带有执行器和自定义安全性的Spring引导OpenSessionInViewFilter

Question

我正在使用spring-boot创建RESTful web服务。为了安全起见，我通过扩展AbstractUserDetailsAuthenticationProvider来使用BasicAuthenticationFilter和自定义AuthenticationProvider。我在控制器类中使用方法级安全性和@Secured注释。这一切都很好，除了我试图让弹簧执行器也工作。

执行器的问题是，我在尝试验证请求时遇到休眠异常，因为没有打开会话。所以当我去http://localhost:8081/info我得到一个休眠异常。

执行器似乎使用了一个独立于应用程序其他部分的过滤链。如果是这样的话，我相信这是有充分理由的。然而，我不知道如何注册我的OpenSessionInViewFilter，使其成为我每个过滤器链中的第一个过滤器。我的OpenSessionInViewFilter是通过我的一个@Configuration类中的FilterRegistrationBean注册的。

Spring boot很棒，但它背后有很多神奇之处，我还没有弄清楚如何深入研究他们的代码，看看这一切从哪里开始并贯彻到底。

这是我的一些配置。我试着把我认为重要的东西包括在内。如果你想看另一件作品，请告诉我。

感谢您的帮助。

@EnableWebSecurity
@Configuration
public class WebSecurityConfig extends WebSecurityConfigurerAdapter
{
    @Override
    protected void configure(HttpSecurity http) throws Exception
    {
        http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
        http.authorizeRequests().anyRequest().fullyAuthenticated()
            .and().httpBasic().authenticationDetailsSource(new WebAuthenticationDetailsSource()
            {
                @Override
                public WebAuthenticationDetails buildDetails(HttpServletRequest context)
                {
                    return new ThirdPartyAuthenticationDetails(context);
                }
            })
            .and().csrf().disable();
    }
} 
@Configuration
public class WebSecurityConfiguration extends GlobalAuthenticationConfigurerAdapter
{
    @Autowired
    private DataSource dataSource;
    @Autowired
    @Qualifier("thirdPartySystemDAO")
    private EntityDAO<ThirdPartySystem> thirdPartySystemDAO;
    @Override
    public void init(AuthenticationManagerBuilder auth) throws Exception
    {
        auth.authenticationProvider(authenticationProvider());
    }
    @Bean
    public AuthenticationProvider authenticationProvider()
    {
        ThirdPartyAuthenticationProvider result = new ThirdPartyAuthenticationProvider();
        result.setSecurityService(thirdPartySecurityService());
        return result;
    }
    @Bean
    public ThirdPartySecurityService thirdPartySecurityService()
    {
        ThirdPartySecurityServiceImpl result = new ThirdPartySecurityServiceImpl();
        result.setJdbcTemplate(new JdbcTemplate(dataSource));
        result.setThirdPartySystemDAO(thirdPartySystemDAO);
        return result;
    }
}

这是尝试访问执行器/info端点时的堆栈跟踪

org.hibernate.HibernateException: Could not obtain transaction-synchronized Session for current thread
    at org.springframework.orm.hibernate4.SpringSessionContext.currentSession(SpringSessionContext.java:134) ~[spring-orm-4.1.4.RELEASE.jar:4.1.4.RELEASE]
    at org.hibernate.internal.SessionFactoryImpl.getCurrentSession(SessionFactoryImpl.java:988) ~[hibernate-core-4.2.2.Final.jar:4.2.2.Final]
    at com.redi.dao.hibernate.HibernateDAO.getCurrentSession(HibernateDAO.java:495) ~[redi-dao-4.3.0.jar:4.3.0]
    at com.redi.dao.hibernate.HibernateDAO.createQuery(HibernateDAO.java:460) ~[redi-dao-4.3.0.jar:4.3.0]
    at com.redi.dao.hibernate.HibernateDAO.findOneWhere(HibernateDAO.java:58) ~[redi-dao-4.3.0.jar:4.3.0]
    at com.mycompany.DefaultVerifiService.getInstitution(DefaultVerifiService.java:349) ~[classes/:na]
    at com.mycompany.thirdparty.ws.security.ThirdPartyAuthenticationProvider.retrieveUser(ThirdPartyAuthenticationProvider.java:36) ~[classes/:na]
    at org.springframework.security.authentication.dao.AbstractUserDetailsAuthenticationProvider.authenticate(AbstractUserDetailsAuthenticationProvider.java:143) ~[spring-security-core-4.0.3.RELEASE.jar:4.0.3.RELEASE]
    at org.springframework.security.authentication.ProviderManager.authenticate(ProviderManager.java:167) ~[spring-security-core-4.0.3.RELEASE.jar:4.0.3.RELEASE]
    at org.springframework.security.authentication.ProviderManager.authenticate(ProviderManager.java:192) ~[spring-security-core-4.0.3.RELEASE.jar:4.0.3.RELEASE]
    at org.springframework.security.web.authentication.www.BasicAuthenticationFilter.doFilter(BasicAuthenticationFilter.java:168) ~[spring-security-web-3.2.5.RELEASE.jar:3.2.5.RELEASE]
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342) ~[spring-security-web-3.2.5.RELEASE.jar:3.2.5.RELEASE]
    at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:110) ~[spring-security-web-3.2.5.RELEASE.jar:3.2.5.RELEASE]
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342) ~[spring-security-web-3.2.5.RELEASE.jar:3.2.5.RELEASE]
    at org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:57) ~[spring-security-web-3.2.5.RELEASE.jar:3.2.5.RELEASE]
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) ~[spring-web-4.1.4.RELEASE.jar:4.1.4.RELEASE]
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342) ~[spring-security-web-3.2.5.RELEASE.jar:3.2.5.RELEASE]
    at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:87) ~[spring-security-web-3.2.5.RELEASE.jar:3.2.5.RELEASE]
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342) ~[spring-security-web-3.2.5.RELEASE.jar:3.2.5.RELEASE]
    at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:50) ~[spring-security-web-3.2.5.RELEASE.jar:3.2.5.RELEASE]
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) ~[spring-web-4.1.4.RELEASE.jar:4.1.4.RELEASE]
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342) ~[spring-security-web-3.2.5.RELEASE.jar:3.2.5.RELEASE]
    at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:192) ~[spring-security-web-3.2.5.RELEASE.jar:3.2.5.RELEASE]
    at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:160) ~[spring-security-web-3.2.5.RELEASE.jar:3.2.5.RELEASE]
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239) ~[tomcat-embed-core-8.0.15.jar:8.0.15]
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) ~[tomcat-embed-core-8.0.15.jar:8.0.15]
    at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219) ~[tomcat-embed-core-8.0.15.jar:8.0.15]
    at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:106) [tomcat-embed-core-8.0.15.jar:8.0.15]
    at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:501) [tomcat-embed-core-8.0.15.jar:8.0.15]
    at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:142) [tomcat-embed-core-8.0.15.jar:8.0.15]
    at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:79) [tomcat-embed-core-8.0.15.jar:8.0.15]
    at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:88) [tomcat-embed-core-8.0.15.jar:8.0.15]
    at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:537) [tomcat-embed-core-8.0.15.jar:8.0.15]
    at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1085) [tomcat-embed-core-8.0.15.jar:8.0.15]
    at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:658) [tomcat-embed-core-8.0.15.jar:8.0.15]
    at org.apache.coyote.http11.Http11NioProtocol$Http11ConnectionHandler.process(Http11NioProtocol.java:222) [tomcat-embed-core-8.0.15.jar:8.0.15]
    at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1556) [tomcat-embed-core-8.0.15.jar:8.0.15]
    at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.run(NioEndpoint.java:1513) [tomcat-embed-core-8.0.15.jar:8.0.15]
    at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) [na:1.8.0_51]
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) [na:1.8.0_51]
    at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) [tomcat-embed-core-8.0.15.jar:8.0.15]
    at java.lang.Thread.run(Unknown Source) [na:1.8.0_51]

Answer 1

注册OpenSessionInViewFilter，将以下代码放在您的配置类上：

    @Bean
public FilterRegistrationBean registerOpenEntityManagerInViewFilterBean() {
    FilterRegistrationBean registrationBean = new FilterRegistrationBean();
    OpenEntityManagerInViewFilter filter = new OpenEntityManagerInViewFilter();
    registrationBean.setFilter(filter);
    registrationBean.setOrder(5);
    return registrationBean;
}

你必须记住。。。如果使用Hibernate，请声明OpenSessionInViewFilter。但是，如果您使用的是JPA，请声明OpenEntityManagerInViewFilter。

祝你好运。