ACL自定义基本权限问题

Question

添加自定义权限时出现错误。下面是代码和异常。

自定义基本权限类：

 public class CustomBasePermission  extends BasePermission {

        public static final Permission RUN = new CustomBasePermission(32, 'E');
        protected CustomBasePermission(int mask) {
            super(mask);
        }

        protected CustomBasePermission(int mask, char code) {
            super(mask, code);
        }
    }

Acl上下文，我在其中配置了我的customBasePermission Bean：

    @Configuration
    @EnableAutoConfiguration
    public class ACLContext {
   //--------------
     @Bean
        public PermissionFactory permissionFactory() {
            return new DefaultPermissionFactory(CustomBasePermission.class);
        }
    //-----------------
    }

接口类似于下面我使用自定义权限的位置：

public interface MyService{
     @PreAuthorize("hasPermission(#pipelineDef, 'run')")
        public ResponseEntity<ApiResponse> myServiceMethod(PipelineDef pipelineDef);
}

一旦执行并尝试访问我的服务，就会出现如下异常：

2019-01-28 17:59:19 - Servlet.service() for servlet [dispatcherServlet] in context with path [] threw exception [Request processing failed; nested exception is java.lang.IllegalArgumentException: Unknown permission 'RUN'] with root cause
java.lang.IllegalArgumentException: Unknown permission 'RUN'
    at org.springframework.security.acls.domain.DefaultPermissionFactory.buildFromName(DefaultPermissionFactory.java:148)
    at org.springframework.security.acls.AclPermissionEvaluator.resolvePermission(AclPermissionEvaluator.java:150)
    at org.springframework.security.acls.AclPermissionEvaluator.checkPermission(AclPermissionEvaluator.java:92)
    at org.springframework.security.acls.AclPermissionEvaluator.hasPermission(AclPermissionEvaluator.java:77)
    at org.springframework.security.access.expression.SecurityExpressionRoot.hasPermission(SecurityExpressionRoot.java:177)
    at sun.reflect.GeneratedMethodAccessor169.invoke(Unknown Source)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:498)
    at org.springframework.expression.spel.support.ReflectiveMethodExecutor.execute(ReflectiveMethodExecutor.java:130)
    at org.springframework.expression.spel.ast.MethodReference.getValueInternal(MethodReference.java:138)
    at org.springframework.expression.spel.ast.MethodReference.getValueInternal(MethodReference.java:94)
    at org.springframework.expression.spel.ast.SpelNodeImpl.getTypedValue(SpelNodeImpl.java:116)
    at org.springframework.expression.spel.standard.SpelExpression.getValue(SpelExpression.java:300)
    at org.springframework.security.access.expression.ExpressionUtils.evaluateAsBoolean(ExpressionUtils.java:26)
    at org.springframework.security.access.expression.method.ExpressionBasedPreInvocationAdvice.before(ExpressionBasedPreInvocationAdvice.java:59)
    at org.springframework.security.access.prepost.PreInvocationAuthorizationAdviceVoter.vote(PreInvocationAuthorizationAdviceVoter.java:72)
    at org.springframework.security.access.prepost.PreInvocationAuthorizationAdviceVoter.vote(PreInvocationAuthorizationAdviceVoter.java:40)
    at org.springframework.security.access.vote.AffirmativeBased.decide(AffirmativeBased.java:63)
    at org.springframework.security.access.intercept.AbstractSecurityInterceptor.beforeInvocation(AbstractSecurityInterceptor.java:233)
    at org.springframework.security.access.intercept.aopalliance.MethodSecurityInterceptor.invoke(MethodSecurityInterceptor.java:65)
    at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:186)
    at org.springframework.aop.framework.CglibAopProxy$DynamicAdvisedInterceptor.intercept(CglibAopProxy.java:688)
    at com.itcinfotech.zicos.pipeline.serviceimpl.PipeLineServiceImpl$$EnhancerBySpringCGLIB$$2ed86a92.runStageViewPipeLine(<generated>)
    at com.itcinfotech.zicos.pipeline.controller.PipeLineController.runPipeLine(PipeLineController.java:93)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:498)
    at org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:189)
    at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:138)
    at org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:102)
    at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandlerMethod(RequestMappingHandlerAdapter.java:895)
    at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:800)
    at org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:87)
    at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:1038)
    at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:942)
    at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:1005)
    at org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java:897)
    at javax.servlet.http.HttpServlet.service(HttpServlet.java:634)
    at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:882)
    at javax.servlet.http.HttpServlet.service(HttpServlet.java:741)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:231)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
    at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:53)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
    at org.springframework.security.web.session.ConcurrentSessionFilter.doFilter(ConcurrentSessionFilter.java:155)
    at com.itcinfotech.zicos.core.CustomConcurrentSessionFilter.doFilter(CustomConcurrentSessionFilter.java:26)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)

Answer 1

[Hi @Nagaraju，我在应用程序中实施ACL时遇到了相同的错误。我确实通过将CustomBasePermission添加到defaultMethodSecurityExpressionHandler()和lookupStrategy()中来解决此问题，如下面所述的代码

@Configuration
@EnableAutoConfiguration
public class AclContext {

  @Autowired
  private DataSource dataSource;

  @Bean
  public EhCacheBasedAclCache aclCache() {
    return new EhCacheBasedAclCache(
        aclEhCacheFactoryBean().getObject(), permissionGrantingStrategy(),
        aclAuthorizationStrategy());
  }

  @Bean
  public EhCacheFactoryBean aclEhCacheFactoryBean() {
    EhCacheFactoryBean ehCacheFactoryBean = new EhCacheFactoryBean();
    ehCacheFactoryBean.setCacheManager(aclCacheManager().getObject());
    ehCacheFactoryBean.setCacheName("aclCache");
    return ehCacheFactoryBean;
  }

  @Bean
  public EhCacheManagerFactoryBean aclCacheManager() {
    EhCacheManagerFactoryBean factoryBean = new EhCacheManagerFactoryBean();
    factoryBean.setShared(true);
    return factoryBean;
  }

  @Bean
  public PermissionGrantingStrategy permissionGrantingStrategy() {
    return new DefaultPermissionGrantingStrategy(new ConsoleAuditLogger());
  }

  @Bean
  public PermissionFactory permissionFactory() {
    return new CustomPermissionFactory();
  }

  @Bean
  public AclAuthorizationStrategy aclAuthorizationStrategy() {
    return new AclAuthorizationStrategyImpl(new SimpleGrantedAuthority("ROLE_ADMIN"));
  }

  @Bean
  public MethodSecurityExpressionHandler defaultMethodSecurityExpressionHandler() {
    DefaultMethodSecurityExpressionHandler expressionHandler = new DefaultMethodSecurityExpressionHandler();
    AclPermissionEvaluator permissionEvaluator = new AclPermissionEvaluator(aclService());
    permissionEvaluator.setPermissionFactory(permissionFactory());
    expressionHandler.setPermissionEvaluator(permissionEvaluator);
    expressionHandler.setPermissionCacheOptimizer(new AclPermissionCacheOptimizer(aclService()));
    return expressionHandler;
  }

  @Bean
  public LookupStrategy lookupStrategy() {
    BasicLookupStrategy lookupStrategy = new BasicLookupStrategy(
        dataSource,
        aclCache(),
        aclAuthorizationStrategy(),
        new ConsoleAuditLogger());
    lookupStrategy.setPermissionFactory(permissionFactory());
    return lookupStrategy;
  }

  @Bean
  public JdbcMutableAclService aclService() {
    JdbcMutableAclService aclService = new JdbcMutableAclService(dataSource, lookupStrategy(), aclCache());
    return aclService;
  }
}