"
        p:authenticationManager-ref="customAuthenticationManager"
        p:authenticationFailureHandler-ref="customAuthenticationFailureHandler"
        p:authenticationSuccessHandler-ref="customAuthenticationSuccessHandler" />

    <!-- Custom authentication manager. In order to authenticate, username and 
        password must not be the same -->
    <beans:bean id="customAuthenticationManager" class="com.cv.pub.cmgt.framework.security.CustomAuthenticationManager" />

    <!-- We just actually need to set the default failure url here -->
    <beans:bean id="customAuthenticationFailureHandler"
        class="org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler"
        p:defaultFailureUrl="/login.jsp?error=true" />

    <!-- We just actually need to set the default target url here -->
    <beans:bean id="customAuthenticationSuccessHandler"
        class="org.springframework.security.web.authentication.SimpleUrlAuthenticationSuccessHandler"
        p:defaultTargetUrl="/pub" />

    <!-- The AuthenticationEntryPoint is responsible for redirecting the user 
        to a particular page, like a login page, whenever the server sends back a 
        response requiring authentication -->
    <!-- See Spring-Security Reference 5.4.1 for more info -->
    <beans:bean id="authenticationEntryPoint"
        class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint"
        p:loginFormUrl="/login.jsp" />

    <!-- The tag below has no use but Spring Security needs it to autowire the 
        parent property of org.springframework.security.authentication.ProviderManager. 
        Otherwise we get an error A probable bug. This is still under investigation -->
    <authentication-manager />

</beans:beans> 

Answer 1

Spring Security 提供了 RememberMeServices requires a UserDetailsService为了工作。这意味着您有两个选择:

1) 如果可能的话，我建议您将此作为最佳选择。不要编写自定义 AuthenticationProvider，而是编写自定义 UserDetailsS​​ervice。您可以找到一个 UserDetailsS​​ervice 示例，查看 InMemoryDaoImpl然后，您可以按照与下面的配置类似的方式进行连接。请注意，您也将删除自定义的 AuthenticationManager。

<http ..>
  ...
  <remember-me key="abcdefgh" />
</http>
<authentication-manager>
  <authentication-provider user-service-ref="myUserService"/>
</authentication-manager>
<beans:bean id="myUserService" class="MyUserService"/>

2) 编写您自己的 RememberMeServices 实现，不需要 UserDetailsS​​ervice。您可以看一下TokenBasedRememberMeServices举个例子(但它需要 UserDetailsS​​ervice)。如果您想使用命名空间配置，您的 RememberMeServices 实现将需要实现 LogoutHandler。然后您可以使用命名空间来连接它。

<http ..>
  ...
  <remember-me ref="myRememberMeServices"/>
</http>
<beans:bean id="myRememberMeServices" class="sample.MyRememberMeServices"/>