Spring Security 2.0.2升级至3.2.9配置问题求助

我将Spring Security从2.0.2版本升级至3.2.9版本后，更新了security-sso-beans.xml配置，但出现访问拒绝错误以及Bean创建的JSON错误，配置代码如下：

<sec:http pattern="/webcontent/**" security="none"/>
<sec:http pattern="/redirect.jsp" security="none"/>
       
<sec:http entry-point-ref="entryPoint" use-expressions="true" auto-config="true">
           <sec:access-denied-handler error-page="/denied.atps"/>
           <sec:intercept-url pattern="/home.atps" access="hasRole('ROLE_SUBMITTER,ROLE_FINANCE_DIRECTOR,ROLE_INVOICE_POINT_APPROVER,ROLE_REGIONAL_DIRECTOR,ROLE_TP_REVIEWER,ROLE_INVOICE_POINT,ROLE_TECH_OPS,ROLE_MARKET, ROLE_ADMIN, ROLE_CAA,ROLE_OPEL_APPROVER')"/>
           <sec:intercept-url pattern="/myrole.atps" access="hasRole('ROLE_SUBMITTER,ROLE_FINANCE_DIRECTOR,ROLE_INVOICE_POINT_APPROVER,ROLE_REGIONAL_DIRECTOR,ROLE_TP_REVIEWER,ROLE_INVOICE_POINT,ROLE_TECH_OPS,ROLE_MARKET,ROLE_OPEL_APPROVER')" />
           <sec:intercept-url pattern="/f1/*.atps" access="hasRole('ROLE_SUBMITTER,ROLE_FINANCE_DIRECTOR,ROLE_INVOICE_POINT_APPROVER,ROLE_REGIONAL_DIRECTOR,ROLE_TP_REVIEWER,ROLE_ADMIN, ROLE_CAA,ROLE_OPEL_APPROVER')" />
           <sec:intercept-url pattern="/grid.atps" access="hasRole('ROLE_SUBMITTER,ROLE_FINANCE_DIRECTOR,ROLE_INVOICE_POINT_APPROVER,ROLE_REGIONAL_DIRECTOR,ROLE_TP_REVIEWER,ROLE_INVOICE_POINT,ROLE_TECH_OPS,ROLE_MARKET,ROLE_OPEL_APPROVER')" />
           <sec:intercept-url pattern="/admin.atps" access="hasRole('ROLE_ADMIN, ROLE_CAA')" />
           <sec:intercept-url pattern="/adminGrid/*.atps" access="hasRole('ROLE_ADMIN, ROLE_CAA')" />
           <sec:intercept-url pattern="/form/handledraft.atps" access="hasRole('ROLE_SUBMITTER,ROLE_TP_REVIEWER')" />
           <sec:intercept-url pattern="/form/handleTPRequest.atps" access="hasRole('ROLE_SUBMITTER,ROLE_TP_REVIEWER')" />
           <sec:intercept-url pattern="/form/handleDistributorRequest.atps" access="hasRole('ROLE_SUBMITTER,ROLE_TP_REVIEWER')" />
           <sec:intercept-url pattern="/userreport.atps" access="hasRole('ROLE_ADMIN, ROLE_CAA')" />
           <sec:intercept-url pattern="/caa.atps" access="hasRole('ROLE_CAA')" />
           <sec:custom-filter position="PRE_AUTH_FILTER" ref="authFilter" />
           <sec:session-management>
               <sec:concurrency-control max-sessions="1"/>
           </sec:session-management>
           <sec:logout/>
</sec:http>

配置中的核心问题及修正方案 #

1. hasRole表达式语法错误（直接导致访问拒绝+Bean解析错误） #

Spring Security 3.x中，hasRole()方法仅支持单个角色参数，多角色场景必须使用hasAnyRole()方法，且每个角色需单独用引号分隔。当前写法将多个角色塞进一个hasRole()参数中，会触发SpEL表达式解析失败，进而引发Bean创建异常，同时权限判断逻辑失效导致访问拒绝。

错误示例：

<sec:intercept-url pattern="/home.atps" access="hasRole('ROLE_SUBMITTER,ROLE_FINANCE_DIRECTOR,...')"/>

修正后：

<sec:intercept-url pattern="/home.atps" access="hasAnyRole('ROLE_SUBMITTER','ROLE_FINANCE_DIRECTOR','ROLE_INVOICE_POINT_APPROVER','ROLE_REGIONAL_DIRECTOR','ROLE_TP_REVIEWER','ROLE_INVOICE_POINT','ROLE_TECH_OPS','ROLE_MARKET','ROLE_ADMIN','ROLE_CAA','ROLE_OPEL_APPROVER')"/>

所有包含多角色的hasRole都需替换为hasAnyRole，并拆分每个角色参数。

2. auto-config="true"与自定义预认证过滤器冲突 #

启用auto-config="true"会自动配置Spring Security默认过滤器链（如表单登录、Basic认证等），但同时自定义PRE_AUTH_FILTER会导致过滤器链顺序混乱或重复配置，引发Bean创建异常。

如果是SSO预认证场景，建议关闭auto-config，手动配置必要组件：

<sec:http entry-point-ref="entryPoint" use-expressions="true" auto-config="false">

3. 可选优化：Session并发控制完整性 #

Spring Security 3.2中，concurrency-control未指定session-registry-ref时会自动创建默认SessionRegistry，但显式配置可提升会话管理的稳定性：

<sec:session-management>
    <sec:concurrency-control max-sessions="1" session-registry-ref="sessionRegistry"/>
</sec:session-management>

<!-- 显式声明SessionRegistry Bean -->
<bean id="sessionRegistry" class="org.springframework.security.core.session.SessionRegistryImpl"/>

修正后的完整配置示例 #

<sec:http pattern="/webcontent/**" security="none"/>
<sec:http pattern="/redirect.jsp" security="none"/>
       
<sec:http entry-point-ref="entryPoint" use-expressions="true" auto-config="false">
    <sec:access-denied-handler error-page="/denied.atps"/>
    <sec:intercept-url pattern="/home.atps" access="hasAnyRole('ROLE_SUBMITTER','ROLE_FINANCE_DIRECTOR','ROLE_INVOICE_POINT_APPROVER','ROLE_REGIONAL_DIRECTOR','ROLE_TP_REVIEWER','ROLE_INVOICE_POINT','ROLE_TECH_OPS','ROLE_MARKET','ROLE_ADMIN','ROLE_CAA','ROLE_OPEL_APPROVER')"/>
    <sec:intercept-url pattern="/myrole.atps" access="hasAnyRole('ROLE_SUBMITTER','ROLE_FINANCE_DIRECTOR','ROLE_INVOICE_POINT_APPROVER','ROLE_REGIONAL_DIRECTOR','ROLE_TP_REVIEWER','ROLE_INVOICE_POINT','ROLE_TECH_OPS','ROLE_MARKET','ROLE_OPEL_APPROVER')" />
    <sec:intercept-url pattern="/f1/*.atps" access="hasAnyRole('ROLE_SUBMITTER','ROLE_FINANCE_DIRECTOR','ROLE_INVOICE_POINT_APPROVER','ROLE_REGIONAL_DIRECTOR','ROLE_TP_REVIEWER','ROLE_ADMIN','ROLE_CAA','ROLE_OPEL_APPROVER')" />
    <sec:intercept-url pattern="/grid.atps" access="hasAnyRole('ROLE_SUBMITTER','ROLE_FINANCE_DIRECTOR','ROLE_INVOICE_POINT_APPROVER','ROLE_REGIONAL_DIRECTOR','ROLE_TP_REVIEWER','ROLE_INVOICE_POINT','ROLE_TECH_OPS','ROLE_MARKET','ROLE_OPEL_APPROVER')" />
    <sec:intercept-url pattern="/admin.atps" access="hasAnyRole('ROLE_ADMIN','ROLE_CAA')" />
    <sec:intercept-url pattern="/adminGrid/*.atps" access="hasAnyRole('ROLE_ADMIN','ROLE_CAA')" />
    <sec:intercept-url pattern="/form/handledraft.atps" access="hasAnyRole('ROLE_SUBMITTER','ROLE_TP_REVIEWER')" />
    <sec:intercept-url pattern="/form/handleTPRequest.atps" access="hasAnyRole('ROLE_SUBMITTER','ROLE_TP_REVIEWER')" />
    <sec:intercept-url pattern="/form/handleDistributorRequest.atps" access="hasAnyRole('ROLE_SUBMITTER','ROLE_TP_REVIEWER')" />
    <sec:intercept-url pattern="/userreport.atps" access="hasAnyRole('ROLE_ADMIN','ROLE_CAA')" />
    <sec:intercept-url pattern="/caa.atps" access="hasRole('ROLE_CAA')" />
    <sec:custom-filter position="PRE_AUTH_FILTER" ref="authFilter" />
    <sec:session-management>
        <sec:concurrency-control max-sessions="1" session-registry-ref="sessionRegistry"/>
    </sec:session-management>
    <sec:logout/>
</sec:http>

<bean id="sessionRegistry" class="org.springframework.security.core.session.SessionRegistryImpl"/>

内容的提问来源于stack exchange，提问作者user2859273