Bonjour
j’essaie d'intégrer le framework spring security ds notre projet pour assurer la sécurité de nos contrôleur , mais lorsque j'ajoute les annotations PreAuthorize ds mon contrôleur le framework ne les prends pas en considération et passe directement au contenu de ce dernier
voici mon web.xml
et
Code : Sélectionner tout - Visualiser dans une fenêtre à part
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30 <listener> <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class> </listener> <listener> <listener-class>org.springframework.security.web.session.HttpSessionEventPublisher</listener-class> </listener> <listener> <listener-class>org.springframework.web.util.Log4jConfigListener</listener-class> </listener> <context-param> <param-name>contextConfigLocation</param-name> <param-value> /WEB-INF/AppliKarma-security.xml </param-value> </context-param> <filter> <filter-name>springSecurityFilterChain</filter-name> <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class> </filter> <filter-mapping> <filter-name>springSecurityFilterChain</filter-name> <url-pattern>/*</url-pattern> </filter-mapping> <!-- : FIN ***************************************** --> <servlet> <servlet-name>AppliKarma</servlet-name> <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class> <load-on-startup>1</load-on-startup> </servlet>
le fichier de sécurité
et voici le controleur :
Code : Sélectionner tout - Visualiser dans une fenêtre à part
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56 <?xml version="1.0" encoding="UTF-8"?> <!-- - Application context containing authentication, channel - security and web URI beans. - - Only used by "filter" artifact. - --> <b:beans xmlns="http://www.springframework.org/schema/security" xmlns:b="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.1.xsd"> <global-method-security pre-post-annotations="enabled" proxy-target-class = "true" > <expression-handler ref="expressionHandler"/> </global-method-security> <http realm="AppliKarma Realm" use-expressions="true"> <intercept-url pattern="/login.jsp*" access="permitAll"/> <intercept-url pattern="/*" access="authenticated"/> <form-login login-page="/login.jsp" authentication-failure-url="/login.jsp?login_error=1"/> <custom-filter ref="requestHeaderFilter" before="FORM_LOGIN_FILTER"/> </http> <authentication-manager alias="authenticationManager"> <authentication-provider ref="karmaAuthenticationProvider" /> </authentication-manager> <b:bean id="expressionHandler" class="org.springframework.security.access.expression.method.DefaultMethodSecurityExpressionHandler"> <b:property name="permissionEvaluator" ref="permissionEvaluator"/> </b:bean> <b:bean id="permissionEvaluator" class="com.devoteam.frw.springSecurity.ScopablePermissionEvaluator"/> <b:bean id="loggerListener" class="org.springframework.security.authentication.event.LoggerListener"/> <b:bean id="karmaAuthenticationProvider" class="com.devoteam.frw.springSecurity.KarmaActiveDirectoryAuthenticationProvider"> </b:bean> <b:bean id="requestHeaderFilter" class="com.devoteam.frw.springSecurity.KarmaAuthenticationFilter"> <b:property name="authenticationManager" ref="authenticationManager"/> </b:bean> <!-- <b:bean id="permissionEvaluator" class="org.springframework.security.acls.AclPermissionEvaluator"> <b:constructor-arg ref="aclService"/> </b:bean> --> </b:beans>
Code : Sélectionner tout - Visualiser dans une fenêtre à part
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43 package com.devoteam.ctrl.test; import java.util.HashMap; import java.util.Map; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; import org.springframework.security.access.prepost.PreAuthorize; import org.springframework.stereotype.Controller; import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.bind.annotation.RequestParam; import org.springframework.web.servlet.ModelAndView; import org.springframework.web.servlet.mvc.AbstractController; public class TestController extends AbstractController { /*@RequestMapping("/test.do") protected ModelAndView doTest (@RequestParam String arg) throws Exception { Map<String, ?> model = new HashMap<String, String>(); // TODO Auto-generated method stub return new ModelAndView("test",model); }*/ @Override @PreAuthorize("hasPermission(1,'Salarie','Visu_DossierRH_Full')") protected ModelAndView handleRequestInternal(HttpServletRequest arg0, HttpServletResponse arg1) throws Exception { // TODO Auto-generated method stub Map<String, ?> model = new HashMap<String, String>(); // TODO Auto-generated method stub return new ModelAndView("test",model); } }
Partager