Spring Security Config Error while server startup

问题

If I keep remember-me element in security.xml file and startup a server then I got following error.

No UserDetailsService registered.......

If I remove this remember-me element then it works fine.

How to get rid of this error...

<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security"
    xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns:p="http://www.springframework.org/schema/p"
    xsi:schemaLocation="http://www.springframework.org/schema/beans 
        http://www.springframework.org/schema/beans/spring-beans-3.0.xsd 
    http://www.springframework.org/schema/security 
    http://www.springframework.org/schema/security/spring-security-3.0.xsd">

    <http auto-config="false" use-expressions="true"
        access-denied-page="/login.jsp?error=true" entry-point-ref="authenticationEntryPoint">
        <remember-me key="abcdefgh" />
        <logout invalidate-session="true" />
        <intercept-url pattern="/login.jsp" access="permitAll" />
        <intercept-url pattern="/index.jsp" access="permitAll" />
        <intercept-url pattern="/pub" access="isAuthenticated()" />
        <intercept-url pattern="/*" access="permitAll" />
        <custom-filter ref="authenticationFilter" position="FORM_LOGIN_FILTER" />
    </http>

    <beans:bean id="authenticationFilter"
        class="org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter"
        p:authenticationManager-ref="customAuthenticationManager"
        p:authenticationFailureHandler-ref="customAuthenticationFailureHandler"
        p:authenticationSuccessHandler-ref="customAuthenticationSuccessHandler" />

    <!-- Custom authentication manager. In order to authenticate, username and 
        password must not be the same -->
    <beans:bean id="customAuthenticationManager" class="com.cv.pub.cmgt.framework.security.CustomAuthenticationManager" />

    <!-- We just actually need to set the default failure url here -->
    <beans:bean id="customAuthenticationFailureHandler"
        class="org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler"
        p:defaultFailureUrl="/login.jsp?error=true" />

    <!-- We just actually need to set the default target url here -->
    <beans:bean id="customAuthenticationSuccessHandler"
        class="org.springframework.security.web.authentication.SimpleUrlAuthenticationSuccessHandler"
        p:defaultTargetUrl="/pub" />

    <!-- The AuthenticationEntryPoint is responsible for redirecting the user 
        to a particular page, like a login page, whenever the server sends back a 
        response requiring authentication -->
    <!-- See Spring-Security Reference 5.4.1 for more info -->
    <beans:bean id="authenticationEntryPoint"
        class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint"
        p:loginFormUrl="/login.jsp" />

    <!-- The tag below has no use but Spring Security needs it to autowire the 
        parent property of org.springframework.security.authentication.ProviderManager. 
        Otherwise we get an error A probable bug. This is still under investigation -->
    <authentication-manager />

</beans:beans>

回答1:

Spring Security's provided RememberMeServices requires a UserDetailsService in order to work. This means you have two options:

1) If possible, I recommend this as your best option. Instead of writing a custom AuthenticationProvider, write a custom UserDetailsService. You can find an example UserDetailsService looking at InMemoryDaoImpl You can then wire it similar to the configuration below. Note you would remove your custom AuthenticationManager too.

<http ..>
  ...
  <remember-me key="abcdefgh" />
</http>
<authentication-manager>
  <authentication-provider user-service-ref="myUserService"/>
</authentication-manager>
<beans:bean id="myUserService" class="MyUserService"/>

2) Write your own RememberMeServices implementation that does not require a UserDetailsService. You can take a look at TokenBasedRememberMeServices for an example (but it requires UserDetailsService). If you want to use the namespace configuration your RememberMeServices implementation will need to implement LogoutHandler. You can then use the namespace to wire it.

<http ..>
  ...
  <remember-me ref="myRememberMeServices"/>
</http>
<beans:bean id="myRememberMeServices" class="sample.MyRememberMeServices"/>

来源：https://stackoverflow.com/questions/8734484/spring-security-config-error-while-server-startup

标签

spring-security