我尝试在 Spring 论坛上询问这个问题(http://forum.springsource.org/showthread.php?109948-Problem-configuring-spring-security-3.1-with-hybrid-Spring-MVC-Flex-application http://forum.springsource.org/showthread.php?109948-Problem-configuring-spring-security-3.1-with-hybrid-Spring-MVC-Flex-application)但没有得到回应。
我正在开发一个 Web 应用程序,该应用程序具有使用 Flex 构建的(最终用户)用户界面和使用 Spring MVC 构建的管理用户界面。我正在尝试保护两个接口的安全,并且可以让每个接口单独工作,但不能一起工作。
我正在使用 spring-flex-core 1.5.0 的快照构建以及 Spring Security 3.1RC1 和 Spring 3.1M1
<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:security="http://www.springframework.org/schema/security"
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.5.xsd
http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.1.xsd">
<!-- All Spring Security related configuration goes here -->
<security:global-method-security secured-annotations="enabled" jsr250-annotations="enabled"/>
<security:http pattern="/messagebroker/**" entry-point-ref="entryPoint">
<security:anonymous enabled="false"/>
</security:http>
<bean id="entryPoint" class="org.springframework.flex.security3.FlexAuthenticationEntryPoint"/>
<security:http pattern="/favicon.ico" security="none"/>
<security:http pattern="/login*" security="none"/>
<security:http pattern="/logoutSuccess*" security="none"/>
<security:http pattern="/apollo/css/**" security="none"/>
<security:http pattern="/apollo/js/**" security="none"/>
<security:http pattern="/apollo/img/**" security="none"/>
<security:http pattern="/common/css/**" security="none"/>
<security:http pattern="/common/js/**" security="none"/>
<security:http pattern="/common/img/**" security="none"/>
<security:http pattern="/MoneyManager.swf" security="none"/>
<security:http pattern="/assets/**" security="none"/>
<security:http pattern="/index.jsp" security="none"/>
<security:http servlet-api-provision="true">
<security:intercept-url pattern="/cms/*" access="ROLE_ADMIN"/>
<security:intercept-url pattern="/cms/users/*" access="ROLE_ADMIN,ROLE_USER_MANAGER"/>
<security:intercept-url pattern="/cms/content/*" access="ROLE_ADMIN,ROLE_CONTENT_MANAGER"/>
<security:intercept-url pattern="/**" access="ROLE_USER,ROLE_ADMIN" />
<security:form-login login-page="/login.html" default-target-url="/home.html"
always-use-default-target="false" authentication-failure-url="/login.html"/>
<security:remember-me/>
<security:logout logout-url="/logout" logout-success-url="/default.html" />
</security:http>
<bean id="successfulLogInListener" class="uk.co.ecube.web.security.SuccessfulLogInListener"/>
<bean id="failedLogInListener" class="uk.co.ecube.web.security.FailedLogInListener"/>
<security:authentication-manager>
<security:authentication-provider user-service-ref='userService'/>
</security:authentication-manager>
</beans>
如果我只包含第一个 http 标签而不包含模式属性,那么 Flex UI 似乎可以使用 Spring 安全性成功进行身份验证。但是如果我包括所有<http>
标签,然后我会收到两个错误之一,具体取决于我是否使用
<security:http entry-point-ref="entryPoint">
<security:anonymous enabled="false"/>
</security:http>
这使
SEVERE: Exception sending context initialized event to listener instance of class org.springframework.web.context.ContextLoaderListener
org.springframework.beans.factory.parsing.BeanDefinitionParsingException: Configuration problem: The filter chain map already contains this request matcher [Root bean: class [org.springframework.security.web.util.AnyRequestMatcher]; scope=; abstract=false; lazyInit=false; autowireMode=0; dependencyCheck=0; autowireCandidate=true; primary=false; factoryBeanName=null; factoryMethodName=null; initMethodName=null; destroyMethodName=null]. If you are using multiple <http> namespace elements, you must use a 'pattern' attribute to define the request patterns to which they apply.
or
<security:http pattern="/messagebroker/**" entry-point-ref="entryPoint">
<security:anonymous enabled="false"/>
</security:http>
这导致
SEVERE: Servlet /apollo threw load() exception
org.springframework.beans.factory.NoSuchBeanDefinitionException: No unique bean of type [org.springframework.security.web.authentication.session.SessionAuthenticationStrategy] is defined: expected single matching bean but found 2: [org.springframework.security.web.authentication.session.SessionFixationProtectionStrategy#0, org.springframework.security.web.authentication.session.SessionFixationProtectionStrategy#1]
at org.springframework.beans.factory.support.DefaultListableBeanFactory.doResolveDependency(DefaultListableBeanFactory.java:796)
我显然遗漏了一些东西,但是虽然 Spring Flex 文档描述了如何在 servlet 级别配置混合 MVC+Flex 应用程序,但它似乎只从纯 Flex 应用程序的角度考虑安全性。
谁能建议我做错了什么?
thanks
Dave