Spring mvc和基于安全角色的限制问题
我正在使用spring-mvc 3.1.1.RELEASE和Spring-Security构建一个应用程序,我希望每个人都必须登录才能访问它,同时我想限制访问通过角色的一些用户,我编辑了弹簧的security.xml这样:Spring mvc和基于安全角色的限制问题
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:context="http://www.springframework.org/schema/context"
xmlns:sec="http://www.springframework.org/schema/security"
xsi:schemaLocation="http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
http://www.springframework.org/schema/security
http://www.springframework.org/schema/security/spring-security-3.1.xsd
http://www.springframework.org/schema/context
http://www.springframework.org/schema/context/spring-context-3.1.xsd">
<bean id="userDetailsService" class="it.dedagroup.cartesio.security.auth.UserDetailServiceImpl">
<property name="accountService" ref="accountService"></property>
</bean>
<sec:http auto-config="true" use-expressions="true" create-session="always">
<sec:http-basic />
<sec:intercept-url pattern="/login" access="permitAll"/>
<sec:intercept-url pattern="/failedLogin" access="permitAll"/>
<sec:intercept-url pattern="/resources/**" access="permitAll"/>
<sec:intercept-url pattern="/error" access="permitAll"/>
<sec:intercept-url pattern="/accessDenied*" access="isAuthenticated()" />
<sec:intercept-url pattern="/home*" access="isAuthenticated()" />
<sec:intercept-url pattern="/utentiRicerca*" access="hasRole('ROLE_ADMIN')" />
<sec:intercept-url pattern="/userEdit*" access="hasRole('ROLE_ADMIN')" />
<sec:intercept-url pattern="/creaUser*" access="hasRole('ROLE_ADMIN')" />
<sec:intercept-url pattern="/detailsUtente*" access="isAuthenticated()" />
<sec:intercept-url pattern="/modificaAccount*" access="isAuthenticated()" />
<sec:intercept-url pattern="/serverRicerca*" access="hasRole('ROLE_ADMIN')" />
<sec:intercept-url pattern="/editServer*" access="hasRole('ROLE_ADMIN')" />
<sec:intercept-url pattern="/prepareListaSearch*" access="hasRole('ROLE_ADMIN')" />
<sec:intercept-url pattern="/prepareListaEdit*" access="hasRole('ROLE_ADMIN')" />
<sec:intercept-url pattern="/groupInitSearch*" access="hasRole('ROLE_ADMIN')" />
<sec:intercept-url pattern="/groupEdit*" access="hasRole('ROLE_ADMIN')" />
<sec:intercept-url pattern="/listaUpdate*" access="hasRole('ROLE_ADMIN')" />
<sec:intercept-url pattern="/upload*" access="isAuthenticated()" />
<sec:intercept-url pattern="/emailRicerca*" access="hasRole('ROLE_ADMIN')" />
<sec:intercept-url pattern="/prepareEditCasella*" access="hasRole('ROLE_ADMIN')" />
<sec:intercept-url pattern="/acl*" access="hasRole('ROLE_ADMIN')" />
<sec:intercept-url pattern="/initDaemons*" access="hasAnyRole('ROLE_ADMIN','ROLE_SYSTEM')" />
<sec:intercept-url pattern="/mailbox*" access="hasAnyRole('ROLE_OPER','ROLE_USER')" />
<sec:intercept-url pattern="/emailBody*" access="hasAnyRole('ROLE_OPER','ROLE_USER')" />
<sec:intercept-url pattern="/pecBody*" access="hasAnyRole('ROLE_OPER','ROLE_USER')" />
<sec:intercept-url pattern="/composeEmail*" access="hasRole('ROLE_OPER')" />
<sec:form-login login-page="/login"
always-use-default-target="true"
default-target-url="/home"
authentication-failure-url="/failedLogin" />
<sec:logout invalidate-session="true" logout-success-url="/logout" delete-cookies="true" />
<sec:session-management invalid-session-url="/login" session-authentication-error-url="/failedLogin?sessionExpiredDuplicateLogin=true" >
<sec:concurrency-control max-sessions="1" expired-url="/failedLogin" error-if-maximum-exceeded="false" />
</sec:session-management>
</sec:http>
<sec:authentication-manager>
<sec:authentication-provider user-service-ref="userDetailsService">
<sec:password-encoder ref="stdEncoder"></sec:password-encoder>
</sec:authentication-provider>
</sec:authentication-manager>
,但如果我删除根URL的seurity映射,它返回了我未找到页面错误,如果我以这种方式评价安全性:
<sec:intercept-url pattern="/**" access="isAuthenticated()" />
它在登录后包装了我所有的请求,并忽略了我直接在浏览器栏上写入时为子网址指定的规则。
例如,我需要只有“ROLE_ADMIN”才能访问URL“/ utentiRicerca”处的用户搜索,但是如果我使用“ROLE_USER”登录并在浏览器URL“http://myhost.it:8080/myApp/utentiRicerca”上写入,它不会给我“ http 403“,因为我配得上这个角色。那么我能为它做些什么?
/**模式将匹配任何网址,因此总能访问所有链接。如果先放置,则其他链接甚至不会被检查,如果放到最后,则会检查其他模式,但即使它们失败,如果选中此项,用户仍然会传递安全性。
如果要限制某些网址,你可以尝试改变你的URL结构,例如有一个固定的角色进入下一个“安全”的网址
例如,你可以使用像链接的任何网址以 “安全” 为前缀如下: :
secured/prepareListaEdit
,并让他们安全使用模式是这样的:
<sec:intercept-url pattern="secured/prepareListaEdit/* access="hasRole('ROLE_ADMIN')" />
和ñ增加,而不是/ **使用/ *访问您的根路径上的其他链接的模式
<security:intercept-url pattern="/*" access="isAuthenticated()" />
(因为使用/ **会匹配所有的子路径包括“担保”)
thanx为你回复我设置拦截器在最后,它现在的作品。 – theMan80 2014-11-26 13:44:42
确保'/ **'的mappnig是你链中的最后一个。他们按照指定的顺序查询,所以如果'/ **'是第一个余数未被使用。第一个匹配模式被使用。 – 2014-11-14 12:36:14