union-ark-web 1.0.1

package/ark-web/src/main/resources/application.yml

@@ -0,0 +1,23 @@
+server:
+  port: ${SERVER_PORT:8080}
+  address: ${SERVER_ADDRESS:127.0.0.1}
+
+arkshiro:
+  sso: false
+
+agent:
+  py-app-base-url: ${PY_APP_BASE_URL:http://127.0.0.1:8083}
+  local-user-id: ${LOCAL_USER_ID:user-1}
+  local-password: ${LOCAL_PASSWORD:local-only}
+  local-org-code: ${LOCAL_ORG_CODE:104100000004}
+  local-authorized-role-id: ${LOCAL_AUTHORIZED_ROLE_ID:role-1}
+
+dubbo:
+  application:
+    name: ark-web
+  registry:
+    address: ${DUBBO_REGISTRY_ADDRESS:zookeeper://127.0.0.1:2181}
+  consumer:
+    check: ${DUBBO_CONSUMER_CHECK:false}
+    direct-url: ${DUBBO_DIRECT_URL:}
+    timeout-ms: ${DUBBO_CONSUMER_TIMEOUT_MS:10000}

package/ark-web/src/main/resources/dubbo-consumer.xml

@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<beans xmlns="http://www.springframework.org/schema/beans"
+       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+       xmlns:dubbo="http://code.alibabatech.com/schema/dubbo"
+       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
+                           http://code.alibabatech.com/schema/dubbo http://code.alibabatech.com/schema/dubbo/dubbo.xsd">
+    <dubbo:application name="${dubbo.application.name}"/>
+    <dubbo:registry address="${dubbo.registry.address}"/>
+    <dubbo:consumer timeout="${dubbo.consumer.timeout-ms}" retries="0"/>
+
+    <dubbo:reference id="agentExecutionService" interface="com.union.control.service.AgentExecutionService" check="${dubbo.consumer.check}" url="${dubbo.consumer.direct-url}"/>
+    <dubbo:reference id="agentProxyService" interface="com.union.control.service.AgentProxyService" check="${dubbo.consumer.check}" url="${dubbo.consumer.direct-url}" timeout="#{T(java.lang.Math).ceil(${AGENT_MAX_RUN_SECONDS:900} * 1000)}"/>
+    <dubbo:reference id="conversationService" interface="com.union.control.service.ConversationService" check="${dubbo.consumer.check}" url="${dubbo.consumer.direct-url}"/>
+    <dubbo:reference id="memoryStoreService" interface="com.union.control.service.MemoryStoreService" check="${dubbo.consumer.check}" url="${dubbo.consumer.direct-url}"/>
+    <dubbo:reference id="runningAnalysisMockService" interface="com.union.control.service.RunningAnalysisMockService" check="${dubbo.consumer.check}" url="${dubbo.consumer.direct-url}"/>
+    <dubbo:reference id="scheduledTaskService" interface="com.union.control.service.ScheduledTaskService" check="${dubbo.consumer.check}" url="${dubbo.consumer.direct-url}"/>
+    <dubbo:reference id="sensitiveDataDemoService" interface="com.union.control.service.SensitiveDataDemoService" check="${dubbo.consumer.check}" url="${dubbo.consumer.direct-url}"/>
+    <dubbo:reference id="sensitiveRevealService" interface="com.union.control.service.sensitive.SensitiveRevealService" check="${dubbo.consumer.check}" url="${dubbo.consumer.direct-url}"/>
+</beans>

package/ark-web/src/production-overlay/java/com/epcc/arkweb/config/CasShiroConfig.java

@@ -0,0 +1,229 @@
+package com.epcc.arkweb.config;
+
+import com.epcc.arkweb.service.redis.ShiroSessionRedisDao;
+import com.epcc.arkweb.service.shirosession.ShiroSessionListener;
+import com.epcc.baseservice.dal.service.UnifyRedisService;
+import org.apache.shiro.authc.pam.FirstSuccessfulStrategy;
+import org.apache.shiro.authc.pam.ModularRealmAuthenticator;
+import org.apache.shiro.cas.CasFilter;
+import org.apache.shiro.cas.CasRealm;
+import org.apache.shiro.cas.CasSubjectFactory;
+import org.apache.shiro.mgt.SecurityManager;
+import org.apache.shiro.mgt.SessionsSecurityManager;
+import org.apache.shiro.session.SessionListener;
+import org.apache.shiro.spring.LifecycleBeanPostProcessor;
+import org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor;
+import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
+import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
+import org.apache.shiro.web.servlet.SimpleCookie;
+import org.apache.shiro.web.session.mgt.DefaultWebSessionManager;
+import org.jasig.cas.client.session.SingleSignOutFilter;
+import org.jasig.cas.client.session.SingleSignOutHttpSessionListener;
+import org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
+import org.springframework.boot.context.properties.ConfigurationProperties;
+import org.springframework.boot.web.servlet.FilterRegistrationBean;
+import org.springframework.boot.web.servlet.ServletListenerRegistrationBean;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.context.annotation.DependsOn;
+import org.springframework.core.Ordered;
+import org.springframework.core.annotation.Order;
+import org.springframework.web.filter.DelegatingFilterProxy;
+
+import javax.servlet.Filter;
+import java.util.*;
+
+/***
+ * @auther: suwen
+ * @date: 17:58 2021/2/26
+ */
+@Configuration
+@ConfigurationProperties(prefix = "cas")
+@ConditionalOnProperty(prefix = "arkshiro", name = "sso",havingValue = "true")
+public class CasShiroConfig {
+
+    @Value("${cas.casServerUrlPrefix}")
+    public String casServerUrlPrefix;
+
+    @Value("${cookie.secure:false}")
+    private String cookieSecure;
+
+    @Value("${cas.casLoginUrl}")
+    public String casLoginUrl;
+
+    @Value("${cas.casLogoutUrl}")
+    public String casLogoutUrl;
+
+    @Value("${cas.shiroServerUrlPrefix}")
+    public String shiroServerUrlPrefix;
+
+    @Value("${cas.casFilterUrlPattern}")
+    public String casFilterUrlPattern;
+
+    @Value("${cas.loginUrl}")
+    public String loginUrl;
+
+    @Value("${cas.logoutUrl}")
+    public String logoutUrl;
+
+    public static final String loginSuccessUrl = "/index.html";
+
+    public static final String unauthorizedUrl = "/403.html";
+
+    /*@Bean
+    public SessionsSecurityManager securityManager(CasRealm realm){
+        DefaultWebSecurityManager defaultWebSecurityManager = new DefaultWebSecurityManager();
+        defaultWebSecurityManager.setRealm(realm);
+        defaultWebSecurityManager.setSubjectFactory(new CasSubjectFactory());
+        return defaultWebSecurityManager;
+    }*/
+
+    @Bean
+    public ArkCasRealm arkCasRealm(){
+        ArkCasRealm arkCasRealm = new ArkCasRealm();
+        arkCasRealm.setCasServerUrlPrefix(casServerUrlPrefix);
+        arkCasRealm.setCasService(shiroServerUrlPrefix+casFilterUrlPattern);
+        arkCasRealm.setAuthenticationCachingEnabled(false);
+        return arkCasRealm;
+    }
+
+    @Bean
+    @Order(Ordered.HIGHEST_PRECEDENCE)
+    public ServletListenerRegistrationBean singleSingOutHttpSessionListener(){
+        ServletListenerRegistrationBean bean = new ServletListenerRegistrationBean();
+        bean.setListener(new SingleSignOutHttpSessionListener());
+        bean.setEnabled(true);
+        return bean;
+    }
+
+    @Bean
+    public FilterRegistrationBean singleSingOutFilter(){
+        FilterRegistrationBean bean = new FilterRegistrationBean();
+        bean.setName("singleSingOutFilter");
+        bean.setFilter(new SingleSignOutFilter());
+        bean.addUrlPatterns("/*");
+        bean.setEnabled(true);
+        return bean;
+    }
+
+    @Bean
+    public FilterRegistrationBean delegatingFilterProxy(){
+        FilterRegistrationBean filterRegistrationBean = new FilterRegistrationBean();
+        filterRegistrationBean.setFilter(new DelegatingFilterProxy("shiroFilter"));
+        filterRegistrationBean.addInitParameter("targetFilterLifecycle","true");
+        filterRegistrationBean.setEnabled(true);
+        filterRegistrationBean.addUrlPatterns("/*");
+        return filterRegistrationBean;
+    }
+
+    @Bean(name="casFilter")
+    public CasFilter getCasFilter(){
+        CasFilter casFilter = new CasFilter();
+        casFilter.setName("casFilter");
+        casFilter.setEnabled(true);
+        casFilter.setFailureUrl(loginUrl);
+        casFilter.setSuccessUrl(loginSuccessUrl);
+        return casFilter;
+    }
+
+    @Bean(name = "shiroFilter")
+    public ShiroFilterFactoryBean shiroFilter(SecurityManager securityManager, CasFilter casFilter){
+        ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
+        shiroFilterFactoryBean.setSecurityManager(securityManager);
+        shiroFilterFactoryBean.setLoginUrl(loginUrl);
+        shiroFilterFactoryBean.setUnauthorizedUrl(unauthorizedUrl);
+
+        Map<String,Filter> filters = new HashMap<>();
+        filters.put("casFilter",casFilter);
+        shiroFilterFactoryBean.setFilters(filters);
+        //拦截器.
+        Map<String, String> filterMap = new LinkedHashMap<>();
+        // 配置不会被拦截的链接 顺序判断
+        filterMap.put(casFilterUrlPattern,"casFilter");
+        filterMap.put("/css/**", "anon");
+        filterMap.put("/images/**", "anon");
+        filterMap.put("/script/**", "anon");
+        filterMap.put("/plugins/**", "anon");
+        filterMap.put("/api/**", "anon");
+        filterMap.put("/agent/**", "anon");
+        filterMap.put("/lhyw/kickidc", "anon");
+        filterMap.put("/lhyw/recoverIdc", "anon");
+        filterMap.put("/lhyw/kickidc/healthcheck", "anon");
+        filterMap.put("/healthcheck.html", "anon");
+        filterMap.put("/SSL/healthcheck.html", "anon");
+        filterMap.put("/**","authc");
+
+        shiroFilterFactoryBean.setFilterChainDefinitionMap(filterMap);
+        return shiroFilterFactoryBean;
+    }
+
+    @Bean
+    public static LifecycleBeanPostProcessor lifecycleBeanPostProcessor(){
+        return new LifecycleBeanPostProcessor();
+    }
+
+    @Bean
+    @DependsOn({"lifecycleBeanPostProcessor"})
+    public DefaultAdvisorAutoProxyCreator advisorAutoProxyCreator(){
+        DefaultAdvisorAutoProxyCreator advisorAutoProxyCreator = new DefaultAdvisorAutoProxyCreator();
+        advisorAutoProxyCreator.setProxyTargetClass(true);
+        return advisorAutoProxyCreator;
+    }
+
+    @Bean
+    public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(SecurityManager securityManager){
+        AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor = new AuthorizationAttributeSourceAdvisor();
+        authorizationAttributeSourceAdvisor.setSecurityManager(securityManager);
+        return authorizationAttributeSourceAdvisor;
+    }
+
+    @Bean
+    public ModularRealmAuthenticator modularRealmAuthenticator(){
+        ModularRealmAuthenticator modularRealmAuthenticator = new ModularRealmAuthenticator();
+        modularRealmAuthenticator.setAuthenticationStrategy(new FirstSuccessfulStrategy());
+        return  modularRealmAuthenticator;
+    }
+    @Bean
+    public DefaultWebSessionManager defaultWebSessionManager(ShiroSessionRedisDao shiroSessionRedisDao){
+        DefaultWebSessionManager defaultWebSessionManager = new DefaultWebSessionManager();
+        //全局会话超时时间，默认30分钟(1800000)
+        defaultWebSessionManager.setGlobalSessionTimeout(1800000);
+        //是否在会话过期后会调用SessionDAO的delete方法删除会话 默认true
+        defaultWebSessionManager.setDeleteInvalidSessions(true);
+        //是否开启会话验证器任务 默认true
+        defaultWebSessionManager.setSessionValidationSchedulerEnabled(true);
+        //会话验证器调度时间
+        defaultWebSessionManager.setSessionValidationInterval(900000);
+        defaultWebSessionManager.setSessionDAO(shiroSessionRedisDao);
+        //默认JSESSIONID，同tomcat/jetty在cookie中缓存标识相同，修改用于防止访问404页面时，容器生成的标识把shiro的覆盖掉
+        SimpleCookie simpleCookie=new SimpleCookie("CASSESSIONID");
+        simpleCookie.setHttpOnly(true);
+        simpleCookie.setSecure(Boolean.parseBoolean(cookieSecure));
+        defaultWebSessionManager.setSessionIdCookie(new SimpleCookie(simpleCookie));
+        //在地址栏去掉JSESSIONID
+        defaultWebSessionManager.setSessionIdUrlRewritingEnabled(false);
+        return defaultWebSessionManager;
+    }
+
+    @Bean
+    public DefaultWebSecurityManager defaultWebSecurityManager(DefaultWebSessionManager defaultWebSessionManager, ModularRealmAuthenticator modularRealmAuthenticator, ArkCasRealm arkCasRealm){
+        DefaultWebSecurityManager webSecurityManager = new DefaultWebSecurityManager();
+        webSecurityManager.setSubjectFactory(new CasSubjectFactory());
+        webSecurityManager.setAuthenticator(modularRealmAuthenticator);
+        webSecurityManager.setRealm(arkCasRealm);
+        webSecurityManager.setSessionManager(defaultWebSessionManager);
+        return webSecurityManager;
+    }
+
+
+    @Bean
+    public ShiroSessionRedisDao shiroSessionRedisDao(UnifyRedisService unifyRedisService){
+        ShiroSessionRedisDao shiroSessionRedisDao = new ShiroSessionRedisDao();
+        shiroSessionRedisDao.setRedisCache(unifyRedisService);
+        return shiroSessionRedisDao;
+    }
+
+
+}

package/ark-web/src/production-overlay/java/com/epcc/arkweb/config/InterceptorConfig.java

@@ -0,0 +1,35 @@
+package com.epcc.arkweb.config;
+
+import com.epcc.arkweb.filter.CSRFInterceptor;
+import com.epcc.arkweb.filter.RefererInterceptor;
+import com.epcc.arkweb.filter.SessionIpInterceptor;
+import com.epcc.arkweb.web.llm.AgentAuthorizationInterceptor;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
+import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
+
+@Configuration
+public class InterceptorConfig implements WebMvcConfigurer {
+    @Autowired
+    private AgentAuthorizationInterceptor agentAuthorizationInterceptor;
+    @Autowired
+    private RefererInterceptor refererInterceptor;
+    @Autowired
+    private SessionIpInterceptor sessionIpInterceptor;
+    @Autowired
+    private CSRFInterceptor csrfInterceptor;
+
+    @Override
+    public void addInterceptors(InterceptorRegistry registry) {
+        registry.addInterceptor(agentAuthorizationInterceptor)
+                .addPathPatterns("/agent/**");
+        registry.addInterceptor(refererInterceptor).addPathPatterns("/**")
+                .excludePathPatterns("/", "/login.html", "/logout", "/agent/**");
+        registry.addInterceptor(sessionIpInterceptor).addPathPatterns("/**")
+                .excludePathPatterns("/", "/login.html", "/error",
+                        "/healthcheck.html", "/logout", "/agent/**");
+        registry.addInterceptor(csrfInterceptor).addPathPatterns("/audit/**")
+                .excludePathPatterns("/", "/login.html", "/logout", "/agent/**");
+    }
+}

package/ark-web/src/production-overlay/java/com/epcc/arkweb/config/ShiroConfig.java

@@ -0,0 +1,161 @@
+package com.epcc.arkweb.config;
+
+import com.epcc.arkweb.filter.LoginFormFilter;
+import com.epcc.arkweb.service.redis.ShiroSessionRedisDao;
+import com.epcc.arkweb.service.shirosession.ShiroSessionListener;
+import com.epcc.baseservice.dal.service.UnifyRedisService;
+import org.apache.shiro.authc.pam.FirstSuccessfulStrategy;
+import org.apache.shiro.authc.pam.ModularRealmAuthenticator;
+import org.apache.shiro.mgt.SecurityManager;
+import org.apache.shiro.session.SessionListener;
+import org.apache.shiro.spring.LifecycleBeanPostProcessor;
+import org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor;
+import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
+import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
+import org.apache.shiro.web.servlet.SimpleCookie;
+import org.apache.shiro.web.session.mgt.DefaultWebSessionManager;
+import org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.context.annotation.DependsOn;
+
+import javax.servlet.Filter;
+import java.util.*;
+
+/**
+ * shiro配置
+ */
+@Configuration
+@ConditionalOnProperty(prefix = "arkshiro", name = "sso",havingValue = "false")
+public class ShiroConfig {
+    @Value("${prop.flag}")
+    private String propFlag;
+
+    @Value("${cookie.secure:false}")
+    private String cookieSecure;
+
+    @Bean
+    public ShiroFilterFactoryBean shiroFilterFactoryBean(SecurityManager securityManager) {
+        ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
+        shiroFilterFactoryBean.setSecurityManager(securityManager);
+        //拦截器.
+        Map<String, String> filterMap = new LinkedHashMap<>();
+        // 配置不会被拦截的链接 顺序判断
+        /*filterMap.put("/arkvue/**", "anon");*/
+        filterMap.put("/error", "anon");
+        filterMap.put("/css/**", "anon");
+        filterMap.put("/images/**", "anon");
+        filterMap.put("/script/**", "anon");
+        filterMap.put("/static/**", "anon");
+        filterMap.put("/plugins/**", "anon");
+        filterMap.put("/.ico", "anon");
+        filterMap.put("/healthcheck.html", "anon");
+        filterMap.put("/SSL/healthcheck.html", "anon");
+        filterMap.put("/agent/**", "anon");
+        //配置退出 过滤器,其中的具体的退出代码Shiro已经替我们实现了
+//        filterMap.put("/loginOut.do", "logout");
+
+        //<!-- 过滤链定义，从上向下顺序执行，一般将/**放在最为下边 -->:这是一个坑呢，一不小心代码就不好使了;
+        //<!-- authc:所有url都必须认证通过才可以访问; anon:所有url都都可以匿名访问-->
+        filterMap.put("/**", "authc");
+        filterMap.put("/union-op/**", "authc");
+        // 如果不设置默认会自动寻找Web工程根目录下的"/login.jsp"页面
+        shiroFilterFactoryBean.setLoginUrl("/login.html");
+        //未授权界面;
+        shiroFilterFactoryBean.setUnauthorizedUrl("/403.html");
+        shiroFilterFactoryBean.setFilterChainDefinitionMap(filterMap);
+        // 登录成功后要跳转的链接
+        shiroFilterFactoryBean.setSuccessUrl("/index.html");
+        Map<String, Filter> filters = new HashMap<>();
+        LoginFormFilter loginFormFilter = new LoginFormFilter(propFlag);
+        filters.put("authc",loginFormFilter);
+        shiroFilterFactoryBean.setFilters(filters);
+
+
+        return shiroFilterFactoryBean;
+    }
+
+    @Bean
+    public static DefaultAdvisorAutoProxyCreator getDefaultAdvisorAutoProxyCreator(){
+        DefaultAdvisorAutoProxyCreator defaultAdvisorAutoProxyCreator = new DefaultAdvisorAutoProxyCreator();
+        defaultAdvisorAutoProxyCreator.setUsePrefix(true);
+        return defaultAdvisorAutoProxyCreator;
+    }
+
+    @Bean
+    public ModularRealmAuthenticator modularRealmAuthenticator(){
+        ModularRealmAuthenticator modularRealmAuthenticator = new ModularRealmAuthenticator();
+        modularRealmAuthenticator.setAuthenticationStrategy(new FirstSuccessfulStrategy());
+        return  modularRealmAuthenticator;
+    }
+
+    @Bean
+    public DefaultWebSessionManager defaultWebSessionManager(ShiroSessionRedisDao shiroSessionRedisDao){
+        DefaultWebSessionManager defaultWebSessionManager = new DefaultWebSessionManager();
+        //全局会话超时时间，默认30分钟(1800000)
+        defaultWebSessionManager.setGlobalSessionTimeout(1800000);
+        //是否在会话过期后会调用SessionDAO的delete方法删除会话 默认true
+        defaultWebSessionManager.setDeleteInvalidSessions(true);
+        //是否开启会话验证器任务 默认true
+        defaultWebSessionManager.setSessionValidationSchedulerEnabled(true);
+        //会话验证器调度时间
+        defaultWebSessionManager.setSessionValidationInterval(900000);
+        defaultWebSessionManager.setSessionDAO(shiroSessionRedisDao);
+        //默认JSESSIONID，同tomcat/jetty在cookie中缓存标识相同，修改用于防止访问404页面时，容器生成的标识把shiro的覆盖掉
+        SimpleCookie simpleCookie=new SimpleCookie("SHRIOSESSIONID");
+        simpleCookie.setHttpOnly(true);
+        simpleCookie.setSecure(Boolean.parseBoolean(cookieSecure));
+
+        defaultWebSessionManager.setSessionIdCookie(new SimpleCookie(simpleCookie));
+        Collection<SessionListener> listeners = new ArrayList<>();
+        listeners.add(new ShiroSessionListener());
+        defaultWebSessionManager.setSessionListeners(listeners);
+        //在地址栏去掉JSESSIONID
+        defaultWebSessionManager.setSessionIdUrlRewritingEnabled(false);
+        return defaultWebSessionManager;
+    }
+
+    @Bean
+    public DefaultWebSecurityManager defaultWebSecurityManager(DefaultWebSessionManager defaultWebSessionManager,ModularRealmAuthenticator modularRealmAuthenticator,Realm realm){
+        DefaultWebSecurityManager webSecurityManager = new DefaultWebSecurityManager();
+        webSecurityManager.setAuthenticator(modularRealmAuthenticator);
+        webSecurityManager.setRealm(realm);
+        webSecurityManager.setSessionManager(defaultWebSessionManager);
+        return webSecurityManager;
+    }
+
+    @Bean
+    public Realm arkRealm() {
+        Realm arkRealm = new Realm();
+        return arkRealm;
+    }
+
+    @Bean
+    public ShiroSessionRedisDao shiroSessionRedisDao(UnifyRedisService unifyRedisService){
+        ShiroSessionRedisDao shiroSessionRedisDao = new ShiroSessionRedisDao();
+        shiroSessionRedisDao.setRedisCache(unifyRedisService);
+        return shiroSessionRedisDao;
+    }
+    @Bean
+    public static LifecycleBeanPostProcessor lifecycleBeanPostProcessor(){
+        return new LifecycleBeanPostProcessor();
+    }
+
+    @Bean
+    @DependsOn({"lifecycleBeanPostProcessor"})
+    public DefaultAdvisorAutoProxyCreator advisorAutoProxyCreator(){
+        DefaultAdvisorAutoProxyCreator advisorAutoProxyCreator = new DefaultAdvisorAutoProxyCreator();
+        advisorAutoProxyCreator.setProxyTargetClass(true);
+        return advisorAutoProxyCreator;
+    }
+
+    @Bean
+    public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(SecurityManager securityManager){
+        AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor = new AuthorizationAttributeSourceAdvisor();
+        authorizationAttributeSourceAdvisor.setSecurityManager(securityManager);
+        return authorizationAttributeSourceAdvisor;
+    }
+
+}