Spring Security配置导致永久认证请求

Question

我已经使用以下配置文件配置了我的网络应用程序：

 <beans xmlns="http://www.springframework.org/schema/beans" xmlns:security="http://www.springframework.org/schema/security"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
    http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.0.xsd">

<security:global-method-security secured-annotations="enabled" pre-post-annotations="enabled" />

<!--
    Filter chain; this is referred to from the web.xml file. Each filter
    is defined and configured as a bean later on.
-->
<!-- Note: anonumousProcessingFilter removed. -->
<bean id="filterChainProxy" class="org.springframework.security.web.FilterChainProxy">
    <security:filter-chain-map path-type="ant">
        <security:filter-chain pattern="/**"
            filters="securityContextPersistenceFilter,
                basicAuthenticationFilter,
                exceptionTranslationFilter,
                filterSecurityInterceptor" />
    </security:filter-chain-map>
</bean>

<!--
    This filter is responsible for session management, or rather the lack
    thereof.
-->
<bean id="securityContextPersistenceFilter" class="org.springframework.security.web.context.SecurityContextPersistenceFilter">
    <property name="securityContextRepository">
        <bean class="org.springframework.security.web.context.HttpSessionSecurityContextRepository">
            <property name="allowSessionCreation" value="false" />
        </bean>
    </property>
</bean>

<!-- Basic authentication filter. -->
<bean id="basicAuthenticationFilter" class="org.springframework.security.web.authentication.www.BasicAuthenticationFilter">
    <property name="authenticationManager" ref="authenticationManager" />
    <property name="authenticationEntryPoint" ref="authenticationEntryPoint" />
</bean>

<!-- Basic authentication entry point. -->
<bean id="authenticationEntryPoint" class="org.springframework.security.web.authentication.www.BasicAuthenticationEntryPoint">
    <property name="realmName" value="Ayudo Web Service" />
</bean>

<!--
    An anonymous authentication filter, which is chained after the normal authentication mechanisms and automatically adds an
    AnonymousAuthenticationToken to the SecurityContextHolder if there is no existing Authentication held there.
-->
<!--
    <bean id="anonymousProcessingFilter" class="org.springframework.security.web.authentication.AnonymousProcessingFilter">
    <property name="key" value="ayudo" /> <property name="userAttribute" value="anonymousUser, ROLE_ANONYMOUS" /> </bean>
-->

<!--
    Authentication manager that chains our main authentication provider
    and anonymous authentication provider.
-->
<bean id="authenticationManager" class="org.springframework.security.authentication.ProviderManager">
    <property name="providers">
        <list>
            <ref local="daoAuthenticationProvider" />
            <ref local="inMemoryAuthenticationProvider" />
            <!-- <ref local="anonymousAuthenticationProvider" /> -->
        </list>
    </property>
</bean>

<!--
    Main authentication provider; in this case, memory implementation.
-->
<bean id="inMemoryAuthenticationProvider" class="org.springframework.security.authentication.dao.DaoAuthenticationProvider">
    <property name="userDetailsService" ref="propertiesUserDetails" />
</bean>

<security:user-service id="propertiesUserDetails" properties="classpath:operators.properties" />

<!-- Main authentication provider. -->
<bean id="daoAuthenticationProvider" class="org.springframework.security.authentication.dao.DaoAuthenticationProvider">
    <property name="userDetailsService" ref="userDetailsService" />
</bean>

<!--
    An anonymous authentication provider which is chained into the ProviderManager so that AnonymousAuthenticationTokens are
    accepted.
-->
<!--
    <bean id="anonymousAuthenticationProvider" class="org.springframework.security.authentication.AnonymousAuthenticationProvider">
    <property name="key" value="ayudo" /> </bean>
-->

<bean id="userDetailsService" class="org.springframework.security.core.userdetails.jdbc.JdbcDaoImpl">
    <property name="dataSource" ref="dataSource" />
</bean>

<bean id="exceptionTranslationFilter" class="org.springframework.security.web.access.ExceptionTranslationFilter">
    <property name="authenticationEntryPoint" ref="authenticationEntryPoint" />
    <property name="accessDeniedHandler">
        <bean class="org.springframework.security.web.access.AccessDeniedHandlerImpl" />
    </property>
</bean>

<bean id="filterSecurityInterceptor" class="org.springframework.security.web.access.intercept.FilterSecurityInterceptor">
    <property name="securityMetadataSource">
        <security:filter-security-metadata-source use-expressions="true">
            <security:intercept-url pattern="/*.html" access="permitAll" />
            <security:intercept-url pattern="/version" access="permitAll" />
            <security:intercept-url pattern="/users/activate" access="permitAll" />
            <security:intercept-url pattern="/**" access="isAuthenticated()" />
        </security:filter-security-metadata-source>
    </property>
    <property name="authenticationManager" ref="authenticationManager" />
    <property name="accessDecisionManager" ref="accessDecisionManager" />
</bean>

<bean id="accessDecisionManager" class="org.springframework.security.access.vote.AffirmativeBased">
    <property name="decisionVoters">
        <list>
            <bean class="org.springframework.security.access.vote.RoleVoter" />
            <bean class="org.springframework.security.web.access.expression.WebExpressionVoter" />
        </list>
    </property>
</bean>

一旦我在 tomcat 上运行我的应用程序，我就会收到一个用户名/密码基本身份验证对话框的请求。即使当我尝试访问： localhost:8080/myapp/version（显式设置为 PermitAll）时，我也会收到身份验证请求对话框。帮助！

感谢， 萨米

Answer 1

您的过滤器链中有 basicAuthenticationFilter ，因此它将尝试对用户进行身份验证。 permitAll 将允许任何用户，但该请求仍然需要在 SecurityContext 中拥有一个用户（从 UserDetailsS​​ervice 中检索）。

如果您希望这些 URI 允许所有访问（即使不验证用户身份），请执行以下操作：

<intercept-url pattern="/version" filters="none"/>