Проблема аутентификации после обновления с весенней безопасности 4.0.4 до 4.1.1

Question

Если я обновлю свой spring-security с 4.0.4 до 4.1.1, я не смогу войти в свое приложение. Мне кажется, что он полностью игнорирует мой CustomUserDetailsService. Если я закомментирую свой REST-сервис (/WEB-INF/rest-dispatcher-servlet.xml и /WEB-INF/rest-dispatcher-servlet-security.xml) из web.xml или перейду на 4.0.x, то вход в систему будет работать хорошо.

Мое приложение и сервис REST на основе калитки и весны.

Вот мои конфигурационные файлы.

pom.xml

    <org.springframework.version>4.3.20.RELEASE</org.springframework.version>        
<org.springframework.sec.version>4.0.4.RELEASE</org.springframework.sec.version>
<org.springframework.sec.oauth2.version>2.3.4.RELEASE</org.springframework.sec.oauth2.version>  

...

applicatonContext-security.xml

    <beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xmlns:context="http://www.springframework.org/schema/context"       
       xmlns:sec="http://www.springframework.org/schema/security"
       xsi:schemaLocation="http://www.springframework.org/schema/beans
       http://www.springframework.org/schema/beans/spring-beans-4.3.xsd
       http://www.springframework.org/schema/security
       http://www.springframework.org/schema/security/spring-security.xsd
       http://www.springframework.org/schema/context
       http://www.springframework.org/schema/context/spring-context-4.3.xsd">


    <sec:http create-session="never" auto-config="true" use-expressions="false">       
        <sec:intercept-url pattern="/**"  />        
        <sec:form-login login-page="/login"          
                        login-processing-url="/" />                                
        <sec:csrf disabled="true"/>
        <sec:headers>
            <sec:frame-options policy="SAMEORIGIN"></sec:frame-options>                    
        </sec:headers>
    </sec:http>

    <bean class="org.springframework.security.authentication.encoding.Md5PasswordEncoder" id="passwordEncoder"/>        

    <authentication-manager alias="authenticationManager"  xmlns="http://www.springframework.org/schema/security">
        <authentication-provider  user-service-ref="CustomUserDetailsService">
            <password-encoder ref="passwordEncoder"/>
        </authentication-provider>
    </authentication-manager>

    <bean id="CustomUserDetailsService" class="com.xxx.zzz.services.CustomUserDetailsService">
        <property name="url" value="${jdbc.url}"/>
    </bean>
    <sec:global-method-security pre-post-annotations="enabled" secured-annotations="enabled" jsr250-annotations="enabled"/>
</beans>

rest-dispatcher-servlet-security.xml

        <beans xmlns="http://www.springframework.org/schema/beans"
           xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
           xmlns:context="http://www.springframework.org/schema/context"
           xmlns:oauth="http://www.springframework.org/schema/security/oauth2"
           xmlns:sec="http://www.springframework.org/schema/security"
           xsi:schemaLocation="http://www.springframework.org/schema/beans
           http://www.springframework.org/schema/beans/spring-beans-4.3.xsd
           http://www.springframework.org/schema/security
           http://www.springframework.org/schema/security/spring-security.xsd
           http://www.springframework.org/schema/security/oauth2
           http://www.springframework.org/schema/security/spring-security-oauth2.xsd
           http://www.springframework.org/schema/context
           http://www.springframework.org/schema/context/spring-context-4.3.xsd">



    <http use-expressions="false" pattern="/oauth/token" create-session="stateless" authentication-manager-ref="clientAuthenticationManager"  xmlns="http://www.springframework.org/schema/security">

        <intercept-url pattern="/oauth/token" access="IS_AUTHENTICATED_FULLY"/>
        <anonymous enabled="false"/>
        <http-basic entry-point-ref="clientAuthenticationEntryPoint"/>
        <custom-filter ref="clientCredentialsTokenEndpointFilter" after="BASIC_AUTH_FILTER"/>
        <access-denied-handler ref="oauthAccessDeniedHandler"/>
        <sec:csrf disabled="true"/>
    </http>

    <http use-expressions="false" pattern="/ws/api/**"
          create-session="never"
          entry-point-ref="oauthAuthenticationEntryPoint"
          access-decision-manager-ref="accessDecisionManager"
          xmlns="http://www.springframework.org/schema/security">
        <anonymous enabled="false"/>
        <intercept-url pattern="/ws/api/**"
                       access="ROLE_USER"/>
        <custom-filter ref="resourceServerFilter"
                       before="PRE_AUTH_FILTER"/>
        <access-denied-handler
                ref="oauthAccessDeniedHandler"/>
        <sec:csrf disabled="true"/>
    </http>

    <bean id="oauthAuthenticationEntryPoint"
          class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint">
        <property name="realmName" value="xxx"/>
    </bean>
    <bean id="clientAuthenticationEntryPoint"
          class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint">
        <property name="realmName" value="xxx/client"/>
        <property name="typeName" value="Basic"/>
    </bean>
    <bean id="oauthAccessDeniedHandler"
          class="org.springframework.security.oauth2.provider.error.OAuth2AccessDeniedHandler"/>

    <bean id="clientCredentialsTokenEndpointFilter"
          class="org.springframework.security.oauth2.provider.client.ClientCredentialsTokenEndpointFilter">
        <property name="authenticationManager" ref="clientAuthenticationManager"/>

    </bean>
    <bean id="accessDecisionManager" class="org.springframework.security.access.vote.UnanimousBased"
          xmlns="http://www.springframework.org/schema/beans">
        <constructor-arg>
            <list>
                <bean class="org.springframework.security.oauth2.provider.vote.ScopeVoter"/>
                <bean class="org.springframework.security.access.vote.RoleVoter"/>
                <bean class="org.springframework.security.access.vote.AuthenticatedVoter"/>
            </list>
        </constructor-arg>
    </bean>
    <authentication-manager id="clientAuthenticationManager" xmlns="http://www.springframework.org/schema/security">
        <authentication-provider user-service-ref="clientDetailsUserService"/>      
    </authentication-manager>
    <bean id="clientDetailsUserService"
          class="org.springframework.security.oauth2.provider.client.ClientDetailsUserDetailsService">
        <constructor-arg ref="clientDetails"/>
    </bean>
    <bean id="tokenStore" class="org.springframework.security.oauth2.provider.token.store.InMemoryTokenStore"/>
    <bean id="tokenServices" class="org.springframework.security.oauth2.provider.token.DefaultTokenServices">
        <property name="tokenStore" ref="tokenStore"/>
        <property name="supportRefreshToken" value="true"/>
        <property name="clientDetailsService" ref="clientDetails"/>
        <property name="accessTokenValiditySeconds" value="10"/>
    </bean>
    <bean id="userApprovalHandler"
          class="org.springframework.security.oauth2.provider.approval.TokenStoreUserApprovalHandler">
        <property name="tokenStore" ref="tokenStore"/>    
        <property name="requestFactory" ref="oAuth2RequestFactory"/>    

    </bean>
    <oauth:authorization-server client-details-service-ref="clientDetails" token-services-ref="tokenServices"
                                user-approval-handler-ref="userApprovalHandler" >

        <oauth:authorization-code/>
        <oauth:implicit/>
        <oauth:refresh-token/>
        <oauth:client-credentials/>
        <oauth:password/>

    </oauth:authorization-server>
    <oauth:resource-server id="resourceServerFilter"
                           resource-id="xxx"                      
                           token-services-ref="tokenServices"/>
    <oauth:client-details-service id="clientDetails">
        <oauth:client client-id="client"
                      authorized-grant-types="password,authorization_code,refresh_token,implicit,redirect"
                      authorities="ROLE_USER, ROLE_TRUSTED_USER"
                      redirect-uri="/"
                      scope="read,write,trust"
                      access-token-validity="300"
                      refresh-token-validity="300"/>
    </oauth:client-details-service>

    <bean class="org.springframework.security.oauth2.provider.request.DefaultOAuth2RequestFactory" id="oAuth2RequestFactory">   
        <constructor-arg ref="clientDetails" />     
    </bean>
    </beans>

web.xml

    <?xml version="1.0" encoding="UTF-8"?>
<web-app version="3.0" xmlns="http://java.sun.com/xml/ns/javaee" 
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
         metadata-complete="true" 
>
    <display-name>xxx</display-name>
    <context-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>
            /WEB-INF/applicationContext.xml  
            /WEB-INF/rest-dispatcher-servlet.xml
            /WEB-INF/rest-dispatcher-servlet-security.xml
            /WEB-INF/applicationContext-security.xml                                                             
        </param-value>
    </context-param>


    <listener>
        <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
    </listener>

    <filter>
        <filter-name>springSecurityFilterChain</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    </filter>
    <filter-mapping>
        <filter-name>springSecurityFilterChain</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>


    <filter>
        <filter-name>wicket</filter-name>
        <filter-class>org.apache.wicket.protocol.http.WicketFilter</filter-class>
        <init-param>
            <param-name>ignorePaths</param-name>
            <param-value>/ws</param-value>
        </init-param>
        <init-param>
            <param-name>applicationClassName</param-name>
            <param-value>com.xxx.zzz.main.Application</param-value>
        </init-param>
        <init-param>
            <param-name>configuration</param-name>
            <param-value>development</param-value>
        </init-param>
    </filter>
    <filter>
        <filter-name>SessionFilter</filter-name>
        <filter-class>org.apache.wicket.protocol.http.servlet.WicketSessionFilter</filter-class>        
        <init-param>            
            <param-name>filterName</param-name>
            <param-value>myfilter</param-value>            
        </init-param>
    </filter>
    <filter-mapping>
        <filter-name>wicket</filter-name>
        <url-pattern>/*</url-pattern>
        <dispatcher>REQUEST</dispatcher>
        <dispatcher>ERROR</dispatcher>        
    </filter-mapping>
    <servlet>
        <servlet-name>ws</servlet-name>
        <servlet-class>org.apache.cxf.transport.servlet.CXFServlet</servlet-class>
        <load-on-startup>1</load-on-startup>
    </servlet>
    <servlet-mapping>
        <servlet-name>ws</servlet-name>
        <url-pattern>/ws/*</url-pattern>
    </servlet-mapping>
    <servlet>
        <servlet-name>rest-dispatcher</servlet-name>
        <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
        <load-on-startup>2</load-on-startup>
    </servlet>
    <servlet-mapping>
        <servlet-name>rest-dispatcher</servlet-name>
        <url-pattern>/</url-pattern>
    </servlet-mapping>
    <session-config>
        <session-timeout>15</session-timeout>
    </session-config>
    <absolute-ordering></absolute-ordering>

</web-app>

Answer 1

Наконец я нашел виновника. В applicationContext-security.xml мой менеджер аутентификации имел псевдоним = "authenticationManager" вместо id = "authenticationManager". Когда на рисунке появился rest-dispatcher-servlet-security.xml, он заменил определение в applicationContext-security.xml, однако загрузил его ранее. Так что мне не ясно, но я более чем доволен результатом:).

остальное-диспетчерская-сервлет-security.xml

<authentication-manager id="clientAuthenticationManager" xmlns="http://www.springframework.org/schema/security">
<authentication-provider user-service-ref="clientDetailsUserService"/>        

ApplicationContext-безопасность

<authentication-manager id="authenticationManager"  xmlns="http://www.springframework.org/schema/security">
    <authentication-provider  user-service-ref="CustomUserDetailsService">
        <password-encoder ref="passwordEncoder"/>
    </authentication-provider>
</authentication-manager>