spring security 권한 문제 입니다.ㅠㅠ

Question

처음 해보는거라 인터넷을 찾아가면서 해보았지만 잘 안되서 문의 한번 올려 봅니다 ㅠㅠ로그인시 ROLE_USER 등급은 저장 된거 같은데 페이지를 이동하면 ROLE_ANONYMOUS로 변경 됩니다.도와주시면 정말 감사 하겠습니다 ㅠㅠ

org.springframework.security.web.session.HttpSessionEventPublisher

10

springSecurityFilterChain

org.springframework.web.filter.DelegatingFilterProxy

springSecurityFilterChain

/*

@Repository public class CustomAuthenticationProvider implements AuthenticationProvider { @Override public boolean supports(Class authentication) { return authentication.equals(UsernamePasswordAuthenticationToken.class); } @Override public Authentication authenticate(Authentication authentication) throws AuthenticationException { String userName = (String)authentication.getPrincipal(); String userPassword = (String)authentication.getCredentials(); //boolean checkPassword = false; boolean checkPassword = true; try { checkPassword = loginUserService.selectPass(userName, userPassword); } catch (Exception e) { } if (checkPassword) { System.out.println(">>> authenticate 인증성공"); String encodedPassword = new BCryptPasswordEncoder().encode(userPassword); List roles = new ArrayList(); roles.add(new SimpleGrantedAuthority("ROLE_USER")); UsernamePasswordAuthenticationToken result = new UsernamePasswordAuthenticationToken(userName, encodedPassword, roles); result.setDetails(new CustomUserDetails(userName, userPassword)); return result; } else { System.out.println(">>> authenticate 인증실패"); throw new BadCredentialsException("Bad credentials"); } } } public class LoginSuccessHandler extends SavedRequestAwareAuthenticationSuccessHandler { private static final Logger logger = LoggerFactory.getLogger(LoginSuccessHandler.class); @Override public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication auth) throws IOException, ServletException { System.out.println(">>> onAuthenticationSuccess"); HttpSession session = request.getSession(); String accept = request.getHeader("accept"); if( StringUtils.indexOf(accept, "html") > -1 ) { System.out.println(">>> LoginSuccessHandler onAuthenticationSuccess html"); super.onAuthenticationSuccess(request, response, auth); } else if( StringUtils.indexOf(accept, "xml") > -1 ) { System.out.println(">>> LoginSuccessHandler onAuthenticationSuccess xml"); response.setContentType("application/xml"); response.setCharacterEncoding("utf-8"); String data = StringUtils.join(new String[] { "" , "" , "false" , "로그인하였습니다.", "" }); PrintWriter out = response.getWriter(); out.print(data); out.flush(); out.close(); } else if( StringUtils.indexOf(accept, "json") > -1 ) { System.out.println(">>> LoginSuccessHandler onAuthenticationSuccess json"); response.setContentType("application/json"); response.setCharacterEncoding("utf-8"); String data = StringUtils.join(new String[] { " { \"response\" : {", " \"error\" : false , " , " \"message\" : \"로그인하였습니다.\" ", "} } " }); PrintWriter out = response.getWriter(); out.print(data); out.flush(); out.close(); } } }log 11:30:14.089 [http-bio-8080-exec-1] DEBUG o.s.s.w.c.SecurityContextPersistenceFilter - SecurityContextHolder now cleared, as request processing completed >>> authenticate hashedPassword:$2a$10$9MTOXnmaRswf0F.m7mVkO.7NmHkEcYNh38IwUQo9JkZeJ/KH6l9Ti 11:30:14.274 [http-bio-8080-exec-10] DEBUG o.s.b.f.s.DefaultListableBeanFactory - Returning cached instance of singleton bean 'sqlSessionFactory' 11:30:14.275 [http-bio-8080-exec-10] DEBUG o.s.s.w.a.s.CompositeSessionAuthenticationStrategy - Delegating to org.springframework.security.web.authentication.session.SessionFixationProtectionStrategy@430f4c09 11:30:14.275 [http-bio-8080-exec-10] DEBUG o.s.s.w.a.s.SessionFixationProtectionStrategy - Invalidating session with Id '9EE6668CA6F0D4B0A2CFF38893490528' and migrating attributes. 11:30:14.275 [http-bio-8080-exec-10] DEBUG o.s.s.w.s.HttpSessionEventPublisher - Publishing event: org.springframework.security.web.session.HttpSessionDestroyedEvent[source=org.apache.catalina.session.StandardSessionFacade@309331dc] 11:30:14.276 [http-bio-8080-exec-10] DEBUG o.s.b.f.s.DefaultListableBeanFactory - Returning cached instance of singleton bean 'sqlSessionFactory' 11:30:14.276 [http-bio-8080-exec-10] DEBUG o.s.s.w.s.HttpSessionEventPublisher - Publishing event: org.springframework.security.web.session.HttpSessionCreatedEvent[source=org.apache.catalina.session.StandardSessionFacade@40f8c46e] 11:30:14.276 [http-bio-8080-exec-10] DEBUG o.s.s.w.a.s.SessionFixationProtectionStrategy - Started new session: EF87D360BB9EC27112C94CA57C914660 11:30:14.277 [http-bio-8080-exec-10] DEBUG o.s.b.f.s.DefaultListableBeanFactory - Returning cached instance of singleton bean 'sqlSessionFactory' 11:30:14.277 [http-bio-8080-exec-10] DEBUG o.s.s.w.a.UsernamePasswordAuthenticationFilter - Authentication success. Updating SecurityContextHolder to contain: org.springframework.security.authentication.UsernamePasswordAuthenticationToken@672cafbe: Principal: a; Credentials: [PROTECTED]; Authenticated: true; Details: kr.co.netpoint.vo.CustomUserDetails@2331adef; Granted Authorities: ROLE_USER 11:30:14.278 [http-bio-8080-exec-10] DEBUG o.s.b.f.s.DefaultListableBeanFactory - Returning cached instance of singleton bean 'sqlSessionFactory' >>> onAuthenticationSuccess >>> LoginSuccessHandler onAuthenticationSuccess json 11:30:14.286 [http-bio-8080-exec-10] DEBUG o.s.s.w.c.HttpSessionSecurityContextRepository - SecurityContext stored to HttpSession: 'org.springframework.security.core.context.SecurityContextImpl@672cafbe: Authentication: org.springframework.security.authentication.UsernamePasswordAuthenticationToken@672cafbe: Principal: a; Credentials: [PROTECTED]; Authenticated: true; Details: kr.co.netpoint.vo.CustomUserDetails@2331adef; Granted Authorities: ROLE_USER' 11:30:14.286 [http-bio-8080-exec-10] DEBUG o.s.s.w.c.HttpSessionSecurityContextRepository - SecurityContext stored to HttpSession: 'org.springframework.security.core.context.SecurityContextImpl@672cafbe: Authentication: org.springframework.security.authentication.UsernamePasswordAuthenticationToken@672cafbe: Principal: a; Credentials: [PROTECTED]; Authenticated: true; Details: kr.co.netpoint.vo.CustomUserDetails@2331adef; Granted Authorities: ROLE_USER' 11:30:14.286 [http-bio-8080-exec-10] DEBUG o.s.s.w.c.SecurityContextPersistenceFilter - SecurityContextHolder now cleared, as request processing completed 11:30:14.343 [http-bio-8080-exec-1] DEBUG o.s.s.w.u.m.AntPathRequestMatcher - Checking match of request : '/favicon.ico'; against '/cint/*' 11:30:14.343 [http-bio-8080-exec-1] DEBUG o.s.s.w.u.m.AntPathRequestMatcher - Checking match of request : '/favicon.ico'; against '/resources/**/*' 11:30:14.343 [http-bio-8080-exec-1] DEBUG o.s.s.w.u.m.AntPathRequestMatcher - Checking match of request : '/favicon.ico'; against '/resources/**/**/*' 11:30:14.343 [http-bio-8080-exec-1] DEBUG o.s.security.web.FilterChainProxy - /favicon.ico at position 1 of 11 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter' 11:30:14.343 [http-bio-8080-exec-1] DEBUG o.s.s.w.c.HttpSessionSecurityContextRepository - No HttpSession currently exists 11:30:14.343 [http-bio-8080-exec-1] DEBUG o.s.s.w.c.HttpSessionSecurityContextRepository - No SecurityContext was available from the HttpSession: null. A new one will be created. 11:30:14.343 [http-bio-8080-exec-1] DEBUG o.s.security.web.FilterChainProxy - /favicon.ico at position 2 of 11 in additional filter chain; firing Filter: 'WebAsyncManagerIntegrationFilter' 11:30:14.343 [http-bio-8080-exec-1] DEBUG o.s.security.web.FilterChainProxy - /favicon.ico at position 3 of 11 in additional filter chain; firing Filter: 'LogoutFilter' 11:30:14.343 [http-bio-8080-exec-1] DEBUG o.s.security.web.FilterChainProxy - /favicon.ico at position 4 of 11 in additional filter chain; firing Filter: 'UsernamePasswordAuthenticationFilter' 11:30:14.343 [http-bio-8080-exec-1] DEBUG o.s.security.web.FilterChainProxy - /favicon.ico at position 5 of 11 in additional filter chain; firing Filter: 'BasicAuthenticationFilter' 11:30:14.343 [http-bio-8080-exec-1] DEBUG o.s.security.web.FilterChainProxy - /favicon.ico at position 6 of 11 in additional filter chain; firing Filter: 'RequestCacheAwareFilter' 11:30:14.343 [http-bio-8080-exec-1] DEBUG o.s.security.web.FilterChainProxy - /favicon.ico at position 7 of 11 in additional filter chain; firing Filter: 'SecurityContextHolderAwareRequestFilter' 11:30:14.343 [http-bio-8080-exec-1] DEBUG o.s.security.web.FilterChainProxy - /favicon.ico at position 8 of 11 in additional filter chain; firing Filter: 'AnonymousAuthenticationFilter' 11:30:14.343 [http-bio-8080-exec-1] DEBUG o.s.s.w.a.AnonymousAuthenticationFilter - Populated SecurityContextHolder with anonymous token: 'org.springframework.security.authentication.AnonymousAuthenticationToken@9055c2bc: Principal: anonymousUser; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@b364: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: null; Granted Authorities: ROLE_ANONYMOUS' 11:30:14.343 [http-bio-8080-exec-1] DEBUG o.s.security.web.FilterChainProxy - /favicon.ico at position 9 of 11 in additional filter chain; firing Filter: 'SessionManagementFilter' 11:30:14.344 [http-bio-8080-exec-1] DEBUG o.s.s.w.s.SessionManagementFilter - Requested session ID 9EE6668CA6F0D4B0A2CFF38893490528 is invalid. 11:30:14.344 [http-bio-8080-exec-1] DEBUG o.s.security.web.FilterChainProxy - /favicon.ico at position 10 of 11 in additional filter chain; firing Filter: 'ExceptionTranslationFilter' 11:30:14.344 [http-bio-8080-exec-1] DEBUG o.s.security.web.FilterChainProxy - /favicon.ico at position 11 of 11 in additional filter chain; firing Filter: 'FilterSecurityInterceptor' 11:30:14.344 [http-bio-8080-exec-1] DEBUG o.s.s.w.u.m.AntPathRequestMatcher - Checking match of request : '/favicon.ico'; against '/' 11:30:14.344 [http-bio-8080-exec-1] DEBUG o.s.s.w.u.m.AntPathRequestMatcher - Checking match of request : '/favicon.ico'; against '/main' 11:30:14.344 [http-bio-8080-exec-1] DEBUG o.s.s.w.u.m.AntPathRequestMatcher - Checking match of request : '/favicon.ico'; against '/main/*' 11:30:14.344 [http-bio-8080-exec-1] DEBUG o.s.s.w.u.m.AntPathRequestMatcher - Checking match of request : '/favicon.ico'; against '/denied' 11:30:14.344 [http-bio-8080-exec-1] DEBUG o.s.s.w.u.m.AntPathRequestMatcher - Checking match of request : '/favicon.ico'; against '/authfail' 11:30:14.344 [http-bio-8080-exec-1] DEBUG o.s.s.w.u.m.AntPathRequestMatcher - Checking match of request : '/favicon.ico'; against '/popup/*/**' 11:30:14.344 [http-bio-8080-exec-1] DEBUG o.s.s.w.u.m.AntPathRequestMatcher - Checking match of request : '/favicon.ico'; against '/login/*' 11:30:14.349 [http-bio-8080-exec-1] DEBUG o.s.s.w.u.m.AntPathRequestMatcher - Checking match of request : '/favicon.ico'; against '/login/*/**' 11:30:14.349 [http-bio-8080-exec-1] DEBUG o.s.s.w.u.m.AntPathRequestMatcher - Checking match of request : '/favicon.ico'; against '/*' 11:30:14.349 [http-bio-8080-exec-1] DEBUG o.s.s.w.a.i.FilterSecurityInterceptor - Secure object: FilterInvocation: URL: /favicon.ico; Attributes: [hasAnyRole('ROLE_ADMIN','ROLE_USER','ROLE_GUEST')] 11:30:14.349 [http-bio-8080-exec-1] DEBUG o.s.s.w.a.i.FilterSecurityInterceptor - Previously Authenticated: org.springframework.security.authentication.AnonymousAuthenticationToken@9055c2bc: Principal: anonymousUser; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@b364: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: null; Granted Authorities: ROLE_ANONYMOUS 11:30:14.350 [http-bio-8080-exec-1] DEBUG o.s.s.access.vote.AffirmativeBased - Voter: org.springframework.security.web.access.expression.WebExpressionVoter@1b1a24eb, returned: -1 11:30:14.351 [http-bio-8080-exec-1] DEBUG o.s.s.w.a.ExceptionTranslationFilter - Access is denied (user is anonymous); redirecting to authentication entry point org.springframework.security.access.AccessDeniedException: Access is denied

우띠 · Answer

result(Token) 리턴 하시기전에SecurityContextHolder.getContext().setAuthentication(result);추가해보세요~UsernamePasswordAuthenticationToken result &#61; new UsernamePasswordAuthenticationToken(userName, encodedPassword, roles); result.setDetails(new CustomUserDetails(userName, userPassword)); return result;

spring security 권한 문제 입니다.ㅠㅠ

1개의 답변

Q&A 목록