在从 Java 1.6 升级到 Java 1.8 之前，我们能够登录 Web 应用程序。 升级后，我们无法登录其中一个 Web 应用程序，但我可以登录另一个。他们使用相同的 Spring-Security、OJDBC 和 Hibernate 版本。

但是，如果我们从类路径中删除了以下 jar，只要您不需要使用钱包登录，登录就会再次生效:

• com.oracle:oraclepki (12.1.0.2.0)
• com.oracle:osdt_cert (12.1.0.2.0)
• com.oracle:osdt_core (12.1.0.2.0)

在上层环境中删除这些不是一个选项，因为我们使用 oracle wallets 登录。

版本:

• OJDBC6 12.1.0.2.0
• SPRINGFRAMEWORK 3.0.7.RELEASE

调试日志

当我将日志级别设置为 DEBUG 时，我看到作为 anonomys 用户的登录被拒绝，但在之前的日志中它成功地验证了登录名/密码。

认证成功:

DEBUG [org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter][http-bio-8080-exec-10] - Authentication success. Updating SecurityContextHolder to contain: org.springframework.security.authentication.UsernamePasswordAuthenticationToken@85ca488a: Principal: org.springframework.security.core.userdetails.User@f75cc3bd: Username: admin; Password: [PROTECTED]; Enabled: true; AccountNonExpired: true; credentialsNonExpired: true; AccountNonLocked: true; Granted Authorities: ADMIN,READ_ONLY; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@2cd90: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: 383A7E52904236DDEA18E00864C0B94C; Granted Authorities: ADMIN, READ_ONLY
DEBUG [org.springframework.security.web.context.HttpSessionSecurityContextRepository][http-bio-8080-exec-10] - SecurityContext stored to HttpSession: 'org.springframework.security.core.context.SecurityContextImpl@85ca488a: Authentication: org.springframework.security.authentication.UsernamePasswordAuthenticationToken@85ca488a: Principal: org.springframework.security.core.userdetails.User@f75cc3bd: Username: admin; Password: [PROTECTED]; Enabled: true; AccountNonExpired: true; credentialsNonExpired: true; AccountNonLocked: true; Granted Authorities: ADMIN,READ_ONLY; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@2cd90: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: 383A7E52904236DDEA18E00864C0B94C; Granted Authorities: ADMIN, READ_ONLY'

然后拒绝访问:

DEBUG [org.springframework.security.access.vote.AffirmativeBased][http-bio-8080-exec-5] - Voter: org.springframework.security.web.access.expression.WebExpressionVoter@259af14a, returned: -1
DEBUG [org.springframework.security.web.access.ExceptionTranslationFilter][http-bio-8080-exec-5] - Access is denied (user is anonymous); redirecting to authentication entry point

完整堆栈跟踪:

DEBUG [org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter][http-bio-8080-exec-10] - Authentication success. Updating SecurityContextHolder to contain: org.springframework.security.authentication.UsernamePasswordAuthenticationToken@85ca488a: Principal: org.springframework.security.core.userdetails.User@f75cc3bd: Username: admin; Password: [PROTECTED]; Enabled: true; AccountNonExpired: true; credentialsNonExpired: true; AccountNonLocked: true; Granted Authorities: ADMIN,READ_ONLY; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@2cd90: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: 383A7E52904236DDEA18E00864C0B94C; Granted Authorities: ADMIN, READ_ONLY
DEBUG [org.springframework.security.web.context.HttpSessionSecurityContextRepository][http-bio-8080-exec-10] - SecurityContext stored to HttpSession: 'org.springframework.security.core.context.SecurityContextImpl@85ca488a: Authentication: org.springframework.security.authentication.UsernamePasswordAuthenticationToken@85ca488a: Principal: org.springframework.security.core.userdetails.User@f75cc3bd: Username: admin; Password: [PROTECTED]; Enabled: true; AccountNonExpired: true; credentialsNonExpired: true; AccountNonLocked: true; Granted Authorities: ADMIN,READ_ONLY; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@2cd90: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: 383A7E52904236DDEA18E00864C0B94C; Granted Authorities: ADMIN, READ_ONLY'
DEBUG [org.springframework.security.web.context.SecurityContextPersistenceFilter][http-bio-8080-exec-10] - SecurityContextHolder now cleared, as request processing completed
DEBUG [org.springframework.security.web.context.HttpSessionSecurityContextRepository][http-bio-8080-exec-8] - No HttpSession currently exists
DEBUG [org.springframework.security.web.context.HttpSessionSecurityContextRepository][http-bio-8080-exec-8] - No SecurityContext was available from the HttpSession: null. A new one will be created.
DEBUG [org.springframework.security.web.authentication.AnonymousAuthenticationFilter][http-bio-8080-exec-8] - Populated SecurityContextHolder with anonymous token: 'org.springframework.security.authentication.AnonymousAuthenticationToken@9055c2bc: Principal: anonymousUser; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@b364: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: null; Granted Authorities: ROLE_ANONYMOUS'
DEBUG [org.springframework.security.web.access.intercept.FilterSecurityInterceptor][http-bio-8080-exec-5] - Secure object: FilterInvocation: URL: /canary/dashboard.action; Attributes: [hasAnyRole('READ_ONLY','READ_ONLY2','STATISTICS','ADMIN')]
DEBUG [org.springframework.security.web.access.intercept.FilterSecurityInterceptor][http-bio-8080-exec-5] - Previously Authenticated: org.springframework.security.authentication.AnonymousAuthenticationToken@9055c2bc: Principal: anonymousUser; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@b364: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: null; Granted Authorities: ROLE_ANONYMOUS
DEBUG [org.springframework.security.access.vote.AffirmativeBased][http-bio-8080-exec-5] - Voter: org.springframework.security.web.access.expression.WebExpressionVoter@259af14a, returned: -1
DEBUG [org.springframework.security.web.access.ExceptionTranslationFilter][http-bio-8080-exec-5] - Access is denied (user is anonymous); redirecting to authentication entry point
org.springframework.security.access.AccessDeniedException: Access is denied
    at org.springframework.security.access.vote.AffirmativeBased.decide(AffirmativeBased.java:71)
    at org.springframework.security.access.intercept.AbstractSecurityInterceptor.beforeInvocation(AbstractSecurityInterceptor.java:204)
    at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.invoke(FilterSecurityInterceptor.java:106)
    at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.doFilter(FilterSecurityInterceptor.java:83)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:381)
    at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:97)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:381)
    at org.springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.java:100)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:381)
    at org.springframework.security.web.authentication.AnonymousAuthenticationFilter.doFilter(AnonymousAuthenticationFilter.java:78)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:381)
    at org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter.doFilter(SecurityContextHolderAwareRequestFilter.java:54)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:381)
    at org.springframework.security.web.savedrequest.RequestCacheAwareFilter.doFilter(RequestCacheAwareFilter.java:35)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:381)
    at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:187)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:381)
    at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:105)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:381)
    at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:79)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:381)
    at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:168)
    at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:237)
    at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:167)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
    at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:220)
    at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:122)
    at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:505)
    at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:169)
    at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103)
    at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:956)
    at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116)
    at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:436)
    at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1078)
    at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:625)
    at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:318)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
    at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
    at java.lang.Thread.run(Thread.java:748)

安全上下文:

<security:authentication-manager alias="authenticationManager">
    <security:authentication-provider user-service-ref="userDetailsService"/>
    <security:authentication-provider ref="ldapProvider"/>
</security:authentication-manager>

<bean id="userDetailsService" class="*******.CustomUserDetailsService">
    <property name="userDetailsService" ref="userDetailsService"/>
    <property name="dataSource" ref="dataSource"/>
    <property name="annotatedSessionFactory" ref="sessionFactory"></property>
</bean>

<bean id="ldapProvider" class="org.springframework.security.ldap.authentication.LdapAuthenticationProvider">
    <constructor-arg ref="authenticator"/>
    <constructor-arg ref="ldapAuthPopulator"/>
</bean>

最佳答案

Spring 3.x 不兼容java 8，最好升级到4.x。

鉴于您在 java 升级时遇到问题(例如，您这边没有更改代码)，这只是确认存在版本不兼容。

取决于您自定义拦截器的重量，它可能是中等努力或根本没有努力(我记得从 spring 3.0.x 到 3.1.x 在 xml 配置中声明匿名资源时有微小的向后兼容性中断，但是所有 java 接口(interface)保持向后兼容)

关于java - 当 oraclepki、osdt_cert 和 osdt_core 在类路径上时，从 Jav 6 升级到 Java 8 后无法登录 Web 应用程序，我们在Stack Overflow上找到一个类似的问题： https://stackoverflow.com/questions/49576172/