Spring Security方法安全拦截器未获取authenticationManager

Question

我正在尝试编写一个自定义方法安全拦截器。但是，它没有使用我添加到安全上下文中的 bean 属性中的身份验证管理器，并且当我检查身份验证管理器是否存在时返回 null。任何人都可以阐明为什么不使用身份验证管理器 bean 属性吗？我在 WebSphere 7.0 上使用 spring security 3.0.5

这是包含方法拦截器的 bean

<beans:bean id="methodInterceptor"
    class="bigbank.security.CustomMethodSecInterceptor">
    <beans:property name="authenticationManager" ref="authenticationManager" />
    <beans:property name="accessDecisionManager" ref="universalAccessDecisionManager" />
    <beans:property name="securityMetadataSource" ref="tspmMethodSecurityMetaData" />

这是我的方法安全拦截器

public class CustomMethodSecInterceptor extends MethodSecurityInterceptor {

private static final Log logger = LogFactory
        .getLog(WebSphere2SpringSecurityPropagationInterceptor.class);
private AuthenticationManager authenticationManager = null;
private AuthenticationDetailsSource authenticationDetailsSource = new WebSpherePreAuthenticatedAuthenticationDetailsSource();
private final WASUsernameAndGroupsExtractor wasHelper;

public CustomMethodSecInterceptor() {
    wasHelper = new DefaultWASUsernameAndGroupsExtractor();
}

@Override
public Object invoke(MethodInvocation mi) throws Throwable {
    try {
        logger.debug("Performing Spring Security authentication with WebSphere credentials");
        System.out.println("@@going through ss authentication");
        authenticateSpringSecurityWithWASCredentials();
        InterceptorStatusToken token = super.beforeInvocation(mi);

        logger.debug("Proceeding with method invocation");
        Object result = mi.proceed();
        return super.afterInvocation(token, result);

    } finally {
        logger.debug("Clearing Spring Security security context");
        SecurityContextHolder.clearContext();
    }
}

private void authenticateSpringSecurityWithWASCredentials() {
    Assert.notNull(authenticationManager); // This is where the error is coming up
    Assert.notNull(authenticationDetailsSource);

    String userName = wasHelper.getCurrentUserName();
    if (logger.isDebugEnabled()) {
        logger.debug("Creating authentication request for user " + userName);
    }
    PreAuthenticatedAuthenticationToken authRequest = new PreAuthenticatedAuthenticationToken(
            userName, "N/A");
    authRequest.setDetails(authenticationDetailsSource.buildDetails(null));
    if (logger.isDebugEnabled()) {
        logger.debug("Authentication request for user " + userName + ": "
                + authRequest);
    }
    Authentication authResponse = authenticationManager
            .authenticate(authRequest);
    if (logger.isDebugEnabled()) {
        logger.debug("Authentication response for user " + userName + ": "
                + authResponse);
    }
    SecurityContextHolder.getContext().setAuthentication(authResponse);
}

public void setAuthenticationManager(
        AuthenticationManager authenticationManager) {
    this.authenticationManager = authenticationManager;
}

}

这是错误：

Caused by: java.lang.IllegalArgumentException: An AuthenticationManager is required
at org.springframework.util.Assert.notNull(Assert.java:112)
at org.springframework.security.access.intercept.AbstractSecurityInterceptor.afterPropertiesSet(AbstractSecurityInterceptor.java:118)
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.invokeInitMethods(AbstractAutowireCapableBeanFactory.java:1469)
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1409)
... 119 more

Answer 1

您已经重写了 setAuthenticationManager 方法，因此当 Spring 调用它来注入 AuthenticationManager 时，它不会在 AbstractSecurityInterceptor 中设置相应的字段。

由于基类包含此属性的 getter，因此最好删除该字段和 setter 方法，而仅使用 getter 来访问代码中的身份验证管理器。