sicurezza Primavera configurazione non supportata

Question

ho il seguente frammento

<http use-expressions="true" auto-config="false" 
     entry-point-ref="loginUrlAuthenticationEntryPoint" 
     access-decision-manager-ref="accessDecisionManager" disable-url-rewriting="false"> 
     <!--<custom-filter position="CONCURRENT_SESSION_FILTER" ref="concurrencyFilter" 
      /> --> 
     <custom-filter position="FORM_LOGIN_FILTER" 
      ref="usernamePasswordAuthenticationFilter" /> 
     <custom-filter position="LOGOUT_FILTER" ref="tapLockFilter" /> 

     <intercept-url pattern="/session/**" access="permitAll" /> 
     <intercept-url pattern="/deviceregistration/**" access="permitAll" /> 
     <intercept-url pattern="/session/lock" access="hasRole('ROLE_MEMBER')" /> 
     <intercept-url pattern="/app/resources/admin*" access="hasRole('ROLE_ADMIN')" /> 
     <intercept-url pattern="/app/SuperAppdashboard*" access="hasRole('ROLE_ADMIN')" /> 
     <intercept-url pattern="/app/*" access="hasRole('ROLE_MEMBER')" /> 


     <!--<session-management invalid-session-url="/tizelytics/session/invalidSession" 
      session-authentication-error-url="/tizelytics/session/accessDenied" session-authentication-strategy-ref="sas"> 
      </session-management> --> 

     <session-management invalid-session-url="/session/invalidSession" 
      session-authentication-error-url="/session/accessDenied" 
      session-fixation-protection="none"> 
      <concurrency-control max-sessions="1" 
       expired-url="/session/accessExpired" /> 
     </session-management> 
</http> 

Quando ho eseguito questo su un server viene generata un'eccezione dicendo

attributi

configurazione non supportata: [permitAll, permitAll, hasRole ('ROLE_ADMIN '), hasRole (' ROLE_ADMIN '), hasRole (' ROLE_MEMBER '), hasRole (' ROLE_MEMBER ')]

ecco la mia accesso-decisione-manager spirito di fagioli hin stesso xml

<beans:bean id="accessDecisionManager" 
     class="org.springframework.security.access.vote.AffirmativeBased"> 
     <beans:constructor-arg> 
      <beans:list> 
       <beans:bean 
        class="org.springframework.security.access.vote.AuthenticatedVoter" /> 
       <beans:bean class="org.springframework.security.access.vote.RoleVoter" /> 
      </beans:list> 
     </beans:constructor-arg> 
</beans:bean> 

se mi tolgo l'accesso-decisione-manager-ref non fa eccezione viene lanciata l'applicazione lancia correttamente chiunque può si prega di avvertire?

Answer 1

Poiché si sta definendo il proprio accessDecisionManager, non vedo WebExpressionVoter come uno dei fagioli nella sua lista. WebExpressionVoter risolve stringhe come permitAll(), hasRole(), hasAuthority(), ecc Quindi, il bean accessDecisionManager dovrebbe essere:

<beans:bean id="accessDecisionManager" 
     class="org.springframework.security.access.vote.AffirmativeBased"> 
     <beans:constructor-arg> 
      <beans:list> 
       <beans:bean 
        class="org.springframework.security.access.vote.AuthenticatedVoter" /> 
       <beans:bean class="org.springframework.security.access.vote.RoleVoter" /> 
       <beans:bean class="org.springframework.security.web.access.expression.WebExpressionVoter" /> 
      </beans:list> 
     </beans:constructor-arg> 
</beans:bean>