1

アノテーションを介して Spring Security を使用して、RESTful Web サービスの 1 つのメソッド呼び出しを保護しようとしています。メソッドに @Secured アノテーションを配置すると、ログインフォームがリダイレクトされなくなり、代わりにすぐに 403 応答が返されるという奇妙な動作に直面しました。

構成の下に配置しています。何が問題なのか説明してもらえますか?

<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security"
         xmlns:beans="http://www.springframework.org/schema/beans"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://www.springframework.org/schema/beans
       http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
       http://www.springframework.org/schema/security
       http://www.springframework.org/schema/security/spring-security-3.1.xsd">

<global-method-security secured-annotations="enabled" />

<http auto-config="true">
    <http-basic/>
    <form-login/>

    <!-- With the following line login form is shown -->
    <!--<intercept-url pattern="/rest/secured/" access="ROLE_USER"/>-->

</http>

<authentication-manager alias="myAuthenticationManager">
    <authentication-provider>
        <user-service>
            <user name="user" password="user" authorities="ROLE_USER"/>
        </user-service>
    </authentication-provider>
</authentication-manager>

</beans:beans>

これは私のサービスインターフェースです:

@Produces({"application/xml"})
public interface KinoteatrService
{
    @GET
    @Path("/secured")
    @Secured("ROLE_USER")
    String testSecuredMethod();
}

そして、これは実装です：

@Path("/")
public class KinoteatrServiceImpl implements KinoteatrService
{
    @Override
    public String testSecuredMethod() {
        return "<html><body>Success, timestamp: " + new Date() + "</body></html>";
    }
}

原因を調査し、ログの DEBUG レベルを有効にしようとしましたが、これが私が得たものです... ログを正しく読んだかどうかはわかりませんが、クライアントはすでに ANONYMOUS として登録されているようですので、すぐに403 エラー コードをスローします。

2012-11-12 15:00:56,545 DEBUG [phase.PhaseInterceptorChain] : Invoking handleMessage on interceptor org.apache.cxf.ws.policy.PolicyInInterceptor@55d0f2b6
2012-11-12 15:00:56,545 DEBUG [phase.PhaseInterceptorChain] : Invoking handleMessage on interceptor org.apache.cxf.transport.https.CertConstraintsInterceptor@78e9282b
2012-11-12 15:00:56,545 DEBUG [phase.PhaseInterceptorChain] : Invoking handleMessage on interceptor org.apache.cxf.jaxrs.interceptor.JAXRSInInterceptor@6c29b061
2012-11-12 15:00:56,547 DEBUG [utils.JAXRSUtils] : Trying to select a resource class, request path : /secured/
2012-11-12 15:00:56,547 DEBUG [utils.JAXRSUtils] : Trying to select a resource operation on the resource class com.kinoteatr.ua.service.KinoteatrServiceImpl
...
...
2012-11-12 15:00:56,558 DEBUG [utils.JAXRSUtils] : Resource operation testSecuredMethod on the resource class com.kinoteatr.ua.service.KinoteatrServiceImpl has been selected
2012-11-12 15:00:56,559 DEBUG [interceptor.JAXRSInInterceptor] : Request path is: /secured/
2012-11-12 15:00:56,559 DEBUG [interceptor.JAXRSInInterceptor] : Request HTTP method is: GET
2012-11-12 15:00:56,559 DEBUG [interceptor.JAXRSInInterceptor] : Request contentType is: */*
2012-11-12 15:00:56,559 DEBUG [interceptor.JAXRSInInterceptor] : Accept contentType is: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
2012-11-12 15:00:56,559 DEBUG [interceptor.JAXRSInInterceptor] : Found operation: testSecuredMethod
2012-11-12 15:00:56,559 DEBUG [phase.PhaseInterceptorChain] : Invoking handleMessage on interceptor org.apache.cxf.interceptor.OneWayProcessorInterceptor@2221deec
2012-11-12 15:00:56,559 DEBUG [phase.PhaseInterceptorChain] : Invoking handleMessage on interceptor org.apache.cxf.interceptor.ServiceInvokerInterceptor@8eeb6be
2012-11-12 15:00:56,561 DEBUG [aopalliance.MethodSecurityInterceptor] : Secure object: ReflectiveMethodInvocation: public java.lang.String com.kinoteatr.ua.service.KinoteatrServiceImpl.testSecuredMethod(); target is of class [com.kinoteatr.ua.service.KinoteatrServiceImpl]; Attributes: [ROLE_USER]
2012-11-12 15:00:56,561 DEBUG [aopalliance.MethodSecurityInterceptor] : Previously Authenticated: org.springframework.security.authentication.AnonymousAuthenticationToken@9055e4a6: Principal: anonymousUser; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@957e: RemoteIpAddress: 127.0.0.1; SessionId: null; Granted Authorities: ROLE_ANONYMOUS
2012-11-12 15:00:56,562 DEBUG [vote.AffirmativeBased] : Voter: org.springframework.security.access.vote.RoleVoter@13961789, returned: -1
2012-11-12 15:00:56,562 DEBUG [vote.AffirmativeBased] : Voter: org.springframework.security.access.vote.AuthenticatedVoter@62e32d6a, returned: 0
2012-11-12 15:00:56,563 DEBUG [support.DefaultListableBeanFactory] : Returning cached instance of singleton bean 'cxf'
2012-11-12 15:00:56,566 DEBUG [phase.PhaseInterceptorChain] : Invoking handleMessage on interceptor org.apache.cxf.interceptor.OutgoingChainInterceptor@701f7886
2012-11-12 15:00:56,566 DEBUG [interceptor.OutgoingChainInterceptor] : Interceptors contributed by bus: [org.apache.cxf.interceptor.LoggingOutInterceptor@315b222e, org.apache.cxf.ws.policy.PolicyOutInterceptor@56211352]
2012-11-12 15:00:56,566 DEBUG [interceptor.OutgoingChainInterceptor] : Interceptors contributed by service: []
2012-11-12 15:00:56,566 DEBUG [interceptor.OutgoingChainInterceptor] : Interceptors contributed by endpoint: [org.apache.cxf.interceptor.MessageSenderInterceptor@65640d91, org.apache.cxf.transport.common.gzip.GZIPOutInterceptor@bb6de98]
2012-11-12 15:00:56,566 DEBUG [interceptor.OutgoingChainInterceptor] : Interceptors contributed by binding: [org.apache.cxf.jaxrs.interceptor.JAXRSOutInterceptor@12cfd32a]
2012-11-12 15:00:56,567 DEBUG [phase.PhaseInterceptorChain] : Chain org.apache.cxf.phase.PhaseInterceptorChain@a4553e4 was created. Current flow:
    setup [PolicyOutInterceptor]
    prepare-send [MessageSenderInterceptor, GZIPOutInterceptor]
    pre-stream [LoggingOutInterceptor]
    marshal [JAXRSOutInterceptor]

2012-11-12 15:00:56,567 DEBUG [phase.PhaseInterceptorChain] : Invoking handleMessage on interceptor org.apache.cxf.ws.policy.PolicyOutInterceptor@56211352
2012-11-12 15:00:56,567 DEBUG [policy.PolicyOutInterceptor] : No binding operation info.
2012-11-12 15:00:56,567 DEBUG [phase.PhaseInterceptorChain] : Invoking handleMessage on interceptor org.apache.cxf.interceptor.MessageSenderInterceptor@65640d91
2012-11-12 15:00:56,567 DEBUG [phase.PhaseInterceptorChain] : Adding interceptor org.apache.cxf.interceptor.MessageSenderInterceptor$MessageSenderEndingInterceptor@43300672 to phase prepare-send-ending
2012-11-12 15:00:56,567 DEBUG [phase.PhaseInterceptorChain] : Chain org.apache.cxf.phase.PhaseInterceptorChain@a4553e4 was modified. Current flow:
   setup [PolicyOutInterceptor]
   prepare-send [MessageSenderInterceptor, GZIPOutInterceptor]
   pre-stream [LoggingOutInterceptor]
   marshal [JAXRSOutInterceptor]
   prepare-send-ending [MessageSenderEndingInterceptor]

2012-11-12 15:00:56,567 DEBUG [phase.PhaseInterceptorChain] : Invoking handleMessage on interceptor org.apache.cxf.transport.common.gzip.GZIPOutInterceptor@bb6de98
2012-11-12 15:00:56,567 DEBUG [gzip.GZIPOutInterceptor] : Response role, checking accept-encoding
2012-11-12 15:00:56,567 DEBUG [gzip.GZIPOutInterceptor] : Accept-Encoding header: [gzip,deflate,sdch]
2012-11-12 15:00:56,567 DEBUG [gzip.GZIPOutInterceptor] : gzip permitted: YES
2012-11-12 15:00:56,567 DEBUG [phase.PhaseInterceptorChain] : Invoking handleMessage on interceptor org.apache.cxf.interceptor.LoggingOutInterceptor@315b222e
2012-11-12 15:00:56,567 DEBUG [phase.PhaseInterceptorChain] : Invoking handleMessage on interceptor org.apache.cxf.jaxrs.interceptor.JAXRSOutInterceptor@12cfd32a
2012-11-12 15:00:56,567 DEBUG [phase.PhaseInterceptorChain] : Invoking handleMessage on interceptor org.apache.cxf.interceptor.MessageSenderInterceptor MessageSenderEndingInterceptor@43300672
2012-11-12 15:00:56,567 INFO  [interceptor.LoggingOutInterceptor] : Outbound Message
---------------------------
ID: 2
Response-Code: 403
Content-Type: text/xml
Headers: {Date=[Mon, 12 Nov 2012 13:00:56 GMT], Content-Length=[0]}
--------------------------------------
2012-11-12 15:00:56,567 DEBUG [gzip.GZIPOutInterceptor] : Message is smaller than compression threshold, not compressing.
2012-11-12 15:00:56,567 DEBUG [context.HttpSessionSecurityContextRepository] : SecurityContext is empty or contents are anonymous - context will not be stored in HttpSession.
2012-11-12 15:00:56,567 DEBUG [servlet.ServletController] : Finished servicing http request on thread: Thread[http-bio-8080-exec-64,5,main]
2012-11-12 15:00:56,567 DEBUG [access.ExceptionTranslationFilter] : Chain processed normally
2012-11-12 15:00:56,567 DEBUG [context.SecurityContextPersistenceFilter] : SecurityContextHolder now cleared, as request processing completed
4

1 に答える 1

3

ログイン ページは、保護された URLに対してのみ表示され、保護された方法に対しては表示されません

安全な方法は、アプリケーションを保護するための追加のレイヤーであり、ユーザーが既に認証されている必要があります。したがって、intersept-url ...を使用してログイン ページを表示する必要があります。

PS念のため。Spring Security のドキュメントで説明されているように:

アノテーション付きメソッドは、Spring Bean として定義されているインスタンスに対してのみ保護されます(メソッド セキュリティが有効になっている同じアプリケーション コンテキスト内)。Spring によって作成されていないインスタンスを保護する場合 (たとえば、new 演算子を使用)、AspectJ を使用する必要があります。

于 2012-11-12T20:35:24.917 に答える