Spring Security 不会在拦截 URL 上重定向

我的 spring-security.xml 有两个问题

1. 当我在其中扮演多个角色时access="ROLE_ADMIN,ROLE_EMPLOYEE"
   我得到了例外：Caused by: java.lang.IllegalArgumentException: Failed to parse expression 'ROLE_ADMIN,ROLE_EMPLOYEE'
   但如果我有一个角色：access="ROLE_ADMIN"它会工作得很好

2. 如果我直接降落在/Management/main/admin我不会被规则重定向：security:form-login login-page="/Management/auth/login/"，这意味着我可以在没有管理员角色的情况下进入应用程序。

这是我的 spring-security.xml

<?xml version="1.0" encoding="UTF-8"?> 
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xmlns:lang="http://www.springframework.org/schema/lang"
       xmlns:context="http://www.springframework.org/schema/context"
       xmlns:tx="http://www.springframework.org/schema/tx"
       xmlns:sec="http://www.springframework.org/schema/security" 
       xsi:schemaLocation="http://www.springframework.org/schema/beans 
        http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
        http://www.springframework.org/schema/context 
        http://www.springframework.org/schema/context/spring-context-3.0.xsd
        http://www.springframework.org/schema/tx 
        http://www.springframework.org/schema/tx/spring-tx-3.0.xsd
        http://www.springframework.org/schema/security 
        http://www.springframework.org/schema/security/spring-security-3.0.xsd">

    <sec:global-method-security secured-annotations="enabled"  jsr250-annotations="enabled" />
    <sec:http auto-config="true" use-expressions="true"
        access-denied-page="/Management/auth/denied">

        <sec:intercept-url pattern="/Management/auth/login" filters="none" access="permitAll"/>
        <sec:intercept-url pattern="/Management/main/admin" filters="none" access="ROLE_ADMIN,ROLE_EMPLOYEE" />
        <sec:intercept-url pattern="/Management/api/affiliates/**" filters="none" access="ROLE_ADMIN,ROLE_EMPLOYEE" />

        <sec:form-login  login-page="/Management/auth/login/"
             authentication-success-handler-ref="loginAuthenticationSuccessHandler"
            authentication-failure-url="/Management/auth/login?error=true"
            login-processing-url="/Management/auth/j_spring_security_check"
            default-target-url="/Management/auth/login?error=false" />
        <sec:logout invalidate-session="true"
            logout-success-url="/Management/auth/login/" logout-url="/Management/auth/logout" />
    </sec:http>

    <sec:authentication-manager>
        <sec:authentication-provider
            user-service-ref="customUserDetailsService">
            <sec:password-encoder ref="passwordEncoder" />
        </sec:authentication-provider>
    </sec:authentication-manager>
    <bean id="loginAuthenticationSuccessHandler" class="com.affiliates.server.security.LoginAuthenticationSuccessHandler">
        <property name="defaultTargetUrl" value="/Management/auth/login?error=false"/>
    </bean>


    <bean
        class="org.springframework.security.authentication.encoding.Md5PasswordEncoder"
        id="passwordEncoder" />
    <bean id="customUserDetailsService" class="com.affiliates.service.CustomUserDetailsService" />
</beans>

这是我的 web.xml

<?xml version="1.0" encoding="UTF-8"?>
<web-app id="WebApp_ID" version="2.4"
    xmlns="http://java.sun.com/xml/ns/j2ee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd">
    <filter>
        <filter-name>springSecurityFilterChain</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    </filter>
    <filter-mapping>
        <filter-name>springSecurityFilterChain</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>
    <context-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>
        /WEB-INF/spring-security.xml
        /WEB-INF/applicationContext.xml
        </param-value>
    </context-param>
    <context-param>
        <param-name>log4jConfigLocation</param-name>
        <param-value>/WEB-INF/classes/log4j-myapp.properties</param-value>
    </context-param>
    <servlet>
        <servlet-name>spring</servlet-name>
        <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
        <load-on-startup>1</load-on-startup>
    </servlet>
    <servlet-mapping>
        <servlet-name>spring</servlet-name>
        <url-pattern>/Management/*</url-pattern>
    </servlet-mapping>
    <listener>
        <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
    </listener>
</web-app>

你正在使用使用表达式=true

您必须在拦截 URL 中使用 SpEL，如下所示：

 <security:http auto-config="true" use-expressions="true" access-denied-page="/krams/auth/denied" >

  <security:intercept-url pattern="/krams/auth/login" access="permitAll"/>
  <security:intercept-url pattern="/krams/main/admin" access="hasRole('ROLE_ADMIN')"/>
  <security:intercept-url pattern="/krams/main/common" access="hasRole('ROLE_USER')"/>

  ....
 </security:http>

要查看实际效果，请访问以下教程：http://krams915.blogspot.com/2010/12/spring-security-3-mvc-using-simple-user.html http://krams915.blogspot.com/2010/12/spring-security-3-mvc-using-simple-user.html

您可能还想查看一些有关本机表达式的信息：http://krams915.blogspot.com/2010/12/spring-security-3-mvc-using-native.html http://krams915.blogspot.com/2010/12/spring-security-3-mvc-using-native.html