Spring Security的角色层次结构问题(Spring Security Role Hier

我试图用闲聊NTML身份验证时，使角色层次表决权Spring Security的，但具有预期防止hasRole表现在两个拦截的URL和使用授权的JSP标签库继承的角色也不会出现在当局对主要在一些未知的问题。

基于以下指导我一直在整合华夫： https://github.com/dblock/waffle/blob/master/Docs/spring/SpringSecuritySingleSignOnFilter.md

这个工程使用标准的RoleVoter预期对自己的应用程序中，但是当我尝试定制使用RoleHierarchyVoter，我也对自己进行测试（使用LDAP身份验证提供者）和角色层次作用完全相同的问题开始预期。

用于组合华夫和RoleHierarchyVoter方法的配置如下：

华夫Specfic配置

<!-- windows authentication provider -->
<bean id="waffleWindowsAuthProvider" class="waffle.windows.auth.impl.WindowsAuthProviderImpl" />

<!-- collection of security filters -->
<bean id="negotiateSecurityFilterProvider" class="waffle.servlet.spi.NegotiateSecurityFilterProvider">
    <constructor-arg ref="waffleWindowsAuthProvider" />
</bean>

<bean id="basicSecurityFilterProvider" class="waffle.servlet.spi.BasicSecurityFilterProvider">
    <constructor-arg ref="waffleWindowsAuthProvider" />
</bean>

<bean id="waffleSecurityFilterProviderCollection" class="waffle.servlet.spi.SecurityFilterProviderCollection">
    <constructor-arg>
        <list>
            <ref bean="negotiateSecurityFilterProvider" />              
            <ref bean="basicSecurityFilterProvider" />              
        </list>
    </constructor-arg>
</bean>

<bean id="negotiateSecurityFilterEntryPoint" class="waffle.spring.NegotiateSecurityFilterEntryPoint">
    <property name="Provider" ref="waffleSecurityFilterProviderCollection" />
</bean>

<!-- spring security filter -->
<bean id="waffleNegotiateSecurityFilter" class="waffle.spring.NegotiateSecurityFilter">
    <property name="Provider" ref="waffleSecurityFilterProviderCollection" />
    <property name="AllowGuestLogin" value="false" />
    <property name="PrincipalFormat" value="fqn" />
    <property name="RoleFormat" value="fqn" />
    <property name="GrantedAuthorityFactory" ref="simpleGrantedAuthorityFactory" />
    <!-- set the default granted authority to null as we don't need to assign a default role of ROLE_USER -->
    <property name="defaultGrantedAuthority"><null/></property>

</bean>

<!-- custom granted authority factory so the roles created are based on the name rather than the fqn-->
<bean id="simpleGrantedAuthorityFactory" class="xx.yy.zz.SimpleGrantedAuthorityFactory">
    <constructor-arg name="prefix" value="ROLE_"/>
    <constructor-arg name="convertToUpperCase" value="true"/>
</bean>

熟悉Spring Security的配置

<!-- declare the entry point ref as the waffle defined entry point -->
<sec:http use-expressions="true"
          disable-url-rewriting="true"
          access-decision-manager-ref="accessDecisionManager"
          entry-point-ref="negotiateSecurityFilterEntryPoint" >

    <sec:intercept-url pattern="/**" access="isAuthenticated()" requires-channel="any"/>

    .
    . access denied handlers, concurrency control, port mappings etc
    .

    <sec:custom-filter ref="waffleNegotiateSecurityFilter" position="BASIC_AUTH_FILTER" />

</sec:http>

<!-- spring authentication provider -->
<sec:authentication-manager alias="authenticationProvider" />


<bean id="accessDecisionManager" class="org.springframework.security.access.vote.AffirmativeBased">
    <property name="decisionVoters">
        <list>
            <ref bean="roleHierarchyVoter" />
            <bean class="org.springframework.security.web.access.expression.WebExpressionVoter">
                <property name="expressionHandler">
                    <bean class="org.springframework.security.web.access.expression.DefaultWebSecurityExpressionHandler">
                        <property name="roleHierarchy" ref="roleHierarchy"/>
                    </bean>
                </property>
            </bean>
        </list>
    </property>
</bean>

<bean id="roleHierarchy" class="org.springframework.security.access.hierarchicalroles.RoleHierarchyImpl">
    <property name="hierarchy">
        <value>
            ROLE_TEST_1 > ROLE_TEST_2
            ROLE_TEST_2 > ROLE_TEST_3
            ROLE_TEST_3 > ROLE_TEST_4
        </value>
    </property>
</bean>

<bean id="roleHierarchyVoter"
            class="org.springframework.security.access.vote.RoleHierarchyVoter">
    <constructor-arg ref="roleHierarchy"/>
</bean>

设法解决我的问题，这是倒在我的HTTP命名空间配置的不作为，我从调试春季安全源小时内发现。

问题是DefaultWebSecurityExpressionHandler是如何产生的。在它上面已经创造它作为这个AccessDecisionManager的bean定义内侧内豆的剪断：

<bean class="org.springframework.security.web.access.expression.WebExpressionVoter">
    <property name="expressionHandler">
        <bean class="org.springframework.security.web.access.expression.DefaultWebSecurityExpressionHandler">
            <property name="roleHierarchy" ref="roleHierarchy"/>
        </bean>
    </property> 
</bean>

与此作用heirachies被用来确定处理定义为截距的网址，如规则时访问是否应当被准许：

<sec:intercept-url pattern="/**" access="isAuthenticated()" requires-channel="any"/>

但是，如果你想检查使用JSP标签库授权如下（这是freemarker中），它不会工作授权的roleHeirachies没有得到考虑：

<@security.authorize access="hasRole('ROLE_TEST_1)">
    <p>You have role 1</p>
</@security.authorize>

<@security.authorize access="hasRole('ROLE_TEST_4')">
    <p>You have role 4</p>
</@security.authorize>

这是因为DefaultWebSecurityExpressionHandler创建为一个内部bean只访问决策管理器中使用，但用于标签库表达式一个新的默认bean将被创建（不使用RoleHierarchy），除非安全HTTP命名空间表达式处理程序的定义。

因此，要解决问题，我创造了我的豆DefaultWebSecurityExpressionHandler和我WebExpressionVoter bean定义中引用它，也用它作为表达式处理程序如下：

<sec:http ... >

    .
    . access denied handlers, concurrency control, port mappings etc
    .

    <sec:expression-handler ref="defaultWebSecurityExpressionHandler" />

</sec:http>

<bean id="defaultWebSecurityExpressionHandler"
      class="org.springframework.security.web.access.expression.DefaultWebSecurityExpressionHandler">
      <property name="roleHierarchy" ref="roleHierarchy"/>
</bean>

<bean id="accessDecisionManager" class="org.springframework.security.access.vote.AffirmativeBased">
    <property name="decisionVoters">
        <list>
            <ref bean="roleHierarchyVoter" />
            <bean class="org.springframework.security.web.access.expression.WebExpressionVoter">
                <property name="expressionHandler" ref="defaultWebSecurityExpressionHandler"/>
            </bean>
        </list>
    </property>
</bean>

进行这些更改确保roleHeirarchies被考虑用于定义为通过HTTP命名空间拦截的URL都Web安全表达式，并使用JSP标签库授权表情。