403访问每次都拒绝Spring Security

Question

我在每个有模式/管理员的请求上得到403我需要限制/管理员只有管理员角色。

失败的方法：

1. 尝试在控制器上使用@PreAuthorize(hasRole('ADMIN'))和@PreAuthorize(hasRole('ROLE_ADMIN'))，但没有运气。
2. 尝试从控制器中删除@PreAuthorize并使用hasRole在下面的类中添加模式但没有运气

下面是类扩展WebSecurityConfigurerAdapter

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter{

    @Autowired
    AuthenticationEntryPoint authenticationEntryPoint;

    @Override
    protected void configure(HttpSecurity httpSecurity) throws Exception {
        httpSecurity
            .exceptionHandling()
                .authenticationEntryPoint(authenticationEntryPoint)
                .and()
            .sessionManagement()
                .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                .and()
            .authorizeRequests()

                .antMatchers(HttpMethod.OPTIONS).permitAll()
              .antMatchers(HttpMethod.GET,"/admin/**").hasAnyRole("ADMIN","ADMIN_TENANT")
                .anyRequest().authenticated()
                .and()
            .logout()
                .permitAll()
                .and()
            .csrf()
                .disable();
        httpSecurity.
            addFilterBefore(authenticationTokenFilterBean(), UsernamePasswordAuthenticationFilter.class);

        httpSecurity.
            headers().cacheControl().disable();
    }

已经尝试过类似问题中提到的解决方案，但没有运气。所以请不要将其标记为重复。

Answer 1

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter{

    @Autowired
    AuthenticationEntryPoint authenticationEntryPoint;

    @Override
    protected void configure(HttpSecurity httpSecurity) throws Exception {
        httpSecurity
            .exceptionHandling()
                .authenticationEntryPoint(authenticationEntryPoint)
                .and()
            .sessionManagement()
                .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                .and()
            .authorizeRequests()

                .antMatchers(HttpMethod.OPTIONS).permitAll()
              .antMatchers(HttpMethod.GET,"/admin/**").hasAnyRole("ADMIN","ADMIN_TENANT") // change hasAnyrole to hasAnyAuthority
                .anyRequest().authenticated()
                .and()
            .logout()
                .permitAll()
                .and()
            .csrf()
                .disable();
        httpSecurity.
            addFilterBefore(authenticationTokenFilterBean(), UsernamePasswordAuthenticationFilter.class);

        httpSecurity.
            headers().cacheControl().disable();
    }

Answer 2

我类似的Git项目：here

    // Config to check if already active
    http.authorizeRequests()
    .and() 
    .rememberMe()
    .tokenRepository(new JdbcTokenRepositoryImpl().setDataSource(//datasource_name) )
     .tokenValiditySeconds(//TimeInterval in sec); 

}