Java 具有多个角色的 Spring 安全访问
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/24010597/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
Spring security access with multiple roles
提问by Evgeny Makarov
I want to define access for some pages for user who has one of following roles (ROLE1 or ROLE2)
我想为具有以下角色（ROLE1 或 ROLE2）之一的用户定义某些页面的访问权限
I'm trying to configure this in my spring security xml file as following:
我正在尝试在我的 spring 安全 xml 文件中配置它，如下所示：
<security:http entry-point-ref="restAuthenticationEntryPoint" access-decision-manager-ref="accessDecisionManager" xmlns="http://www.springframework.org/schema/security" use-expressions="true">
<!-- skipped configuration -->
<security:intercept-url pattern="/rest/api/myUrl*" access="hasRole('ROLE1') or hasRole('ROLE2')" />
<!-- skipped configuration -->
</security:http>
I've tried various ways like:
我尝试了各种方法，例如：
access="hasRole('ROLE1, ROLE2')"
access="hasRole('ROLE1', 'ROLE2')"
access="hasAnyRole('[ROLE1', 'ROLE2]')"
etc
等等
but nothing seems to be working.
但似乎没有任何效果。
I'm keep getting exception
我不断收到异常
java.lang.IllegalArgumentException: Unsupported configuration attributes:
or
或者
java.lang.IllegalArgumentException: Failed to parse expression 'hasAnyRole(['ROLE1', 'ROLE2'])'
how should it be configured?
应该如何配置？
Thanks
谢谢
采纳答案by Evgeny Makarov
The problem was that I configured custom access-decision-manager-ref="accessDecisionManager"and didn't pass one of the voters.
问题是我配置了自定义access-decision-manager-ref="accessDecisionManager"并且没有通过投票者之一。
Solved by adding org.springframework.security.web.access.expression.WebExpressionVoterto accessDecisionManagerbean.
通过添加org.springframework.security.web.access.expression.WebExpressionVoter到accessDecisionManagerbean解决。
回答by Wundwin Born
回答by user1632989
If you are playing it with OAuth2, make sure you checkout this to solve your problems.
如果您使用 OAuth2 玩它，请确保您检查它以解决您的问题。
http://lightweightyes.blogspot.in/2012/08/spring-security-expressions-not-working.html
http://lightweightyes.blogspot.in/2012/08/spring-security-expressions-not-working.html
I just struggled hell lot of time trying all trial and errors.
我只是在尝试所有试验和错误中挣扎了很多时间。
