如何使用 Spring Security 保护混合 Spring MVC + Flex 应用程序 [英] How to secure a hybrid Spring MVC + Flex application with spring security

问题描述

我试着在 Spring 论坛上问这个问题(http://forum.springsource.org/showthread.php?109948-Problem-configuring-spring-security-3.1-with-hybrid-Spring-MVC-Flex-application ) 但没有得到回应.

I tried asking this on the Spring forums ( http://forum.springsource.org/showthread.php?109948-Problem-configuring-spring-security-3.1-with-hybrid-Spring-MVC-Flex-application ) but did not get a response.

我正在开发一个 Web 应用程序，该应用程序具有在 Flex 中构建的(最终用户)用户界面和使用 Spring MVC 构建的管理用户界面.我正在尝试保护两个接口，并且可以让每个接口单独工作，但不能一起工作.

I'm working on a web application that has an (end user) user interface built in Flex and a management user interface built using Spring MVC. I'm trying to secure both interfaces and can get each one working separately, but not together.

我正在使用带有 Spring Security 3.1RC1 和 Spring 3.1M1 的 spring-flex-core 1.5.0 快照版本

I'm using a snapshot build of spring-flex-core 1.5.0 with Spring Security 3.1RC1 and Spring 3.1M1

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:security="http://www.springframework.org/schema/security"
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.5.xsd
    http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.1.xsd">

<!-- All Spring Security related configuration goes here -->

<security:global-method-security secured-annotations="enabled" jsr250-annotations="enabled"/>

<security:http pattern="/messagebroker/**" entry-point-ref="entryPoint">
    <security:anonymous enabled="false"/>
</security:http>

<bean id="entryPoint" class="org.springframework.flex.security3.FlexAuthenticationEntryPoint"/>

<security:http pattern="/favicon.ico" security="none"/>
<security:http pattern="/login*" security="none"/>
<security:http pattern="/logoutSuccess*" security="none"/>
<security:http pattern="/apollo/css/**" security="none"/>
<security:http pattern="/apollo/js/**" security="none"/>
<security:http pattern="/apollo/img/**" security="none"/>
<security:http pattern="/common/css/**" security="none"/>
<security:http pattern="/common/js/**" security="none"/>
<security:http pattern="/common/img/**" security="none"/>
<security:http pattern="/MoneyManager.swf" security="none"/>
<security:http pattern="/assets/**" security="none"/>
<security:http pattern="/index.jsp" security="none"/>

<security:http servlet-api-provision="true">

    <security:intercept-url pattern="/cms/*" access="ROLE_ADMIN"/>
    <security:intercept-url pattern="/cms/users/*" access="ROLE_ADMIN,ROLE_USER_MANAGER"/>
    <security:intercept-url pattern="/cms/content/*" access="ROLE_ADMIN,ROLE_CONTENT_MANAGER"/>        
    <security:intercept-url pattern="/**" access="ROLE_USER,ROLE_ADMIN" />

    <security:form-login login-page="/login.html" default-target-url="/home.html" 
                        always-use-default-target="false" authentication-failure-url="/login.html"/>

    <security:remember-me/>
    <security:logout logout-url="/logout" logout-success-url="/default.html" />

</security:http>

<bean id="successfulLogInListener" class="uk.co.ecube.web.security.SuccessfulLogInListener"/>
<bean id="failedLogInListener" class="uk.co.ecube.web.security.FailedLogInListener"/>


<security:authentication-manager>
    <security:authentication-provider user-service-ref='userService'/>
</security:authentication-manager>
</beans>

如果我只包含第一个没有 pattern 属性的 http 标记，那么 flex UI 似乎可以使用 Spring 安全性成功进行身份验证.但是，如果我包含所有 <http> 标签，那么我会收到两个错误之一，具体取决于我是否使用

If I include only the first http tag without the pattern attribute then the flex UI appears to authenticate successfully using Spring security. However if I include all the <http> tags then I get one of two errors depending on whether I use

<security:http  entry-point-ref="entryPoint">
    <security:anonymous enabled="false"/>
</security:http>

给出

SEVERE: Exception sending context initialized event to listener instance of class  org.springframework.web.context.ContextLoaderListener
org.springframework.beans.factory.parsing.BeanDefinitionParsingException:  Configuration problem: The filter chain map already contains this request matcher [Root  bean: class [org.springframework.security.web.util.AnyRequestMatcher]; scope=; abstract=false; lazyInit=false; autowireMode=0; dependencyCheck=0; autowireCandidate=true; primary=false; factoryBeanName=null; factoryMethodName=null; initMethodName=null; destroyMethodName=null]. If you are using multiple <http> namespace elements, you must use a 'pattern' attribute to define the request patterns to which they apply.

或

   <security:http pattern="/messagebroker/**" entry-point-ref="entryPoint">
    <security:anonymous enabled="false"/>
</security:http>

导致

SEVERE: Servlet /apollo threw load() exception
org.springframework.beans.factory.NoSuchBeanDefinitionException: No unique bean of type   [org.springframework.security.web.authentication.session.SessionAuthenticationStrategy] is defined: expected single matching bean but found 2: [org.springframework.security.web.authentication.session.SessionFixationProtectionStrategy#0, org.springframework.security.web.authentication.session.SessionFixationProtectionStrategy#1]
at org.springframework.beans.factory.support.DefaultListableBeanFactory.doResolveDependency(DefaultListableBeanFactory.java:796)

我显然遗漏了一些东西，虽然 Spring Flex 文档描述了如何在 servlet 级别配置混合 MVC+Flex 应用程序，但它似乎只从仅 flex 应用程序的角度考虑安全性.

I'm obviously missing something but while the Spring Flex documentation describes how to configure a hybrid MVC+Flex application at the servlet level it appears to only consider security from the perspective of a flex-only application.

谁能建议我做错了什么?

Can anyone suggest what I'm doing wrong?

谢谢

戴夫

推荐答案

我之前在处理同一问题时使用过的一件事是拥有 2 个独立的 DispatcherServlets:

One thing I've used before when dealing with the same issue was to have 2 separate DispatcherServlets:

<listener>
    <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>

<servlet>
    <servlet-name>flex</servlet-name>
    <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
    <load-on-startup>1</load-on-startup>
</servlet>

<servlet-mapping>
    <servlet-name>flex</servlet-name>
    <url-pattern>/messagebroker/*</url-pattern>
</servlet-mapping>

<servlet>
    <servlet-name>spring-mvc</servlet-name>
    <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
    <load-on-startup>1</load-on-startup>
</servlet>

<servlet-mapping>
    <servlet-name>spring-mvc</servlet-name>
    <url-pattern>/spring/*</url-pattern>
</servlet-mapping>

您还需要通过将 MVC 路径修改为 /spring/...

You also need to update your security configuration by modifying the MVC paths to /spring/...

我几乎可以肯定，当您使用 SpringDS 而不是 BlazeDS 时，这不是最佳解决方案.一定有更好的方法！

I'm almost sure that this isn't the best solution when you use SpringDS instead of BlazeDS. There's gotta be a more optimal way!

您也可以尝试删除:

<security:http pattern="/messagebroker/**" entry-point-ref="entryPoint">
    <security:anonymous enabled="false"/>
</security:http>

而不是尝试使用这个:

<flex:message-broker mapping-order="1">
    <flex:mapping pattern="/messagebroker/*"/>
    <flex:message-service default-channels="amf, polling-amf, longpolling-amf" />
    <flex:secured>
       <flex:secured-channel channel="amf" access="ROLE_SOME_ROLE" />
   </flex:secured>
</flex:message-broker>

请记住，身份验证应通过 Flex 客户端上的 channelSet 完成！

Keep in mind that the authentication should be done through the channelSet on the Flex client!

这篇关于如何使用 Spring Security 保护混合 Spring MVC + Flex 应用程序的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！