W jaki sposób <global-method-security> może działać na moim kontrolerze przez Spring-Security?

Question

Utknąłem w tym wydaniu przez długi czas. Chcę używać @Secure dodać kontrolować dostęp do mojego kontrolera ArticleController.java tak:

@RequestMapping(headers = "Accept=application/json") 
@ResponseBody 
@Secured("ROLE_ADMIN") 
public ResponseEntity<String> listJson() { 
    HttpHeaders headers = new HttpHeaders(); 
    headers.add("Content-Type", "application/json; charset=utf-8"); 
    List<Article> result = Article.findAllArticles(); 
    return new ResponseEntity<String>(Article.toJsonArray(result), headers, HttpStatus.OK); 
} 

listJson zwrócić obiekt JSON dla Articles ale tylko Administrator może je odczytać. OK, teraz konfiguruję Spring-Security, aby to działało.

użyć security setup funkcji sprężynowym Roo następujące konfiguruje generowane:

W web.xml:

 <context-param> 
      <param-name>contextConfigLocation</param-name> 
      <param-value>classpath*:META-INF/spring/applicationContext*.xml</param-value> 
    </context-param> 
.... 
    <servlet> 
     <servlet-name>BabyPortal</servlet-name> 
     <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class> 
     <init-param> 
      <param-name>contextConfigLocation</param-name> 
      <param-value>WEB-INF/spring/webmvc-config.xml</param-value> 
     </init-param> 
     <load-on-startup>1</load-on-startup> 
    </servlet> 

W spring/webmvc-config.xml:

<?xml version="1.0" encoding="UTF-8"?> 
<beans xmlns="http://www.springframework.org/schema/beans" 
    xmlns:security="http://www.springframework.org/schema/security" 
    xmlns:context="http://www.springframework.org/schema/context" 
    xmlns:mvc="http://www.springframework.org/schema/mvc" xmlns:p="http://www.springframework.org/schema/p" 
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
    xmlns:tx="http://www.springframework.org/schema/tx" 
    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.1.xsd     http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.1.xsd     http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc-3.1.xsd  http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.1.xsd http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx-3.1.xsd"> 

    <tx:annotation-driven/> 
    <!-- The controllers are autodetected POJOs labeled with the @Controller 
     annotation. --> 
    <context:component-scan base-package="com.tongxinyuan.babyportal" 
     use-default-filters="false"> 
     <context:include-filter expression="org.springframework.stereotype.Controller" 
      type="annotation" /> 
    </context:component-scan> 

    <!-- Turns on support for mapping requests to Spring MVC @Controller methods 
     Also registers default Formatters and Validators for use across all @Controllers --> 
    <mvc:annotation-driven conversion-service="applicationConversionService" /> 


    <!-- Handles HTTP GET requests for /resources/** by efficiently serving 
     up static resources --> 
    <mvc:resources location="/, classpath:/META-INF/web-resources/" 
     mapping="/resources/**" /> 

    <!-- Allows for mapping the DispatcherServlet to "/" by forwarding static 
     resource requests to the container's default Servlet --> 
    <mvc:default-servlet-handler /> 

    <!-- Register "global" interceptor beans to apply to all registered HandlerMappings --> 
    <mvc:interceptors> 
     <bean class="org.springframework.web.servlet.theme.ThemeChangeInterceptor" /> 
     <bean class="org.springframework.web.servlet.i18n.LocaleChangeInterceptor" 
      p:paramName="lang" /> 
    </mvc:interceptors> 

    <!-- Selects a static view for rendering without the need for an explicit 
     controller --> 
    <mvc:view-controller path="/login" /> 
    <mvc:view-controller path="/" view-name="index" /> 
    <mvc:view-controller path="/uncaughtException" /> 
    <mvc:view-controller path="/resourceNotFound" /> 
    <mvc:view-controller path="/dataAccessFailure" /> 

    <!-- Resolves localized messages*.properties and application.properties 
     files in the application to allow for internationalization. The messages*.properties 
     files translate Roo generated messages which are part of the admin interface, 
     the application.properties resource bundle localizes all application specific 
     messages such as entity names and menu items. --> 
    <bean 
     class="org.springframework.context.support.ReloadableResourceBundleMessageSource" 
     id="messageSource" p:basenames="WEB-INF/i18n/messages,WEB-INF/i18n/application" 
     p:fallbackToSystemLocale="false" /> 

    <!-- Store preferred language configuration in a cookie --> 
    <bean class="org.springframework.web.servlet.i18n.CookieLocaleResolver" 
     id="localeResolver" p:cookieName="locale" /> 

    <!-- Resolves localized <theme_name>.properties files in the classpath to 
     allow for theme support --> 
    <bean 
     class="org.springframework.ui.context.support.ResourceBundleThemeSource" 
     id="themeSource" /> 

    <!-- Store preferred theme configuration in a cookie --> 
    <bean class="org.springframework.web.servlet.theme.CookieThemeResolver" 
     id="themeResolver" p:cookieName="theme" p:defaultThemeName="standard" /> 

    <!-- This bean resolves specific types of exceptions to corresponding logical 
     - view names for error views. The default behaviour of DispatcherServlet 
     - is to propagate all exceptions to the servlet container: this will happen 
     - here with all other types of exceptions. --> 
    <bean 
     class="org.springframework.web.servlet.handler.SimpleMappingExceptionResolver" 
     p:defaultErrorView="uncaughtException"> 
     <property name="exceptionMappings"> 
      <props> 
       <prop key=".DataAccessException">dataAccessFailure</prop> 
       <prop key=".NoSuchRequestHandlingMethodException">resourceNotFound</prop> 
       <prop key=".TypeMismatchException">resourceNotFound</prop> 
       <prop key=".MissingServletRequestParameterException">resourceNotFound</prop> 
      </props> 
     </property> 
    </bean> 

    <!-- Enable this for integration of file upload functionality --> 
    <bean 
     class="org.springframework.web.multipart.commons.CommonsMultipartResolver" 
     id="multipartResolver" /> 
    <bean 
     class="com.tongxinyuan.babyportal.controller.ApplicationConversionServiceFactoryBean" 
     id="applicationConversionService" /> 
    <bean class="org.springframework.web.servlet.view.UrlBasedViewResolver" 
     id="tilesViewResolver"> 
     <property name="viewClass" 
      value="org.springframework.web.servlet.view.tiles2.TilesView" /> 
    </bean> 
    <bean class="org.springframework.web.servlet.view.tiles2.TilesConfigurer" 
     id="tilesConfigurer"> 
     <property name="definitions"> 
      <list> 
       <value>/WEB-INF/layouts/layouts.xml</value> 
       <!-- Scan views directory for Tiles configurations --> 
       <value>/WEB-INF/views/**/views.xml</value> 
      </list> 
     </property> 
    </bean> 

    <security:global-method-security mode="aspectj" secured-annotations="enabled" pre-post-annotations="enabled"/> 

</beans> 

W /spring/applicationContext-security.xml:

<?xml version="1.0" encoding="UTF-8"?> 
<beans:beans xmlns="http://www.springframework.org/schema/security" 
    xmlns:beans="http://www.springframework.org/schema/beans" 
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.1.xsd 
     http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.1.xsd"> 
    <!-- HTTP security configurations --> 
    <http auto-config="true" use-expressions="true"> 
     <form-login login-processing-url="/resources/j_spring_security_check" login-page="/login" authentication-failure-url="/login?login_error=t" /> 
     <logout logout-url="/resources/j_spring_security_logout" /> 
     <!-- Configure these elements to secure URIs in your application --> 
     <intercept-url pattern="/choices/**" access="hasRole('ROLE_ADMIN')" /> 
     <intercept-url pattern="/member/**" access="isAuthenticated()" /> 
     <intercept-url pattern="/resources/**" access="permitAll" /> 
     <intercept-url pattern="/*.html" access="hasRole('ROLE_ADMIN')" /> 
    </http> 
    <!-- Configure Authentication mechanism --> 
    <authentication-manager alias="authenticationManager"> 
     <authentication-provider> 
      <user-service> 
       <user name="admin" password="admin" authorities="ROLE_ADMIN" /> 
       <user name="user" password="user" authorities="ROLE_USER" /> 
      </user-service> 
     </authentication-provider> 
    </authentication-manager> 
</beans:beans> 

Po pierwsze próbowałem dodać <global-method-security mode="aspectj" secured-annotations="enabled" pre-post-annotations="enabled"/> do /spring/applicationContext-security.xml, ale nie działało. Wtedy może kontroler nie znajduje się w tym samym kontekście kontekstu zabezpieczeń, więc dodałem do /spring/webmvc-config.xml, który rozpoczął się od DispatcherServlet, nie działał.

Dodałem także do innego domyślnego applicationContext.xml, to też nie działa. Nie wiem, jak skonfigurować <global-method-security>, które może sprawić, że bezpieczeństwo metody zadziała. Wydaje mi się, że używam tylko jednego kontekstu, czy coś przeoczyłem? Mam nadzieję, że informacje są wystarczające do wyjaśnienia tej kwestii.

PS: Wygenerowana metoda URL działa bardzo dobrze: <intercept-url pattern="/*.html" access="hasRole('ROLE_ADMIN')" />.

Dodano: Według komentarzy @LukeTaylor „s: Dodałem <global-method-security> do webmvc-config.xml i usunął mode="aspectj", to działa, i zrobiłem kilka eksperymentów, jeszcze kilka pytań:

1) To działa ale tylko dla ArticleController.java, tag @Secure w ArticleController_Roo_Controller.aj nadal nie działa, czy jest to coś związanego z "machaniem"? 2) Czy możesz mi wyjaśnić, dlaczego mode=aspectj sprawiają, że tu jest bałagan?

Answer 1

Zgodnie z sugestią @Luke Taylor w komentarzach tag <sec:global-method-security/> należy zdefiniować w pliku dispatcher-servlet.xml (webmvc-config.xml w tym przypadku). I nie ma potrzeby posiadania atrybutu mode="aspectj".

Dzięki.