AbstractSecurityInterceptor 必须提供一个非空的 AccessDecisionManager

Question

自从 Spring Security 升级到 5.6.2 后，我在运行应用程序时遇到了问题，因为我不断收到以下信息：

Caused by: java.lang.IllegalArgumentException: AbstractSecurityInterceptor must provide a non-null AccessDecisionManager
    at org.springframework.util.Assert.notNull(Assert.java:201) ~[spring-core-5.3.16.jar:5.3.16]
    at org.springframework.security.web.access.DefaultWebInvocationPrivilegeEvaluator.<init>(DefaultWebInvocationPrivilegeEvaluator.java:54) ~[spring-security-web-5.6.2.jar:5.6.2]
    at org.springframework.security.config.annotation.web.builders.WebSecurity.getRequestMatcherPrivilegeEvaluatorsEntry(WebSecurity.java:338) ~[spring-security-config-5.6.2.jar:5.6.2]
    at org.springframework.security.config.annotation.web.builders.WebSecurity.performBuild(WebSecurity.java:305) ~[spring-security-config-5.6.2.jar:5.6.2]
    at org.springframework.security.config.annotation.web.builders.WebSecurity.performBuild(WebSecurity.java:90) ~[spring-security-config-5.6.2.jar:5.6.2]
    at org.springframework.security.config.annotation.AbstractConfiguredSecurityBuilder.doBuild(AbstractConfiguredSecurityBuilder.java:305) ~[spring-security-config-5.6.2.jar:5.6.2]
    at org.springframework.security.config.annotation.AbstractSecurityBuilder.build(AbstractSecurityBuilder.java:38) ~[spring-security-config-5.6.2.jar:5.6.2]

到目前为止，我不需要 AccessDecisionManager bean，一切都像魅力一样工作this：

@Configuration
@EnableWebSecurity
open class OpenApiSecurityConfig() : WebSecurityConfigurerAdapter() {

    override fun configure(http: HttpSecurity) {
        http.requestMatchers()
            .antMatchers("/docs")
            .and()
            .addFilter(OpenApiFilter(authService))
    }

    open class OpenApiFilter(private val authService: AuthService) : FilterSecurityInterceptor() {
        override fun doFilter(request: ServletRequest, response: ServletResponse, chain: FilterChain) {
            if (userAuthorized()) {
                chain.doFilter(request, response)
            } else {
                throw AccessDeniedException("Forbidden.")
            }
        }
    }
}

所以我想这只是某种新的要求。我将配置添加为：

@Configuration
@Import(AccessManager::class)
@EnableWebSecurity
open class OpenApiSecurityConfig() : WebSecurityConfigurerAdapter() { … }
… 
@Configuration
open class AccessManager : AccessDecisionManager {
    override fun decide(authentication: Authentication, `object`: Any?, configAttributes: MutableCollection<ConfigAttribute>?) {}
    override fun supports(attribute: ConfigAttribute?): Boolean = false
    override fun supports(clazz: Class<*>?): Boolean = false
}

但是没有效果。

1. 是否可以避免对 AccessManager 的需要？
2. 实例化它的正确方法是什么？

Answer 1

此问题源于创建自定义 FilterSecurityInterceptor。
该过滤器不应在过滤器链中被替换。
最好创建不同类型的自定义过滤器并将其插入到 FilterSecurityInterceptor 之前。例如，它可以扩展OncePerRequestFilter，并且如果用户未经授权，它可以简单地返回，而不是抛出AccessDeniedException。