?論壇上看了不少Spring Security的相關(guān)文章。這些文章基本上都還是基于Acegi-1.X的配置方式，而主要的配置示例也來自于SpringSide的貢獻(xiàn)。 搭建基礎(chǔ)環(huán)境 http://www.javaeye.com/wiki/struts2/1321-struts2-development-environment-to-build 參考文檔 http://www.family168.com/tutorial/springsecurity/html/springsecurity.html Spring Security基本配置 最小化配置 1. 在web.xml文件中加入Filter聲明
Xml代碼
?? < filter > ????< filter-name > </ filter-name > ????< filter-class > </ filter-class > </ filter > < filter-mapping > ????< filter-name > </ filter-name > ????< url-pattern > </ url-pattern > </ filter-mapping >
<!-- Spring security Filter -->
<filter><filter-name>springSecurityFilterChain</filter-name><filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping><filter-name>springSecurityFilterChain</filter-name><url-pattern>/*</url-pattern>
</filter-mapping>
2. 使用最小的<http>配置
Xml代碼
< http auto-config 'true' > ????< intercept-url pattern "/**" access "ROLE_USER" /> </ http >
<http auto-config='true'><intercept-url pattern="/**" access="ROLE_USER" />
</http>
3. 配置UserDetailsService來指定用戶和權(quán)限
Xml代碼
< authentication-provider > ????< user-service > ??????< user name "downpour" password "downpour" authorities "ROLE_USER,?ROLE_ADMIN" /> ??????< user name "robbin" password "robbin" authorities "ROLE_USER" /> ??????< user name "QuakeWang" password "QuakeWang" authorities "ROLE_ADMIN" /> ????</ user-service > ??</ authentication-provider >
<authentication-provider><user-service><user name="downpour" password="downpour" authorities="ROLE_USER, ROLE_ADMIN" /><user name="robbin" password="robbin" authorities="ROLE_USER" /><user name="QuakeWang" password="QuakeWang" authorities="ROLE_ADMIN" /></user-service></authentication-provider>
4. 小結(jié) 剖析基本配置元素 1. 有關(guān)auto-config屬性
Xml代碼
< http > ????< intercept-url pattern "/**" access "ROLE_USER" /> ????< form-login /> ????< anonymous /> ????< http-basic /> ????< logout /> ????< remember-me /> </ http >
<http><intercept-url pattern="/**" access="ROLE_USER" /><form-login /><anonymous /><http-basic /><logout /><remember-me />
</http>
2. 與Acegi的比較
Xml代碼
< form-login login-page "/login.jsp" authentication-failure-url "/login.jsp?error=true" default-target-url "/work" />
<form-login login-page="/login.jsp" authentication-failure-url="/login.jsp?error=true" default-target-url="/work" />
Xml代碼
< bean id "authenticationProcessingFilter" ??????????class "org.acegisecurity.ui.webapp.AuthenticationProcessingFilter" > ????< property name "authenticationManager" ??????????????????ref "authenticationManager" /> ????< property name "authenticationFailureUrl" ??????????????????value "/login.jsp?error=1" /> ????< property name "defaultTargetUrl" value "/work" /> ????< property name "filterProcessesUrl" ??????????????????value "/j_acegi_security_check" /> ????< property name "rememberMeServices" ref "rememberMeServices" /> </ bean >
<bean id="authenticationProcessingFilter"class="org.acegisecurity.ui.webapp.AuthenticationProcessingFilter"><property name="authenticationManager"ref="authenticationManager"/><property name="authenticationFailureUrl"value="/login.jsp?error=1"/><property name="defaultTargetUrl" value="/work"/><property name="filterProcessesUrl"value="/j_acegi_security_check"/><property name="rememberMeServices" ref="rememberMeServices"/>
</bean>
3. 過濾器鏈在哪里
Xml代碼
< bean id "filterChainProxy" ??????????class "org.acegisecurity.util.FilterChainProxy" > ????< property name "filterInvocationDefinitionSource" > ????????< value > ????????????????CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON ?? ????????????????PATTERN_TYPE_APACHE_ANT????????????????? ?? ????????????????/common/**=#NONE#? ?? ????????????????/css/**=#NONE#? ?? ????????????????/images/**=#NONE# ?? ????????????????/js/**=#NONE#? ?? ????????????????/login.jsp ????????????????/**=httpSessionContextIntegrationFilter,logoutFilter,authenticationProcessingFilter,securityContextHolderAwareRequestFilter,exceptionTranslationFilter,filterSecurityInterceptor ?? ????????</ value > ????</ property > </ bean >
<bean id="filterChainProxy"class="org.acegisecurity.util.FilterChainProxy"><property name="filterInvocationDefinitionSource"><value>CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISONPATTERN_TYPE_APACHE_ANT /common/**=#NONE# /css/**=#NONE# /images/**=#NONE#/js/**=#NONE# /login.jsp=#NONE#/**=httpSessionContextIntegrationFilter,logoutFilter,authenticationProcessingFilter,securityContextHolderAwareRequestFilter,exceptionTranslationFilter,filterSecurityInterceptor</value></property>
</bean>
你不能替換那些<http>元素自己使用而創(chuàng)建出的過濾器，比如HttpSessionContextIntegrationFilter, ExceptionTranslationFilter 或 FilterSecurityInterceptor
Xml代碼
< beans:bean id "myFilter" class "com.mycompany.MySpecialAuthenticationFilter" > ????< custom-filter position "AUTHENTICATION_PROCESSING_FILTER" /> </ beans:bean >
<beans:bean id="myFilter" class="com.mycompany.MySpecialAuthenticationFilter"><custom-filter position="AUTHENTICATION_PROCESSING_FILTER"/>
</beans:bean>
對(duì)于在http/intercept-url中沒有進(jìn)行定義的URL，將會(huì)默認(rèn)使用系統(tǒng)內(nèi)置的過濾器鏈進(jìn)行權(quán)限認(rèn)證。 所以，你并不需要在http/intercept-url中額外定義一個(gè)類似/**的匹配規(guī)則。 使用數(shù)據(jù)庫(kù)對(duì)用戶和權(quán)限進(jìn)行管理 用戶和權(quán)限的關(guān)系設(shè)計(jì)
Java代碼
CREATE?TABLE?users?( ?? ??username?VARCHAR(50 ??password?VARCHAR(50 ??enabled?BIT?NOT?NULL ?? ); ?? ?? CREATE?TABLE?authorities?( ?? ??username?VARCHAR(50 ??authority?VARCHAR(50 );??
CREATE TABLE users (username VARCHAR(50) NOT NULL PRIMARY KEY,password VARCHAR(50) NOT NULL,enabled BIT NOT NULL
);CREATE TABLE authorities (username VARCHAR(50) NOT NULL,authority VARCHAR(50) NOT NULL
);
Java代碼
CREATE?TABLE?`user`?( ?? ??`id`?int 11 ??`name`?varchar(255 default ??`password`?varchar(255 default ??`disabled`?int 1 ??PRIMARY?KEY??(`id`) ?? )?ENGINE=InnoDB?DEFAULT?CHARSET=utf8; ?? ?? CREATE?TABLE?`role`?( ?? ??`id`?int 11 ??`name`?varchar(255 default ??PRIMARY?KEY??(`id`) ?? )?ENGINE=InnoDB?DEFAULT?CHARSET=utf8; ?? ?? CREATE?TABLE?`user_role`?( ?? ??`user_id`?int 11 ??`role_id`?int 11 ??PRIMARY?KEY??(`user_id`,`role_id`), ?? ??UNIQUE?KEY?`role_id`?(`role_id`), ?? ??KEY?`FK143BF46AF6AD4381`?(`user_id`), ?? ??KEY?`FK143BF46A51827FA1`?(`role_id`), ?? ??CONSTRAINT?`FK143BF46A51827FA1`?FOREIGN?KEY?(`role_id`)?REFERENCES?`role`?(`id`), ?? ??CONSTRAINT?`FK143BF46AF6AD4381`?FOREIGN?KEY?(`user_id`)?REFERENCES?`user`?(`id`) ?? )?ENGINE=InnoDB?DEFAULT?CHARSET=utf8;??
CREATE TABLE `user` (`id` int(11) NOT NULL auto_increment,`name` varchar(255) default NULL,`password` varchar(255) default NULL,`disabled` int(1) NOT NULL,PRIMARY KEY (`id`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8;CREATE TABLE `role` (`id` int(11) NOT NULL auto_increment,`name` varchar(255) default NULL,PRIMARY KEY (`id`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8;CREATE TABLE `user_role` (`user_id` int(11) NOT NULL,`role_id` int(11) NOT NULL,PRIMARY KEY (`user_id`,`role_id`),UNIQUE KEY `role_id` (`role_id`),KEY `FK143BF46AF6AD4381` (`user_id`),KEY `FK143BF46A51827FA1` (`role_id`),CONSTRAINT `FK143BF46A51827FA1` FOREIGN KEY (`role_id`) REFERENCES `role` (`id`),CONSTRAINT `FK143BF46AF6AD4381` FOREIGN KEY (`user_id`) REFERENCES `user` (`id`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8;
通過配置SQL來模擬用戶和權(quán)限
Xml代碼
< authentication-provider > ????< jdbc-user-service data-source-ref "dataSource" ????users-by-username-query "SELECT?U.username,?U.password,?U.accountEnabled?AS?'enabled'?FROM?User?U?where?U.username=?" ????authorities-by-username-query "SELECT?U.username,?R.name?as?'authority'?FROM?User?U?JOIN?Authority?A?ON?u.id?=?A.userId?JOIN?Role?R?ON?R.id?=?A.roleId?WHERE?U.username=?" /> </ authentication-provider >
<authentication-provider><jdbc-user-service data-source-ref="dataSource"users-by-username-query="SELECT U.username, U.password, U.accountEnabled AS 'enabled' FROM User U where U.username=?"authorities-by-username-query="SELECT U.username, R.name as 'authority' FROM User U JOIN Authority A ON u.id = A.userId JOIN Role R ON R.id = A.roleId WHERE U.username=?"/>
</authentication-provider>
通過擴(kuò)展Spring Security的默認(rèn)實(shí)現(xiàn)來進(jìn)行用戶和權(quán)限的管理
Java代碼
public interface extends ???? ?? ????GrantedAuthority[]?getAuthorities(); ?? ?? ????String?getPassword(); ?? ?? ????String?getUsername(); ?? ?? ????boolean ?? ????boolean ?? ????boolean ?? ????boolean }??
public interface UserDetails extends Serializable {GrantedAuthority[] getAuthorities();String getPassword();String getUsername();boolean isAccountNonExpired();boolean isAccountNonLocked();boolean isCredentialsNonExpired();boolean isEnabled();
}
?
Java代碼
public interface ????UserDetails?loadUserByUsername(String?username) ?? ????????throws }??
public interface UserDetailsService {UserDetails loadUserByUsername(String username)throws UsernameNotFoundException, DataAccessException;
}
1. 定義User類和Role類，使他們之間形成多對(duì)多的關(guān)系
Java代碼
@Entity @Proxy false @Cache public class ???? ?? ????private static final long ?? ????@Id ????@GeneratedValue ????private ???? ?? ????private ???? ?? ????private ???? ?? ????private boolean ???? ?? ????@ManyToMany class ????@JoinTable "user_role" @JoinColumn "user_id" @JoinColumn "role_id" ????@Cache ????private ?? ?????????? }??
@Entity
@Proxy(lazy = false)
@Cache(usage = CacheConcurrencyStrategy.READ_WRITE)
public class User {private static final long serialVersionUID = 8026813053768023527L;@Id@GeneratedValueprivate Integer id;private String name;private String password;private boolean disabled;@ManyToMany(targetEntity = Role.class, fetch = FetchType.EAGER)@JoinTable(name = "user_role", joinColumns = @JoinColumn(name = "user_id"), inverseJoinColumns = @JoinColumn(name = "role_id"))@Cache(usage = CacheConcurrencyStrategy.READ_WRITE)private Set<Role> roles;// setters and getters
}
?
Java代碼
@Entity @Cache public class ???? ?? ????@Id ????@GeneratedValue ????private ???? ?? ????private ???????? ?? ?????????? }??
@Entity
@Cache(usage = CacheConcurrencyStrategy.READ_WRITE)
public class Role {@Id@GeneratedValueprivate Integer id;private String name;// setters and getters
}
2. 使User類實(shí)現(xiàn)UserDetails接口
Java代碼
@Entity @Proxy false @Cache public class implements ???? ?? ????private static final long ?? ????@Id ????@GeneratedValue ????private ???? ?? ????private ???? ?? ????private ???? ?? ????private boolean ???? ?? ????@ManyToMany class ????@JoinTable "user_role" @JoinColumn "user_id" @JoinColumn "role_id" ????@Cache ????private ???? ?? ????? ? ?? ????public ???????? ?? ????} ?? ?? ????? ? ?? ????public ????????List<GrantedAuthority>?grantedAuthorities?=?new ????????for ????????????grantedAuthorities.add(new ????????} ?? ????????return new ????} ?? ?? ????? ? ?? ????public ????????return ????} ?? ?? ????? ? ?? ????public ????????return ????} ?? ?? ????? ? ?? ????public boolean ????????return true ????} ?? ?? ????? ? ?? ????public boolean ????????return true ????} ?? ?? ????? ? ?? ????public boolean ????????return true ????} ?? ?? ????? ? ?? ????public boolean ????????return this ????} ?? ?????? ?? ???????? }??
@Entity
@Proxy(lazy = false)
@Cache(usage = CacheConcurrencyStrategy.READ_WRITE)
public class User implements UserDetails {private static final long serialVersionUID = 8026813053768023527L;@Id@GeneratedValueprivate Integer id;private String name;private String password;private boolean disabled;@ManyToMany(targetEntity = Role.class, fetch = FetchType.EAGER)@JoinTable(name = "user_role", joinColumns = @JoinColumn(name = "user_id"), inverseJoinColumns = @JoinColumn(name = "role_id"))@Cache(usage = CacheConcurrencyStrategy.READ_WRITE)private Set<Role> roles;/*** The default constructor*/public User() {}/* (non-Javadoc)* @see org.springframework.security.userdetails.UserDetails#getAuthorities()*/public GrantedAuthority[] getAuthorities() {List<GrantedAuthority> grantedAuthorities = new ArrayList<GrantedAuthority>(roles.size());for(Role role : roles) {grantedAuthorities.add(new GrantedAuthorityImpl(role.getName()));}return grantedAuthorities.toArray(new GrantedAuthority[roles.size()]);}/* (non-Javadoc)* @see org.springframework.security.userdetails.UserDetails#getPassword()*/public String getPassword() {return password;}/* (non-Javadoc)* @see org.springframework.security.userdetails.UserDetails#getUsername()*/public String getUsername() {return name;}/* (non-Javadoc)* @see org.springframework.security.userdetails.UserDetails#isAccountNonExpired()*/public boolean isAccountNonExpired() {return true;}/* (non-Javadoc)* @see org.springframework.security.userdetails.UserDetails#isAccountNonLocked()*/public boolean isAccountNonLocked() {return true;}/* (non-Javadoc)* @see org.springframework.security.userdetails.UserDetails#isCredentialsNonExpired()*/public boolean isCredentialsNonExpired() {return true;}/* (non-Javadoc)* @see org.springframework.security.userdetails.UserDetails#isEnabled()*/public boolean isEnabled() {return !this.disabled;}// setters and getters
}
Java代碼
? ? ?? public ????List<GrantedAuthority>?grantedAuthorities?=?new ????for ????????grantedAuthorities.add(new ????????} ?? ????????return new }??
/* (non-Javadoc)* @see org.springframework.security.userdetails.UserDetails#getAuthorities()*/
public GrantedAuthority[] getAuthorities() {List<GrantedAuthority> grantedAuthorities = new ArrayList<GrantedAuthority>(roles.size());for(Role role : roles) {grantedAuthorities.add(new GrantedAuthorityImpl(role.getName()));}return grantedAuthorities.toArray(new GrantedAuthority[roles.size()]);
}
Xml代碼
< user name "downpour" password "downpour" authorities "ROLE_USER,?ROLE_ADMIN" />
<user name="downpour" password="downpour" authorities="ROLE_USER, ROLE_ADMIN" />
3. 實(shí)現(xiàn)UserDetailsService接口
Java代碼
@Repository "securityManager" public class extends implements ?? ????? ? ? ? ?? ????@Autowired ????public void ????????super ????} ?? ?? ????public throws ????????List<User>?users?=?getHibernateTemplate().find("FROM?User?user?WHERE?user.name?=???AND?user.disabled?=?false" ????????if ????????????throw new "User?" "?has?no?GrantedAuthority" ????????} ?? ????????return 0 ????} ?? }??
@Repository("securityManager")
public class SecurityManagerSupport extends HibernateDaoSupport implements UserDetailsService {/*** Init sessionFactory here because the annotation of Spring 2.5 can not support override inject* * @param sessionFactory*/@Autowiredpublic void init(SessionFactory sessionFactory) {super.setSessionFactory(sessionFactory);}public UserDetails loadUserByUsername(String userName) throws UsernameNotFoundException, DataAccessException {List<User> users = getHibernateTemplate().find("FROM User user WHERE user.name = ? AND user.disabled = false", userName);if(users.isEmpty()) {throw new UsernameNotFoundException("User " + userName + " has no GrantedAuthority");}return users.get(0);}
}
4. 配置文件
Xml代碼
< authentication-provider user-service-ref "securityManager" > ????< password-encoder hash "md5" /> </ authentication-provider >
<authentication-provider user-service-ref="securityManager"><password-encoder hash="md5"/>
</authentication-provider>
使用數(shù)據(jù)庫(kù)對(duì)資源進(jìn)行管理 權(quán)限和資源的設(shè)計(jì)
Java代碼
CREATE?TABLE?`role`?( ?? ??`id`?int 11 ??`name`?varchar(255 default ??`description`?varchar(255 default ??PRIMARY?KEY??(`id`) ?? )?ENGINE=InnoDB?DEFAULT?CHARSET=utf8; ?? ?? CREATE?TABLE?`resource`?( ?? ??`id`?int 11 ??`type`?varchar(255 default ??`value`?varchar(255 default ??PRIMARY?KEY??(`id`) ?? )?ENGINE=InnoDB?DEFAULT?CHARSET=utf8; ?? ?? CREATE?TABLE?`role_resource`?( ?? ??`role_id`?int 11 ??`resource_id`?int 11 ??PRIMARY?KEY??(`role_id`,`resource_id`), ?? ??KEY?`FKAEE599B751827FA1`?(`role_id`), ?? ??KEY?`FKAEE599B7EFD18D21`?(`resource_id`), ?? ??CONSTRAINT?`FKAEE599B751827FA1`?FOREIGN?KEY?(`role_id`)?REFERENCES?`role`?(`id`), ?? ??CONSTRAINT?`FKAEE599B7EFD18D21`?FOREIGN?KEY?(`resource_id`)?REFERENCES?`resource`?(`id`) ?? )?ENGINE=InnoDB?DEFAULT?CHARSET=utf8;??
CREATE TABLE `role` (`id` int(11) NOT NULL auto_increment,`name` varchar(255) default NULL,`description` varchar(255) default NULL,PRIMARY KEY (`id`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8;CREATE TABLE `resource` (`id` int(11) NOT NULL auto_increment,`type` varchar(255) default NULL,`value` varchar(255) default NULL,PRIMARY KEY (`id`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8;CREATE TABLE `role_resource` (`role_id` int(11) NOT NULL,`resource_id` int(11) NOT NULL,PRIMARY KEY (`role_id`,`resource_id`),KEY `FKAEE599B751827FA1` (`role_id`),KEY `FKAEE599B7EFD18D21` (`resource_id`),CONSTRAINT `FKAEE599B751827FA1` FOREIGN KEY (`role_id`) REFERENCES `role` (`id`),CONSTRAINT `FKAEE599B7EFD18D21` FOREIGN KEY (`resource_id`) REFERENCES `resource` (`id`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8;
針對(duì)資源的認(rèn)證 我們可以再實(shí)現(xiàn)一個(gè)類似的過濾器，并將我們自己的過濾器作為一個(gè)customer-filter，加到默認(rèn)的過濾器鏈的最后，從而完成整個(gè)過濾檢查。
Java代碼
@Entity @Cache public class ???? ?? ????@Id ????@GeneratedValue ????private ???? ?? ????private ???? ?? ????@ManyToMany class ????@JoinTable "role_resource" @JoinColumn "role_id" @JoinColumn "resource_id" ????@Cache ????private ?? ?????????? }??
@Entity
@Cache(usage = CacheConcurrencyStrategy.READ_WRITE)
public class Role {@Id@GeneratedValueprivate Integer id;private String name;@ManyToMany(targetEntity = Resource.class, fetch = FetchType.EAGER)@JoinTable(name = "role_resource", joinColumns = @JoinColumn(name = "role_id"), inverseJoinColumns = @JoinColumn(name = "resource_id"))@Cache(usage = CacheConcurrencyStrategy.READ_WRITE)private Set<Resource> resources;// setters and getter
}
Java代碼
@Entity @Cache ?? public class ?? ????@Id ????@GeneratedValue ????private ???? ?? ????private ???? ?? ????private ???? ?? ????@ManyToMany "resources" class ????@Cache ????private ???? ?? ????? ? ?? ????public ???????? ?? ????} ?? }??
@Entity
@Cache(usage = CacheConcurrencyStrategy.READ_WRITE)public class Resource {@Id@GeneratedValueprivate Integer id;private String type;private String value;@ManyToMany(mappedBy = "resources", targetEntity = Role.class, fetch = FetchType.EAGER)@Cache(usage = CacheConcurrencyStrategy.READ_WRITE)private Set<Role> roles;/*** The default constructor*/public Resource() {}
}
Java代碼
public class implements ?? ????? ? ?? ????public void ????????ServletContext?servletContext?=?servletContextEvent.getServletContext(); ?? ????????SecurityManager?securityManager?=?this ???????? ?? ????????Map<String,?String>?urlAuthorities?=?securityManager.loadUrlAuthorities(); ?? ????????servletContext.setAttribute("urlAuthorities" ????} ?? ?? ???? ?? ????? ? ?? ????public void ????????servletContextEvent.getServletContext().removeAttribute("urlAuthorities" ????} ?? ?? ????? ? ? ? ? ?? ????protected ???????return "securityManager" ????} ?? ?? }??
public class ServletContextLoaderListener implements ServletContextListener {/* (non-Javadoc)* @see javax.servlet.ServletContextListener#contextInitialized(javax.servlet.ServletContextEvent)*/public void contextInitialized(ServletContextEvent servletContextEvent) {ServletContext servletContext = servletContextEvent.getServletContext();SecurityManager securityManager = this.getSecurityManager(servletContext);Map<String, String> urlAuthorities = securityManager.loadUrlAuthorities();servletContext.setAttribute("urlAuthorities", urlAuthorities);}/* (non-Javadoc)* @see javax.servlet.ServletContextListener#contextDestroyed(javax.servlet.ServletContextEvent)*/public void contextDestroyed(ServletContextEvent servletContextEvent) {servletContextEvent.getServletContext().removeAttribute("urlAuthorities");}/*** Get SecurityManager from ApplicationContext* * @param servletContext* @return*/protected SecurityManager getSecurityManager(ServletContext servletContext) {return (SecurityManager) WebApplicationContextUtils.getWebApplicationContext(servletContext).getBean("securityManager"); }}
Java代碼
@Service "securityManager" public class extends implements ???? ?? ????? ? ? ? ?? ????@Autowired ????public void ????????super ????} ?? ???? ?? ????? ? ?? ????public throws ????????List<User>?users?=?getHibernateTemplate().find("FROM?User?user?WHERE?user.name?=???AND?user.disabled?=?false" ????????if ????????????throw new "User?" "?has?no?GrantedAuthority" ????????} ?? ????????return 0 ????} ?? ???? ?? ????? ? ?? ????public ????????Map<String,?String>?urlAuthorities?=?new ????????List<Resource>?urlResources?=?getHibernateTemplate().find("FROM?Resource?resource?WHERE?resource.type?=??" "URL" ????????for ????????????urlAuthorities.put(resource.getValue(),?resource.getRoleAuthorities()); ?? ????????} ?? ????????return ????}??? ?? }??
@Service("securityManager")
public class SecurityManagerSupport extends HibernateDaoSupport implements UserDetailsService, SecurityManager {/*** Init sessionFactory here because the annotation of Spring 2.5 can not support override inject* * @param sessionFactory*/@Autowiredpublic void init(SessionFactory sessionFactory) {super.setSessionFactory(sessionFactory);}/* (non-Javadoc)* @see org.springframework.security.userdetails.UserDetailsService#loadUserByUsername(java.lang.String)*/public UserDetails loadUserByUsername(String userName) throws UsernameNotFoundException, DataAccessException {List<User> users = getHibernateTemplate().find("FROM User user WHERE user.name = ? AND user.disabled = false", userName);if(users.isEmpty()) {throw new UsernameNotFoundException("User " + userName + " has no GrantedAuthority");}return users.get(0);}/* (non-Javadoc)* @see com.javaeye.sample.security.SecurityManager#loadUrlAuthorities()*/public Map<String, String> loadUrlAuthorities() {Map<String, String> urlAuthorities = new HashMap<String, String>();List<Resource> urlResources = getHibernateTemplate().find("FROM Resource resource WHERE resource.type = ?", "URL");for(Resource resource : urlResources) {urlAuthorities.put(resource.getValue(), resource.getRoleAuthorities());}return urlAuthorities;}
}
Java代碼
public class implements ???? ?? ????private ?? ????private boolean true ???? ?? ????private boolean true ???? ?? ????? ? ?? ????public void boolean ????????this ????} ?? ???? ?? ????? ? ?? ????public void boolean ????????this ????} ?? ???? ?? ????? ? ?? ????public void throws ???????? ?? ?????????? ????????this new ???????? ?? ????????if ????????????this new ????????} ?? ???????? ?? ?????????? ????????if "true" ????????????if this ????????????????((RegexUrlPathMatcher)?this true ????????????} ?? ????????}?else if "false" ????????????if this ????????????????((AntUrlPathMatcher)?this false ????????????} ?? ????????} ?? ???????? ?? ????} ?? ???? ?? ????? ? ?? ????public throws ???????? ?? ????????FilterInvocation?filterInvocation?=?(FilterInvocation)?filter; ?? ????????String?requestURI?=?filterInvocation.getRequestUrl(); ?? ????????Map<String,?String>?urlAuthorities?=?this ???????? ?? ????????String?grantedAuthorities?=?null ????????for ????????????Map.Entry<String,?String>?entry?=?iter.next(); ?? ????????????String?url?=?entry.getKey(); ?? ???????????? ?? ????????????if ????????????????grantedAuthorities?=?entry.getValue(); ?? ????????????????break ????????????} ?? ???????????? ?? ????????} ?? ???????? ?? ????????if null ????????????ConfigAttributeEditor?configAttrEditor?=?new ????????????configAttrEditor.setAsText(grantedAuthorities); ?? ????????????return ????????} ?? ???????? ?? ????????return null ????} ?? ?? ????? ? ?? ????@SuppressWarnings "unchecked" ????public ????????return null ????} ?? ?? ????? ? ?? ????@SuppressWarnings "unchecked" ????public boolean ????????return true ????} ?? ???? ?? ????? ? ? ? ?? ????@SuppressWarnings "unchecked" ????private ????????ServletContext?servletContext?=?filterInvocation.getHttpRequest().getSession().getServletContext(); ?? ????????return "urlAuthorities" ????} ?? ?? }??
public class SecureResourceFilterInvocationDefinitionSource implements FilterInvocationDefinitionSource, InitializingBean {private UrlMatcher urlMatcher;private boolean useAntPath = true;private boolean lowercaseComparisons = true;/*** @param useAntPath the useAntPath to set*/public void setUseAntPath(boolean useAntPath) {this.useAntPath = useAntPath;}/*** @param lowercaseComparisons*/public void setLowercaseComparisons(boolean lowercaseComparisons) {this.lowercaseComparisons = lowercaseComparisons;}/* (non-Javadoc)* @see org.springframework.beans.factory.InitializingBean#afterPropertiesSet()*/public void afterPropertiesSet() throws Exception {// default url matcher will be RegexUrlPathMatcherthis.urlMatcher = new RegexUrlPathMatcher();if (useAntPath) { // change the implementation if requiredthis.urlMatcher = new AntUrlPathMatcher();}// Only change from the defaults if the attribute has been setif ("true".equals(lowercaseComparisons)) {if (!this.useAntPath) {((RegexUrlPathMatcher) this.urlMatcher).setRequiresLowerCaseUrl(true);}} else if ("false".equals(lowercaseComparisons)) {if (this.useAntPath) {((AntUrlPathMatcher) this.urlMatcher).setRequiresLowerCaseUrl(false);}}}/* (non-Javadoc)* @see org.springframework.security.intercept.ObjectDefinitionSource#getAttributes(java.lang.Object)*/public ConfigAttributeDefinition getAttributes(Object filter) throws IllegalArgumentException {FilterInvocation filterInvocation = (FilterInvocation) filter;String requestURI = filterInvocation.getRequestUrl();Map<String, String> urlAuthorities = this.getUrlAuthorities(filterInvocation);String grantedAuthorities = null;for(Iterator<Map.Entry<String, String>> iter = urlAuthorities.entrySet().iterator(); iter.hasNext();) {Map.Entry<String, String> entry = iter.next();String url = entry.getKey();if(urlMatcher.pathMatchesUrl(url, requestURI)) {grantedAuthorities = entry.getValue();break;}}if(grantedAuthorities != null) {ConfigAttributeEditor configAttrEditor = new ConfigAttributeEditor();configAttrEditor.setAsText(grantedAuthorities);return (ConfigAttributeDefinition) configAttrEditor.getValue();}return null;}/* (non-Javadoc)* @see org.springframework.security.intercept.ObjectDefinitionSource#getConfigAttributeDefinitions()*/@SuppressWarnings("unchecked")public Collection getConfigAttributeDefinitions() {return null;}/* (non-Javadoc)* @see org.springframework.security.intercept.ObjectDefinitionSource#supports(java.lang.Class)*/@SuppressWarnings("unchecked")public boolean supports(Class clazz) {return true;}/*** * @param filterInvocation* @return*/@SuppressWarnings("unchecked")private Map<String, String> getUrlAuthorities(FilterInvocation filterInvocation) {ServletContext servletContext = filterInvocation.getHttpRequest().getSession().getServletContext();return (Map<String, String>)servletContext.getAttribute("urlAuthorities");}}
Xml代碼
< beans:beans xmlns "http://www.springframework.org/schema/security" ????xmlns:beans "http://www.springframework.org/schema/beans" ????xmlns:xsi "http://www.w3.org/2001/XMLSchema-instance" ????xsi:schemaLocation ????????????????????????http://www.springframework.org/schema/security?http://www.springframework.org/schema/security/spring-security-2.0.4.xsd"> ???? ?? ????< beans:bean id "loggerListener" class "org.springframework.security.event.authentication.LoggerListener" /> ???? ?? ????< http access-denied-page "/403.jsp" > ????????< intercept-url pattern "/static/**" filters "none" /> ????????< intercept-url pattern "/template/**" filters "none" /> ????????< intercept-url pattern "/" filters "none" /> ????????< intercept-url pattern "/login.jsp" filters "none" /> ????????< form-login login-page "/login.jsp" authentication-failure-url "/login.jsp?error=true" default-target-url "/index" /> ????????< logout logout-success-url "/login.jsp" /> ????????< http-basic /> ????</ http > ?? ????< authentication-manager alias "authenticationManager" /> ???? ?? ????< authentication-provider user-service-ref "securityManager" > ????????< password-encoder hash "md5" /> ????</ authentication-provider > ???? ?? ????< beans:bean id "accessDecisionManager" class "org.springframework.security.vote.AffirmativeBased" > ????????< beans:property name "allowIfAllAbstainDecisions" value "false" /> ????????< beans:property name "decisionVoters" > ????????????< beans:list > ????????????????< beans:bean class "org.springframework.security.vote.RoleVoter" /> ????????????????< beans:bean class "org.springframework.security.vote.AuthenticatedVoter" /> ????????????</ beans:list > ????????</ beans:property > ????</ beans:bean > ???? ?? ????< beans:bean id "resourceSecurityInterceptor" class "org.springframework.security.intercept.web.FilterSecurityInterceptor" > ????????< beans:property name "authenticationManager" ref "authenticationManager" /> ????????< beans:property name "accessDecisionManager" ref "accessDecisionManager" /> ????????< beans:property name "objectDefinitionSource" ref "secureResourceFilterInvocationDefinitionSource" /> ????????< beans:property name "observeOncePerRequest" value "false" /> ????????< custom-filter after "LAST" /> ????</ beans:bean > ???? ?? ????< beans:bean id "secureResourceFilterInvocationDefinitionSource" class "com.javaeye.sample.security.interceptor.SecureResourceFilterInvocationDefinitionSource" /> ???? ?? </ beans:beans >
<beans:beans xmlns="http://www.springframework.org/schema/security"xmlns:beans="http://www.springframework.org/schema/beans"xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.5.xsdhttp://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-2.0.4.xsd"><beans:bean id="loggerListener" class="org.springframework.security.event.authentication.LoggerListener" /><http access-denied-page="/403.jsp" ><intercept-url pattern="/static/**" filters="none" /><intercept-url pattern="/template/**" filters="none" /><intercept-url pattern="/" filters="none" /><intercept-url pattern="/login.jsp" filters="none" /><form-login login-page="/login.jsp" authentication-failure-url="/login.jsp?error=true" default-target-url="/index" /><logout logout-success-url="/login.jsp"/><http-basic /></http><authentication-manager alias="authenticationManager"/><authentication-provider user-service-ref="securityManager"><password-encoder hash="md5"/></authentication-provider><beans:bean id="accessDecisionManager" class="org.springframework.security.vote.AffirmativeBased"><beans:property name="allowIfAllAbstainDecisions" value="false"/><beans:property name="decisionVoters"><beans:list><beans:bean class="org.springframework.security.vote.RoleVoter"/><beans:bean class="org.springframework.security.vote.AuthenticatedVoter"/></beans:list></beans:property></beans:bean><beans:bean id="resourceSecurityInterceptor" class="org.springframework.security.intercept.web.FilterSecurityInterceptor"><beans:property name="authenticationManager" ref="authenticationManager"/><beans:property name="accessDecisionManager" ref="accessDecisionManager"/><beans:property name="objectDefinitionSource" ref="secureResourceFilterInvocationDefinitionSource" /><beans:property name="observeOncePerRequest" value="false" /><custom-filter after="LAST" /></beans:bean><beans:bean id="secureResourceFilterInvocationDefinitionSource" class="com.javaeye.sample.security.interceptor.SecureResourceFilterInvocationDefinitionSource" /></beans:beans>
Spring Security對(duì)象的訪問 1. 訪問當(dāng)前登錄用戶
Java代碼
public class ?? ????? ? ? ? ?? ????public static ????????return ????} ?? ?? }??
public class SecurityUserHolder {/*** Returns the current user* * @return*/public static User getCurrentUser() {return (User) SecurityContextHolder.getContext().getAuthentication().getPrincipal();}}
2. 訪問當(dāng)前登錄用戶所擁有的權(quán)限
Java代碼
? ? ?? public ????List<GrantedAuthority>?grantedAuthorities?=?new ????for ????????grantedAuthorities.add(new ????} ?? ???????return new } ?? ?? ? ? ? ? ? ? ? ? ?? public ????List<String>?authorities?=?new ????for this ????????authorities.add(authority.getAuthority()); ?? ????} ?? ????return "," }??
/* (non-Javadoc)* @see org.springframework.security.userdetails.UserDetails#getAuthorities()*/public GrantedAuthority[] getAuthorities() {List<GrantedAuthority> grantedAuthorities = new ArrayList<GrantedAuthority>(roles.size());for(Role role : roles) {grantedAuthorities.add(new GrantedAuthorityImpl(role.getName()));}return grantedAuthorities.toArray(new GrantedAuthority[roles.size()]);}/*** Returns the authorites string* * eg. * downpour --- ROLE_ADMIN,ROLE_USER* robbin --- ROLE_ADMIN* * @return*/public String getAuthoritiesString() {List<String> authorities = new ArrayList<String>();for(GrantedAuthority authority : this.getAuthorities()) {authorities.add(authority.getAuthority());}return StringUtils.join(authorities, ",");}
3. 訪問當(dāng)前登錄用戶能夠訪問的資源
/*** @return the roleResources*/
public Map<String, List<Resource>> getRoleResources() {// init roleResources for the first timeif(this.roleResources == null) { this.roleResources = new HashMap<String, List<Resource>>();for(Role role : this.roles) {String roleName = role.getName();Set<Resource> resources = role.getResources();for(Resource resource : resources) {String key = roleName + "_" + resource.getType();if(!this.roleResources.containsKey(key)) {this.roleResources.put(key, new ArrayList<Resource>());}this.roleResources.get(key).add(resource); }}}return this.roleResources;
}
代碼示例
SpringSecurity.zip (48.7 KB) 下載次數(shù): 4717 總結(jié)
以上是生活随笔 為你收集整理的Spring Security 2 配置精讲 的全部?jī)?nèi)容，希望文章能夠幫你解決所遇到的問題。
如果覺得生活随笔 網(wǎng)站內(nèi)容還不錯(cuò)，歡迎將生活随笔 推薦給好友。
