Spring Security XML Config与Java Config

我已经通过大量指南完成了Spring Security的XML配置.
它应该拦截URL,并使用自定义过滤器通过ldap身份验证管理器提供身份验证.

所以这里是：
    

   <http create-session="stateless" auto-config='false' use-expressions="true">
    <anonymous enabled="true"/>
    <intercept-url pattern="/index.html" access="permitAll()" method="GET"/>
    <intercept-url pattern="/login" access="permitAll()" method="GET"/>


    <custom-filter before="LAST" ref="statelessLoginFilter"/>
    <custom-filter before="PRE_AUTH_FILTER" ref="statelessAuthFilter"/>

    <intercept-url pattern="/one*" access="hasRole('ROLE_ONE')" method="GET"/>
    <intercept-url pattern="/two*" access="hasRole('ROLE_TWO')" method="GET"/>

    <!-- another intercept-url stuff -->

    <csrf disabled="true"/>

    <!-- authentication manager and stuff -->
</http>

现在,我正在尝试使用Java Config重写它.但是我无法在其中使用自定义过滤器.有一个.addFilterBefore,但我不能只是放在=“ LAST”之前或=“ =” PRE_AUTH_FILTER“之前.因为没有这样的事情.我该如何重写？

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

@Autowired
GenericFilterBean statelessAuthFilter;
@Autowired
AbstractAuthenticationProcessingFilter statelessLoginFilter;

public  SecurityConfig(){

}

@Override
protected void configure(HttpSecurity http) throws Exception {
    http
            .authorizeRequests()
            .antMatchers("/one**", "/two**").access("hasRole('ONE')")
            .antMatchers("/login").permitAll()
            .anyRequest().authenticated()

            .and()
            .addFilterBefore(statelessAuthFilter, GenericFilterBean.class)
            .addFilterBefore(statelessLoginFilter, BasicAuthenticationFilter.class)
            .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)

            .and().anonymous()
            .and().csrf().disable();
}}

解决方法:

您必须确定特定的过滤器类.

例如,默认的LAST过滤器应为FilterSecurityInterceptor-Filter Ordering.

PRE_AUTH_FILTER可以是扩展AbstractPreAuthenticatedProcessingFilter的任何内容,具体取决于您配置的内容.

基本上,Java Config会强制您在订购时保持明确,以避免以后出现令人讨厌的意外情况.