自定义安全类中缺少身份验证管理器

Question

我有一个安全罐，我正在我的项目中实现。我正在扩展扩展WebSecurityConfigurerAdapter并具有所有过滤器的BasicSecurityConfig。有人告诉我，我所需要的只是扩展BasicSecurityConfig并调用super().configure这将调用父级的配置方法。但是，我收到此错误，

Field authenticationManager in com.custom.security.CustomSecurityFilter required a bean of type 'org.springframework.security.authentication.AuthenticationManager' that could not be found.

父类已经有一个AuthenticationManagerbean，我也不需要在子类中定义它。

My Security类

public class SecurityConfiguration extends BasicSecurityConfig {
private static final String PAYMONEYROLE = "(hasRole('EE'))";
@Override
protected void configure(HttpSecurity http) throws Exception {
// must call super first
super.configure(http);
http.authorizeRequests()
.antMatchers(HttpMethod.POST, "/v1/cart/validate").authenticated()
.antMatchers(HttpMethod.POST, "/v1/cart/validate").access(PAYMONEYROLE)
.and().cors().and().csrf().disable();
}
@Bean
public FilterRegistrationBean invalidResourceFilterRegistration(InvalidResourceFilter invalidResourceFilter) {
FilterRegistrationBean registration = new FilterRegistrationBean(invalidResourceFilter);
registration.setEnabled(false);
invalidResourceFilter.setDisabled(true);
return registration;
}
@Bean
public FilterRegistrationBean customSecurityFilterRegistration(CustomSecurityFilter customSecurityFilter) {
FilterRegistrationBean registration = new FilterRegistrationBean(customSecurityFilter);
registration.setEnabled(false);
return registration;
}

}

Custom Security罐

public class BasicSecurityConfig extends WebSecurityConfigurerAdapter {
@Autowired
private ApplicationContext applicationContext;
@Autowired
private InvalidResourceFilter invalidResourceFilter;
public BasicSecurityConfig() {
}
protected void configure(HttpSecurity http) throws Exception {
((HttpSecurity)((HttpSecurity)http.addFilterBefore(this.customSecurityFilter(), AbstractPreAuthenticatedProcessingFilter.class).addFilterAfter(this.invalidResourceFilter, FilterSecurityInterceptor.class).sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()).exceptionHandling().authenticationEntryPoint(this.authenticationEntryPoint()).accessDeniedHandler(this.customDeniedHandler()).and()).authorizeRequests().accessDecisionManager(this.accessDecisionManager());
}
public void configure(WebSecurity web) throws Exception {
web.ignoring().antMatchers(new String[]{"/docs**/**", "/swagger-ui.html**/**", "/webjars**/**", "/swagger-resources**/**", "/api-docs**/**", "/v2/api-docs**", "/version.json**"});
}
@Autowired
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
auth.authenticationProvider(this.customAuthenticationProvider());
}
@Bean
public AuthenticationManager authenticationManagerBean() throws Exception {
return super.authenticationManagerBean();
}
@Bean
public DefaultWebSecurityExpressionHandler defaultWebSecurityExpressionHandler() {
return new CustomWebSecurityExpressionHandler();
}
@Bean
public CustomSecurityFilter customSecurityFilter() {
return new CustomSecurityFilter();
}
@Bean
public AuthenticationProvider customAuthenticationProvider() {
return new CustomAuthenticationProvider();
}
@Bean
public AuthenticationSuccessHandler customSuccessHandler() {
return new CustomSuccessHandler();
}
@Bean
public AccessDeniedHandler customDeniedHandler() {
return new CustomAccessDeniedHandler();
}
@Bean
public AuthenticationEntryPoint authenticationEntryPoint() {
return new CustomAuthenticationEntryPoint();
}
@Bean
public CustomSystemUserAuthVoter customSystemUserAuthVoter() {
return new CustomSystemUserAuthVoter();
}
@Bean
public WebExpressionVoter webExpressionVoter() {
WebExpressionVoter wev = new WebExpressionVoter();
wev.setExpressionHandler(this.defaultWebSecurityExpressionHandler());
return wev;
}
@Bean
public AccessDecisionManager accessDecisionManager() {
return new ExplicitDecisionManager(Arrays.asList(this.customSystemUserAuthVoter(), this.webExpressionVoter()));
}
}

Answer 1

• 根据您的错误，CustomSecurityFilter应该authenticationManager注入。但它是在没有authenticationManager的情况下创建的，如下所示。

@Bean
public CustomSecurityFilter customSecurityFilter() {
return new CustomSecurityFilter();
}

• 如果可以修改BasicSecurityConfig，则按如下方式更新方法：

@Bean
public CustomSecurityFilter customSecurityFilter() {
//If it has a constructor which accept AuthenticationManager
return new CustomSecurityFilter(authenticationManagerBean());
//If it has a setter for AuthenticationManager instead
CustomSecurityFilter filter = new CustomSecurityFilter();
filter.setAuthenticationManager(authenticationManagerBean())
return filter;
}

• 如果无法修改BasicSecurityConfig，则使用Primary在SecurityConfiguration中创建它

@Bean
@Primary
public CustomSecurityFilter customSecurityFilter() {
//If it has a constructor which accept AuthenticationManager
return new CustomSecurityFilter(authenticationManagerBean());
//If it has a setter for AuthenticationManager instead
CustomSecurityFilter filter = new CustomSecurityFilter();
filter.setAuthenticationManager(authenticationManagerBean())
return filter;
}