虽然角色正确提供了弹簧安全授权

http.authorizeRequests().antMatchers("/dms**").access("hasAnyRole('admin','dms')");

用户应该具有admin或dms角色导航到该页面。我以管理员身份登录。虽然角色正确提供了弹簧安全授权

从日志中我可以看到角色的匹配正确（数据库角色和登录的用户角色）

Granted Authorities: admin

但我仍然可以看到访问被拒绝。任何线索？这里完整的日志

2016-11-10 16:41:46 DEBUG AntPathRequestMatcher:157 - Checking match of 
request : '/dms.jsp'; against '/dms**' 
2016-11-10 16:41:46 DEBUG FilterSecurityInterceptor:219 - Secure object: FilterInvocation: URL: /dms.jsp; Attributes: [hasAnyRole('admin','dms')] 
2016-11-10 16:41:46 DEBUG FilterSecurityInterceptor:348 - Previously Authenticated: org.springframew[email protected]9546: Principal: [email protected]: Username: admin; Password: [PROTECTED]; Enabled: true; AccountNonExpired: true; credentialsNonExpired: true; AccountNonLocked: true; Granted Authorities: admin; Credentials: [PROTECTED]; Authenticated: true; Details: org.sprin[email protected]ffff6a82: RemoteIpAddress: 127.0.0.1; SessionId: LVXYO0lvcLRvJFcH9pJO_kO2R5B7ha4LLm3DwZ7m; Granted Authorities: admin 
2016-11-10 16:41:46 DEBUG AffirmativeBased:66 - Voter: org.sp[email protected]7ade02ad, returned: -1 
2016-11-10 16:41:46 DEBUG ExceptionTranslationFilter:186 - Access is denied (user is not anonymous); delegating to AccessDeniedHandler 
org.springframework.security.access.AccessDeniedException: Access is denied 
    at org.springframework.security.access.vote.AffirmativeBased.decide(AffirmativeBased.java:84)

来源

2016-11-10 user2555212

只是前缀“ROLE_”的可用角色解决了这个问题。不知道为什么春天不允许自己的角色

来源

2016-11-10 12:17:08 user2555212

虽然角色正确提供了弹簧安全授权

回答

相关问题