Spring security3.1 AccessDeniedException抛出的时候，指定的拒否画面无法跳转

0 0

Spring security3.1 AccessDeniedException抛出的时候，指定的拒否画面无法跳转10

配置如下： spring-security.xml

<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security"
	xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd  
                        http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.1.xsd">

	<http use-expressions="true" auto-config="true">
		<intercept-url pattern="/login.jsp" access="permitAll" />
		<intercept-url pattern="/accessDenied.jsp" access="permitAll"/>
		<form-login login-page="/login.jsp" default-target-url="/menu/init"
			always-use-default-target="true" authentication-failure-url="/login.jsp?login_error=1" />
		<logout invalidate-session="true" logout-success-url="/login.jsp"
			logout-url="/j_spring_security_logout" />
		<access-denied-handler error-page="/accessDenied.jsp"/>
		<!-- 实现免登陆验证 -->
		<remember-me />
		<session-management invalid-session-url="/timeout.jsp"
			session-fixation-protection="none">
			<concurrency-control max-sessions="1"
				error-if-maximum-exceeded="true" />
		</session-management>
		<custom-filter ref="myFilter" before="FILTER_SECURITY_INTERCEPTOR" />
	</http>
	<beans:bean id="myFilter" class="argo.cost.common.security.MySecurityFilter">
		<!-- 用户拥有的权限 -->
		<beans:property name="authenticationManager" ref="myAuthenticationManager" />
		<!-- 用户是否拥有所请求资源的权限 -->
		<beans:property name="accessDecisionManager" ref="myAccessDecisionManager" />
		<!-- 资源与权限对应关系 -->
		<beans:property name="securityMetadataSource" ref="mySecurityMetadataSource" />
	</beans:bean>
	<!-- UserDetailsServiceBean -->
	<authentication-manager alias="myAuthenticationManager">
		<authentication-provider user-service-ref="myUserDetailServiceImpl" />
	</authentication-manager>
	<beans:bean id="myAccessDecisionManager"
		class="argo.cost.common.security.MyAccessDecisionManager"></beans:bean>
	<beans:bean id="mySecurityMetadataSource"
		class="argo.cost.common.security.MySecurityMetadataSource">
		<beans:constructor-arg name="resourcesDao" ref="resourcesDao"></beans:constructor-arg>
	</beans:bean>
	<beans:bean id="myUserDetailServiceImpl"
		class="argo.cost.common.security.MyUserDetailServiceImpl">
		<beans:property name="usersDao" ref="usersDao"></beans:property>
		<beans:property name="resourcesDao" ref="resourcesDao"></beans:property>
	</beans:bean>
	<beans:bean id="resourcesDao" class="argo.cost.common.dao.ResourcesDaoImpl"></beans:bean>
	<beans:bean id="usersDao" class="argo.cost.common.dao.UsersDaoImpl"></beans:bean>
</beans:beans>

package argo.cost.common.security;

import java.util.Collection;
import java.util.Iterator;

import org.springframework.security.access.AccessDecisionManager;
import org.springframework.security.access.AccessDeniedException;
import org.springframework.security.access.ConfigAttribute;
import org.springframework.security.authentication.InsufficientAuthenticationException;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.GrantedAuthority;

/**
 * <p>
 * 権限判定。
 * </p>
 * 
 * @author COST argo Corporation.
 */
public class MyAccessDecisionManager implements AccessDecisionManager {

	public void decide(Authentication authentication, Object object,
			Collection<ConfigAttribute> configAttributes)
			throws AccessDeniedException, InsufficientAuthenticationException {
		if (configAttributes == null) {
			return;
		}
	
		Iterator<ConfigAttribute> iterator = configAttributes.iterator();
		while (iterator.hasNext()) {
			ConfigAttribute configAttribute = iterator.next();

			
			String needPermission = configAttribute.getAttribute();
			System.out.println("needPermission is " + needPermission);

			
			for (GrantedAuthority ga : authentication.getAuthorities()) {
				if (needPermission.equals(ga.getAuthority())) {
					return;
				}
			}
		}
		
		throw new AccessDeniedException("无权访问！ ");
	}

	public boolean supports(ConfigAttribute attribute) {
		// TODO Auto-generated method stub
		return true;
	}

	public boolean supports(Class<?> clazz) {
		// TODO Auto-generated method stub
		return true;
	}

}

当用户权限判定无权限，AccessDeniedException("无权访问！ ");抛出后，没有跳转到指定的（/accessDenied.jsp），直接跳转到了HTTP403画面。

求解。