Весенняя безопасность - аутентификация перестает работать через несколько дней - требуется перезагрузка

Question

У меня есть приложение, разработанное на Spring 4.1.4 и Spring Security 4.0.2, развернутое на сервере с Apache Tomcat 8 и JDK 1.7. Бывает, что через несколько дней некоторые пользователи не могут войти в систему, даже если они задают правильную комбинацию пользователей и паролей. Перезагрузка Tomcat устраняет проблему.

Любое предложение? Может быть, это проблема, связанная с сессией?

Это моя конфигурация безопасности

<beans:beans xmlns="http://www.springframework.org/schema/security" 
xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
xmlns:jee="http://www.springframework.org/schema/jee" 
xsi:schemaLocation=" 
    http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd 
    http://www.springframework.org/schema/jee http://www.springframework.org/schema/jee/spring-jee-3.0.xsd 
    http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-4.0.xsd 
"> 

<http auto-config="true" use-expressions="true"> 
    <custom-filter after="EXCEPTION_TRANSLATION_FILTER" ref="ajaxTimeoutRedirectFilter"/> 

    <custom-filter position="SWITCH_USER_FILTER" ref="switchUserProcessingFilter" /> 
    <intercept-url pattern="/j_spring_security_switch_user" access="hasRole('ROLE_SUPERVISOR')"/> 

    <session-management invalid-session-url="/login.html?invalidSession=1" session-fixation-protection="newSession"> 
     <concurrency-control max-sessions="10" error-if-maximum-exceeded="true" /> 
    </session-management> 

    <intercept-url pattern="/login.html" access="hasRole('ROLE_ANONYMOUS')" requires-channel="https"/> 
    <intercept-url pattern="/resources/**" access="permitAll" requires-channel="any"/> 
    <intercept-url pattern="/admin**" access="hasRole('ROLE_ADMIN')" requires-channel="https"/> 
    <intercept-url pattern="/rest/**" access="hasRole('ROLE_USER')" requires-channel="https"/> 
    <intercept-url pattern="/index" access="hasRole('ROLE_USER')" requires-channel="https"/> 
    <intercept-url pattern="/upload/**" access="hasRole('ROLE_USER')" requires-channel="https"/> 

    <headers> 
     <xss-protection block="false"/> 
     <frame-options disabled="true"/> 
     <cache-control/> 
    </headers> 

    <!-- access denied page --> 
    <access-denied-handler error-page="/403" /> 
    <form-login 
     login-page="/login.html" 
     default-target-url="/index" 
     always-use-default-target="true" 
     authentication-failure-url="/login.html?error=1" 
     username-parameter="username" 
     password-parameter="password"/> 
    <logout logout-success-url="/login.html?logout=1" invalidate-session="false" delete-cookies="JSESSIONID"/> 
    <!-- enable csrf protection --> 
    <!-- <csrf disabled="true" /> --> 

    <port-mappings> 
     <port-mapping http="8080" https="8443"/> 
    </port-mappings> 
</http> 

<beans:bean id="ajaxTimeoutRedirectFilter" class="com.finconsgroup.mens.springsecurity.AjaxTimeoutRedirectFilter"> 
    <beans:property name="customSessionExpiredErrorCode" value="419"/> 
</beans:bean> 

<beans:bean id="switchUserProcessingFilter" class="com.finconsgroup.mens.springsecurity.MensSwitchUserFilter"> 
    <beans:property name="userDetailsService" ref="mensAuthenticationService"/> 
    <beans:property name="switchUserUrl" value="/j_spring_security_switch_user"/> 
    <beans:property name="exitUserUrl" value="/j_spring_security_exit_user"/> 
    <beans:property name="targetUrl" value="/index"/> 
</beans:bean> 

<beans:bean name="bcryptEncoder" class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder"/> 
<!-- Select users and user_roles from database --> 
<authentication-manager alias="authenticationManager"> 
    <authentication-provider user-service-ref="mensAuthenticationService"> 
     <password-encoder ref="bcryptEncoder"/> 
    </authentication-provider> 
</authentication-manager> 
<beans:bean id="mensAuthenticationService" class="com.finconsgroup.mens.springsecurity.MensAuthenticationProvider"> 
    <beans:property name="dataSource" ref="mensDataSource"/> 
    <beans:property name="usersByUsernameQuery" value="my_query"/> 
    <beans:property name="authoritiesByUsernameQuery" value="my_query"/> 
    <beans:property name="groupAuthoritiesByUsernameQuery" value="my_query"/> 
    <beans:property name="enableGroups" value="true"/> 
</beans:bean> 

<!-- Spring Security --> 

<beans:bean id="mensPermissionEvaluator" class="com.finconsgroup.mens.springsecurity.MensPermissionEvaluator"> 
    <beans:constructor-arg ref="aclService"/> 
</beans:bean> 

<beans:bean id="securityExpressionHandler" 
     class="org.springframework.security.access.expression.method.DefaultMethodSecurityExpressionHandler"> 
    <beans:property name="permissionEvaluator" ref="mensPermissionEvaluator"/> 
</beans:bean> 

<global-method-security 
    authentication-manager-ref="authenticationManager" 
    pre-post-annotations="enabled" 
    secured-annotations="enabled"> 
    <expression-handler ref="securityExpressionHandler"/> 
</global-method-security> 

<!-- ================================================================== --> 
<!-- ACL service              --> 
<!-- ================================================================== --> 

<beans:bean id="aclService" class="org.springframework.security.acls.jdbc.JdbcMutableAclService"> 
    <beans:constructor-arg ref="mensDataSource" /> 
    <beans:constructor-arg ref="lookupStrategy" /> 
    <beans:constructor-arg ref="aclCache" /> 
</beans:bean> 

<beans:bean id="aclCache" class="org.springframework.security.acls.domain.EhCacheBasedAclCache"> 
    <beans:constructor-arg> 
     <beans:bean class="org.springframework.cache.ehcache.EhCacheFactoryBean"> 
      <beans:property name="cacheManager"> 
       <beans:ref bean="mensEhCacheManager"/> 
      </beans:property> 
      <beans:property name="cacheName" value="aclCache"/> 
     </beans:bean> 
    </beans:constructor-arg> 
    <beans:constructor-arg> 
     <beans:bean class="org.springframework.security.acls.domain.DefaultPermissionGrantingStrategy"> 
      <beans:constructor-arg> 
       <beans:bean class="org.springframework.security.acls.domain.ConsoleAuditLogger"/> 
      </beans:constructor-arg> 
     </beans:bean> 
    </beans:constructor-arg> 
    <beans:constructor-arg> 
     <beans:bean class="org.springframework.security.acls.domain.AclAuthorizationStrategyImpl"> 
      <beans:constructor-arg> 
       <beans:list> 
        <beans:bean class="org.springframework.security.core.authority.SimpleGrantedAuthority"> 
         <beans:constructor-arg value="ROLE_ACL_ADMIN"/> 
        </beans:bean> 
       </beans:list> 
      </beans:constructor-arg> 
     </beans:bean> 
    </beans:constructor-arg> 
</beans:bean> 

<beans:bean id="lookupStrategy" class="org.springframework.security.acls.jdbc.BasicLookupStrategy"> 
    <beans:constructor-arg ref="mensDataSource" /> 
    <beans:constructor-arg ref="aclCache" /> 
    <beans:constructor-arg> 
     <!-- Decides whether current principal can make ACL changes. See 
      AclAuthorizationStrategyImpl Javadoc for the rules involved. --> 
     <beans:bean class="org.springframework.security.acls.domain.AclAuthorizationStrategyImpl"> 
      <beans:constructor-arg> 
       <beans:list> 
        <!-- Role required to change ACL ownership --> 
        <beans:ref bean="adminRole" /> 
        <!-- Role required to change auditing details --> 
        <beans:ref bean="adminRole" /> 
        <!-- Role required to change other ACL/ACE details --> 
        <beans:ref bean="adminRole" /> 
       </beans:list> 
      </beans:constructor-arg> 
     </beans:bean> 
    </beans:constructor-arg> 
    <beans:constructor-arg> 
     <beans:bean class="org.springframework.security.acls.domain.ConsoleAuditLogger" /> 
    </beans:constructor-arg> 
</beans:bean> 

<beans:bean id="adminRole" class="org.springframework.security.core.authority.SimpleGrantedAuthority"> 
    <beans:constructor-arg value="ADMIN" /> 
</beans:bean> 

Заранее спасибо за вашу помощь!

Answer 1

Я исправил проблему с изменением атрибута защиты сеанса-фиксации на migrateSession. Теперь мне не нужно периодически перезапускать Tomcat.