봄 보안 기능을 사용하여 역할 기반 액세스를 API로 올바르게 제한하는 방법은 무엇입니까?

Question

사용자 역할을 기반으로 API를 보호하려고하지만 @PreAuthorize 주석이 제대로 작동하지 않는 것 같습니다. 사용자가 어떤 역할을 수행하든간에 서버는 403 오류를 발생시킵니다. 이 작품을 만드는 방법? 에 따르면

@Configuration 
@EnableWebSecurity 
@EnableGlobalMethodSecurity(prePostEnabled = true) 
@Order(SecurityProperties.ACCESS_OVERRIDE_ORDER) 
public class SecurityConfig extends WebSecurityConfigurerAdapter { 

    @Autowired 
    private DatabaseAuthenticationProvider authenticationProvider; 

    @Override 
    public void configure(WebSecurity web) throws Exception { 
     web.ignoring().antMatchers("/js/**", "/css/**", "/img/**"); 
    } 

    @Override 
    protected void configure(HttpSecurity http) throws Exception { 
     http.formLogin().loginPage("/login").failureUrl("/login").defaultSuccessUrl("/") 
       .and().logout().logoutSuccessUrl("/login") 
       .and().authorizeRequests().antMatchers("/login").permitAll() 
       /*.antMatchers("/settings.html").access("hasRole('HR')") 
       .antMatchers("/pendingRequests.html").access("hasRole('MANAGER')") 
       .antMatchers("/settings.html","/pendingRequests.html").access("hasRole('ADMIN')")*/ 
       .anyRequest().authenticated().and().csrf().disable(); 
    } 



    @Autowired 
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception { 
     auth.authenticationProvider(authenticationProvider).eraseCredentials(false); 
    } 
} 

Answer 1

:

@PreAuthorize("hasRole('ROLE_HR')") //I don't have acces even if I am HR 
@RestController 
public class SettingsController { 

    @Autowired 
    private LocationRepository locationRepository; 
    @Autowired 
    private DepartmentRepository departmentRepository; 
    @Autowired 
    private RoleRepository roleRepository; 

    @RequestMapping(value = "/api/locations", method = RequestMethod.POST) 
    public ResponseEntity addLocation(@RequestBody Location location) { 
     if (location == null) { 
      return new ResponseEntity(HttpStatus.BAD_REQUEST); 
     } 
     locationRepository.save(new Location(location.getName())); 
     return new ResponseEntity(HttpStatus.CREATED); 
    } 

    @RequestMapping(value = "/api/roles", method = RequestMethod.POST) 
    public ResponseEntity addRole(@RequestBody Role role) { 
     if (role == null) { 
      return new ResponseEntity(HttpStatus.BAD_REQUEST); 
     } 
     roleRepository.save(new Role(role.getName())); 
     return new ResponseEntity(HttpStatus.CREATED); 
    } 

    @RequestMapping(value = "/api/departments", method = RequestMethod.POST) 
    public ResponseEntity addDepartment(@RequestBody Department department) { 
     if (department == null) { 
      return new ResponseEntity(HttpStatus.BAD_REQUEST); 
     } 
     departmentRepository.save(new Department(department.getName())); 
     return new ResponseEntity(HttpStatus.CREATED); 
    } 
} 

그리고 보안 설정 :

@Override 
    protected UserDetails retrieveUser(String userName, UsernamePasswordAuthenticationToken usernamePasswordAuthenticationToken){ 
     final String password = (String) usernamePasswordAuthenticationToken.getCredentials(); 

     if (!StringUtils.hasText(password)) { 
      this.logger.warn("Username {}: no password provided", userName); 
     } 

     userName = parseCredentials(userName); 

     try { 
      DirContext ctx = ldapConfiguration.openConnection(userName, password); 
      ctx.close(); 
     } catch (NamingException e) { 
      throw new LdapException("User not found in Active Directory", e); 
     } catch (NullPointerException e) { 
      throw new CredentialsNotProvidedException("Entered data may be null", e); 
     } 

     User user = userRepository.findOneByLogin(userName); 

     if (user == null) { 
      this.logger.warn("Username {}: user not found", userName); 
      throw new BadCredentialsException("Invalid Username/Password for user " + userName); 
     } 

     final List<GrantedAuthority> auths = new ArrayList<GrantedAuthority>(); 

     GrantedAuthority r = (GrantedAuthority)() -> "ROLE_" + user.getRole().getName().toUpperCase(); 
     auths.add(r); 
     // enabled, account not expired, credentials not expired, account not locked 
     UserDetails userDetails = new org.springframework.security.core.userdetails.User(userName, password, true, true, true, true, auths); 
     return userDetails; 
    } 

이것은 컨트롤러 : 내 사용자 지정 인증 공급자에서 사용자 정보를 검색 할 경우

이

입니다 보안 구성 클래스의 주석 처리 된 행 .antMatchers("/settings.html").access("hasRole('HR')") 사용자 역할은 HR입니다. 역할은 다음 HR 경우

당신은 @PreAuthorize("hasRole('HR')")

사용해야하며 @PreAuthorize 먼저 배치해야하고 사전 승인이 작동하지 않으면 다음 @RestController

@RestController 
@PreAuthorize("hasRole('HR')") 
public class SettingsController