Java 我在哪里定义`springSecurityFilterChain` bean？

Where do I define `springSecurityFilterChain` bean?

提问by CodeMed

When I place the bean definition for springSecurityFilterChainin web.xml, I get an error indicating that Tomcat 7 will not start because there is a duplicate bean definition for springSecurityFilterChain. I uploaded the entire stack trace to a file sharing site, which you can read by clicking on this link. However, when I the comment out the springSecurityFilterChainbean definition in web.xmland try to restart the server, I get a different error message indicating that there is no bean definition for springSecurityFilterChain. You can read the second stack trace at the file sharing site by clicking on this link.

当我为springSecurityFilterChainin放置 bean 定义时web.xml，我收到一条错误消息，指出 Tomcat 7 将无法启动，因为有一个duplicate bean definition for springSecurityFilterChain. 我将整个堆栈跟踪上传到了一个文件共享站点，您可以通过单击此链接来阅读该站点。但是，当我注释掉springSecurityFilterChainbean 定义web.xml并尝试重新启动服务器时，我收到一条不同的错误消息，表明没有springSecurityFilterChain. 您可以通过单击此链接在文件共享站点上阅读第二个堆栈跟踪。

So where should I put the bean definition for springSecurityFilterChain, and what should its syntax be?

那么我应该把 bean 定义放在哪里springSecurityFilterChain，它的语法应该是什么？

I think the problem might be that the spring petclinic sample app, which I am using to test this approach, has its own way of using a clinicserviceand its own xml config files to handle application startup and the management of resources. You can view the entire code for the spring petclinic app at this link.

我认为问题可能在于我用来测试这种方法的 spring petclinic 示例应用程序有自己的使用方式clinicservice和自己的 xml 配置文件来处理应用程序启动和资源管理。您可以在此链接查看 spring petclinic 应用程序的完整代码。

The changes I made to the petclinic app are as follows:

我对 petclinic 应用程序所做的更改如下：

I added the following to pom.xml:

我在 pom.xml 中添加了以下内容：

<dependency>
  <groupId>org.springframework.security</groupId>
  <artifactId>spring-security-core</artifactId>
  <version>3.2.2.RELEASE</version>
</dependency>

<dependency>
  <groupId>org.springframework.security</groupId>
  <artifactId>spring-security-web</artifactId>
  <version>3.2.2.RELEASE</version>
</dependency>
<dependency>
  <groupId>org.springframework.security</groupId>
  <artifactId>spring-security-config</artifactId>
  <version>3.2.2.RELEASE</version>
</dependency>  

I added the following to web.xml:

我在 web.xml 中添加了以下内容：

<filter>
    <filter-name>springSecurityFilterChain</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>

<filter-mapping>
  <filter-name>springSecurityFilterChain</filter-name>
  <url-pattern>/*</url-pattern>
</filter-mapping>

I added a package named org.springframework.security.samples.knowledgemanager.configto src/main/javain Java Resources, and then I added the following two classes to it:

我添加了一个名为包org.springframework.security.samples.knowledgemanager.config来src/main/java的Java Resources，然后我增加了以下两类它：

MessageSecurityWebApplicationInitializer.java:

MessageSecurityWebApplicationInitializer.java：

@Order(2)
public class MessageSecurityWebApplicationInitializer extends AbstractSecurityWebApplicationInitializer {}  

SecurityConfig.java:

安全配置.java：

@Configuration
@EnableWebMvcSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private DataSource dataSource;

    @Autowired
    private UserDetailsService myCustomUserDetailsService;

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth
        .jdbcAuthentication()
            .dataSource(dataSource)
            .and()
        .userDetailsService(myCustomUserDetailsService);
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
        .authorizeRequests()
            .antMatchers("/app/**").hasRole("ADMIN")
            .and()
        .formLogin()
            .loginPage("/index.jsp")
            .defaultSuccessUrl("/app/")
            .failureUrl("/index.jsp")
            .permitAll()
            .and()
        .logout()
            .logoutSuccessUrl("/index.jsp");
    }
}

采纳答案by Rob Winch

I get an error indicating that Tomcat 7 will not start because there is a duplicate bean definition for springSecurityFilterChain

我收到一个错误，表明 Tomcat 7 将无法启动，因为 springSecurityFilterChain 有重复的 bean 定义

This is because you should define the springSecurityFilterChain with either (NOT both) the web.xml or a AbstractSecurityWebApplicationInitializer. As you appear to be using Java Configuration, I would remove the web.xml entry.

这是因为您应该使用 web.xml 或 AbstractSecurityWebApplicationInitializer 中的一个（不是两者）定义 springSecurityFilterChain。由于您似乎在使用 Java 配置，因此我将删除 web.xml 条目。

However, when I the comment out the springSecurityFilterChain bean definition in web.xml and try to restart the server, I get a different error message indicating that there is no bean definition for springSecurityFilterChain.

但是，当我注释掉 web.xml 中的 springSecurityFilterChain bean 定义并尝试重新启动服务器时，我收到一条不同的错误消息，表明没有 springSecurityFilterChain 的 bean 定义。

This is because the SecurityConfig needs to be referenced somehow. Typically the easiest way to do this when using Java Configuration is to pass in the configuration to the super class constructor of MessageSecurityWebApplicationInitializer.

这是因为需要以某种方式引用 SecurityConfig。通常，在使用 Java Configuration 时执行此操作的最简单方法是将配置传递给 MessageSecurityWebApplicationInitializer 的超类构造函数。

However, the pet clinic is using XML configuration in the web.xml so you will need to do this by combining Java and XML configurationas outlined in the reference. For this example, you could include the following within src/main/resources/business-config.xml

但是，宠物诊所在 web.xml 中使用 XML 配置，因此您需要通过结合参考中概述的Java 和 XML 配置来完成此操作。对于此示例，您可以在src/main/resources/business-config.xml 中包含以下内容

<bean class="thepackage.SecurityConfig"/>

Naturally, you will need to replace thepackage with the package you are using for SecurityConfig.

当然，您需要用您用于 SecurityConfig 的包替换包。

The reason you can include the configuration in business-config.xml is because this is specified as a contextConfiguration to load in the web.xml. You could also create your own Spring bean XML file, add the SecurityConfig bean as shown above, and ensure to update the web.xml to point to the new Spring bean XML file.

您可以在 business-config.xml 中包含配置的原因是因为它被指定为要加载到 web.xml 中的contextConfiguration。您还可以创建自己的 Spring bean XML 文件，添加如上所示的 SecurityConfig bean，并确保更新 web.xml 以指向新的 Spring bean XML 文件。