使用@PreAuthorize 时出错

Question

我正在开发一个 Spring 引导应用程序，我在其中尝试使用 @PreAuthorize 注释来过滤对用户资源的访问，以便用户只能访问他自己的资源。这是我的 UserRepository：

@Repository
@RepositoryRestResource
public interface MyUserRepository extends PagingAndSortingRepository<MyUser, UUID> {
    @Override
    @PreAuthorize("principal.getId().equals(#uuid)")
    MyUser findOne(UUID uuid);

    MyUser findByUsername(@Param("username") String username);

    MyUser findByEmail(@Param("email") String email);

}

您可以看到堆栈跟踪 here。

堆栈跟踪中的某处引用了 class WebSecurityConfig 第 42 行。这是以下 class:

的方法 configureAuthentication

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private RestAuthenticationEntryPoint unauthorizedHandler;

    @Autowired
    private BasicUserDetailsService userDetailsService;

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Autowired
    public void configureAuthentication(AuthenticationManagerBuilder authenticationManagerBuilder) throws Exception {
        authenticationManagerBuilder
                .userDetailsService(this.userDetailsService)
                .passwordEncoder(passwordEncoder());
    }

    @Bean
    @Override
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }

    @Bean
    public JwtAuthenticationTokenFilter authenticationTokenFilterBean() throws Exception {
        JwtAuthenticationTokenFilter authenticationTokenFilter = new JwtAuthenticationTokenFilter();
        authenticationTokenFilter.setAuthenticationManager(authenticationManagerBean());
        return authenticationTokenFilter;
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http

            // we don't need CSRF because our token is invulnerable
            .csrf().disable()

            .exceptionHandling()
                .authenticationEntryPoint(unauthorizedHandler)
                .and()

            // don't create session
            .sessionManagement()
                .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                .and()

            .authorizeRequests()
                .antMatchers(HttpMethod.POST, "/login").permitAll()
                .antMatchers(HttpMethod.POST, "/myUsers").permitAll()
                .antMatchers(HttpMethod.PUT).authenticated()
                .antMatchers(HttpMethod.POST).authenticated()
                .antMatchers(HttpMethod.DELETE).authenticated()
                .antMatchers(HttpMethod.PATCH).authenticated()
                .anyRequest().permitAll();

        // Custom JWT based security filter
        http.addFilterBefore(authenticationTokenFilterBean(), UsernamePasswordAuthenticationFilter.class);

        http.addFilterBefore(new CORSFilter(), ChannelProcessingFilter.class);

    }
}

谢谢！

Answer 1

更新至 Spring boot 1.4 已解决问题。

使用@PreAuthorize 时出错

Error using @PreAuthorize

spring-security

spring-data-rest