Bahar güvenlik desteklenmeyen konfigürasyon niteliklerini

Question

Ben sunucuda bu çalıştırdığınızda

<http use-expressions="true" auto-config="false" 
     entry-point-ref="loginUrlAuthenticationEntryPoint" 
     access-decision-manager-ref="accessDecisionManager" disable-url-rewriting="false"> 
     <!--<custom-filter position="CONCURRENT_SESSION_FILTER" ref="concurrencyFilter" 
      /> --> 
     <custom-filter position="FORM_LOGIN_FILTER" 
      ref="usernamePasswordAuthenticationFilter" /> 
     <custom-filter position="LOGOUT_FILTER" ref="tapLockFilter" /> 

     <intercept-url pattern="/session/**" access="permitAll" /> 
     <intercept-url pattern="/deviceregistration/**" access="permitAll" /> 
     <intercept-url pattern="/session/lock" access="hasRole('ROLE_MEMBER')" /> 
     <intercept-url pattern="/app/resources/admin*" access="hasRole('ROLE_ADMIN')" /> 
     <intercept-url pattern="/app/SuperAppdashboard*" access="hasRole('ROLE_ADMIN')" /> 
     <intercept-url pattern="/app/*" access="hasRole('ROLE_MEMBER')" /> 


     <!--<session-management invalid-session-url="/tizelytics/session/invalidSession" 
      session-authentication-error-url="/tizelytics/session/accessDenied" session-authentication-strategy-ref="sas"> 
      </session-management> --> 

     <session-management invalid-session-url="/session/invalidSession" 
      session-authentication-error-url="/session/accessDenied" 
      session-fixation-protection="none"> 
      <concurrency-control max-sessions="1" 
       expired-url="/session/accessExpired" /> 
     </session-management> 
</http> 

o

Desteksiz konfigürasyon niteliklerini belirten bir istisna atar aşağıdaki parçada vardır: [permitAll, permitAll, hasRole ('ROLE_ADMIN '), hasRole (' ROLE_ADMIN '), hasRole (' 'hasRole()' ROLE_MEMBER ')] burada

zaman erişim-karar yöneticisi fasulyesi wit ROLE_MEMBER olan i app atılır erişim-Karar yöneticisi-ref istisna herkes tavsiye lütfen yapabilirsiniz doğru başlattı kaldırırsanız aynı xml

<beans:bean id="accessDecisionManager" 
     class="org.springframework.security.access.vote.AffirmativeBased"> 
     <beans:constructor-arg> 
      <beans:list> 
       <beans:bean 
        class="org.springframework.security.access.vote.AuthenticatedVoter" /> 
       <beans:bean class="org.springframework.security.access.vote.RoleVoter" /> 
      </beans:list> 
     </beans:constructor-arg> 
</beans:bean> 

hin?

Answer 1

Kendi accessDecisionManager'nu tanımladığınız için, listesindeki fasulyelerden biri olarak WebExpressionVoter göremiyorum. WebExpressionVoter vb permitAll(), hasRole(), hasAuthority() gibi dizeleri giderir Yani, accessDecisionManager fasulye olmalıdır:

<beans:bean id="accessDecisionManager" 
     class="org.springframework.security.access.vote.AffirmativeBased"> 
     <beans:constructor-arg> 
      <beans:list> 
       <beans:bean 
        class="org.springframework.security.access.vote.AuthenticatedVoter" /> 
       <beans:bean class="org.springframework.security.access.vote.RoleVoter" /> 
       <beans:bean class="org.springframework.security.web.access.expression.WebExpressionVoter" /> 
      </beans:list> 
     </beans:constructor-arg> 
</beans:bean>