Spring Security 3.1配置与使用

1、使用maven 添加Spring Security的jar 包，在pom.xml中加入：

[html]  view plain copy

1.               <dependency>  
2.     <groupId>org.springframework.security</groupId>  
3.     <artifactId>spring-security-core</artifactId>  
4.     <version>3.1.3.RELEASE</version>  
5. </dependency>  
6. <dependency>  
7.     <groupId>org.springframework.security</groupId>  
8.     <artifactId>spring-security-web</artifactId>  
9.     <version>3.1.3.RELEASE</version>  
10. </dependency>  
11. <dependency>  
12.     <groupId>org.springframework.security</groupId>  
13.     <artifactId>spring-security-config</artifactId>  
14.     <version>3.1.3.RELEASE</version>  
15. </dependency>  
16. <dependency>  
17.     <groupId>org.springframework.security</groupId>  
18.     <artifactId>spring-security-taglibs</artifactId>  
19.     <version>3.1.3.RELEASE</version>  
20. </dependency>  

2、在web.xml中加入Spring Security的过滤器：

[html]  view plain copy

1. <context-param>  
2.    <param-name>contextConfigLocation</param-name>  
3.    <param-value>classpath:spring-*.xml,classpath:beans.xml</param-value>  
4. </context-param>  
5.   
6.  <!-- 用于初始化 Sping Security 的 filterChain -->  
7.    <filter>  
8.        <filter-name>springSecurityFilterChain</filter-name>  
9.        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>  
10.    </filter>  
11.    <filter-mapping>  
12.        <filter-name>springSecurityFilterChain</filter-name>  
13.        <url-pattern>/*</url-pattern>  
14.    </filter-mapping>  

3、Spring Security的配置：

[html]  view plain copy

1. <?xml version="1.0" encoding="UTF-8"?>  
2. <beans:beans xmlns="http://www.springframework.org/schema/security"  
3.     xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"  
4.     xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd  
5.                         http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.1.xsd">  
6.     <http pattern="/adminLogin.action" security="none"/>  
7.     <http pattern="/adminLoginSubmit.action" security="none"/>  
8.     <http pattern="/static/**" security="none"/>  
9.     <http auto-config="true" use-expressions="true">  
10.         <form-login login-page="/adminLogin.action"  
11.             authentication-failure-url="/adminLogin.action?error=true "/>  
12.         <logout logout-success-url="/adminLogin.action"   
13.             invalidate-session="true" />  
14.         <session-management invalid-session-url="/adminLogin.action">  
15.             <concurrency-control max-sessions="1" />  
16.         </session-management>  
17.         <custom-filter ref="myFilter" before="FILTER_SECURITY_INTERCEPTOR"/>   
18.     </http>  
19.     <beans:bean id="myFilter" class="com.sz7road.web.security.MyFilterSecurityInterceptor">  
20.         <beans:property name="accessDecisionManager" ref="myAccessDecisionManager" /><!-- 资源访问决策 -->  
21.         <beans:property name="authenticationManager" ref="authenticationManager" /><!-- 登陆的认证 -->  
22.         <beans:property name="securityMetadataSource" ref="mySecurityMetadataSource" /><!-- 资源和权限列表 -->  
23.     </beans:bean>  
24.        
25.     <authentication-manager alias="authenticationManager">  
26.         <authentication-provider user-service-ref="userDetailsService">  
27.         </authentication-provider>  
28.     </authentication-manager>  
29.        
30.     <beans:bean name="userDetailsService" class="com.sz7road.web.security.MyUserDetailsService">  
31.     </beans:bean>  
32.        
33.     <beans:bean name="myAccessDecisionManager" class="com.sz7road.web.security.MyAccessDecisionManager">  
34.     </beans:bean>  
35.        
36.     <beans:bean name="mySecurityMetadataSource" class="com.sz7road.web.security.MyInvocationSecurityMetadataSourceService">  
37.     </beans:bean>  
38.       
39. </beans:beans>  

4、四个主要类的实现：

[java]  view plain copy

1. package com.sz7road.web.security;  
2.   
3. import java.util.ArrayList;  
4. import java.util.Collection;  
5. import java.util.List;  
6.   
7. import javax.annotation.Resource;  
8.   
9. import org.springframework.security.core.GrantedAuthority;  
10. import org.springframework.security.core.authority.GrantedAuthorityImpl;  
11. import org.springframework.security.core.authority.SimpleGrantedAuthority;  
12. import org.springframework.security.core.userdetails.UserDetails;  
13. import org.springframework.security.core.userdetails.UserDetailsService;  
14. import org.springframework.security.core.userdetails.UsernameNotFoundException;  
15.   
16. import com.sz7road.web.dao.UserDao;  
17. import com.sz7road.web.model.user.User;  
18.   
19. public class MyUserDetailsService implements UserDetailsService{  
20.   
21.     @Resource  
22.     private UserDao userDao;  
23.       
24.     @Override  
25.     public UserDetails loadUserByUsername(String username)  
26.             throws UsernameNotFoundException {  
27.         Collection<GrantedAuthority> auths = new ArrayList<GrantedAuthority>();  
28.         User user = new User();  
29.         try {  
30.             user = userDao.getUserByName(username);  
31.             List<String> authStr= userDao.loadUserAuthoritiesByName(username);  
32.             for (String authName : authStr) {  
33.                 SimpleGrantedAuthority authority = new SimpleGrantedAuthority(authName);  
34.                 auths.add(authority);  
35.             }  
36.         } catch (Exception e) {  
37.             e.printStackTrace();  
38.         }  
39.         return new User(user.getId(), user.getUserName(), user.getPassword(), user.getEmail(), user.getCreateDate(), user.getUserName(), auths, true, true, true);  
40.     }  
41.       
42. }  

[java]  view plain copy

1. package com.sz7road.web.security;  
2.   
3. import java.util.Collection;  
4. import java.util.Iterator;  
5.   
6. import org.springframework.security.access.AccessDecisionManager;  
7. import org.springframework.security.access.AccessDeniedException;  
8. import org.springframework.security.access.ConfigAttribute;  
9. import org.springframework.security.access.SecurityConfig;  
10. import org.springframework.security.authentication.InsufficientAuthenticationException;  
11. import org.springframework.security.core.Authentication;  
12. import org.springframework.security.core.GrantedAuthority;  
13.   
14. public class MyAccessDecisionManager implements AccessDecisionManager {  
15.   
16.     @Override  
17.     public void decide(Authentication authentication, Object object,  
18.             Collection<ConfigAttribute> configAttributes)  
19.             throws AccessDeniedException, InsufficientAuthenticationException {  
20.         if( configAttributes == null ) {  
21.             return ;  
22.         }  
23.           
24.         Iterator<ConfigAttribute> ite = configAttributes.iterator();  
25.           
26.         while( ite.hasNext()){  
27.             ConfigAttribute ca = ite.next();  
28.             String needRole = ((SecurityConfig)ca).getAttribute();  
29.             for( GrantedAuthority ga: authentication.getAuthorities()){  
30.                 if(needRole.trim().equals(ga.getAuthority().trim())){  
31.                     return;  
32.                 }  
33.             }  
34.         }  
35.         throw new AccessDeniedException("无权限！");  
36.   
37.     }  
38.   
39.     @Override  
40.     public boolean supports(ConfigAttribute attribute) {  
41.         return true;  
42.     }  
43.   
44.     @Override  
45.     public boolean supports(Class<?> clazz) {  
46.         return true;  
47.     }  
48.   
49. }  

[java]  view plain copy

1. package com.sz7road.web.security;  
2.   
3. import java.util.ArrayList;  
4. import java.util.Collection;  
5. import java.util.List;  
6.   
7. import javax.annotation.Resource;  
8.   
9. import org.springframework.security.access.ConfigAttribute;  
10. import org.springframework.security.access.SecurityConfig;  
11. import org.springframework.security.web.FilterInvocation;  
12. import org.springframework.security.web.access.intercept.FilterInvocationSecurityMetadataSource;  
13.   
14. import com.sz7road.web.dao.PermissionDao;  
15. import com.sz7road.web.model.permission.Permission;  
16.   
17. public class MyInvocationSecurityMetadataSourceService implements  
18.         FilterInvocationSecurityMetadataSource {  
19.   
20.     @Resource  
21.     private PermissionDao permDao;  
22.       
23.     @Override  
24.     public Collection<ConfigAttribute> getAttributes(Object object)  
25.             throws IllegalArgumentException {  
26.         String url = ((FilterInvocation) object).getRequestUrl();  
27.         int firstQuestionMarkIndex = url.indexOf("?");  
28.         if (firstQuestionMarkIndex != -1) {  
29.             url = url.substring(0, firstQuestionMarkIndex);  
30.         }  
31.         if (firstQuestionMarkIndex != -1) {  
32.             url = url.substring(0, firstQuestionMarkIndex);  
33.         }  
34.         System.out.println("url:"+url);  
35.         List<ConfigAttribute> result = new ArrayList<ConfigAttribute>();  
36.         ConfigAttribute attribute = new SecurityConfig("ROLE_BASE");  
37.         result.add(attribute);  
38.         try {  
39.             List<Permission> permList = permDao.getPermissionByUrl(url);  
40.             for (Permission permission : permList) {  
41.                 ConfigAttribute conf = new SecurityConfig(permission.getPermName());  
42.                 result.add(conf);  
43.             }  
44.         } catch (Exception e) {  
45.             e.printStackTrace();  
46.         }  
47.         return result;  
48.     }  
49.   
50.     @Override  
51.     public Collection<ConfigAttribute> getAllConfigAttributes() {  
52.         // TODO Auto-generated method stub  
53.         return null;  
54.     }  
55.   
56.     @Override  
57.     public boolean supports(Class<?> clazz) {  
58.         // TODO Auto-generated method stub  
59.         return true;  
60.     }  
61.   
62. }  

[java]  view plain copy

1. package com.sz7road.web.security;  
2.   
3. import java.io.IOException;  
4. import java.util.Collection;  
5.   
6. import javax.servlet.Filter;  
7. import javax.servlet.FilterChain;  
8. import javax.servlet.FilterConfig;  
9. import javax.servlet.ServletException;  
10. import javax.servlet.ServletRequest;  
11. import javax.servlet.ServletResponse;  
12.   
13. import org.springframework.security.access.ConfigAttribute;  
14. import org.springframework.security.access.SecurityMetadataSource;  
15. import org.springframework.security.access.intercept.AbstractSecurityInterceptor;  
16. import org.springframework.security.access.intercept.InterceptorStatusToken;  
17. import org.springframework.security.core.Authentication;  
18. import org.springframework.security.core.context.SecurityContextHolder;  
19. import org.springframework.security.web.FilterInvocation;  
20. import org.springframework.security.web.access.intercept.FilterInvocationSecurityMetadataSource;  
21.   
22. public class MyFilterSecurityInterceptor extends AbstractSecurityInterceptor  
23.         implements Filter {  
24.   
25.     private FilterInvocationSecurityMetadataSource securityMetadataSource;  
26.   
27.     @Override  
28.     public void init(FilterConfig filterConfig) throws ServletException {  
29.     }  
30.   
31.     @Override  
32.     public void doFilter(ServletRequest request, ServletResponse response,  
33.             FilterChain chain) throws IOException, ServletException {  
34.         FilterInvocation fi = new FilterInvocation(request, response, chain);  
35.         invoke(fi);  
36.   
37.     }  
38.   
39.     @Override  
40.     public void destroy() {  
41.     }  
42.   
43.     @Override  
44.     public Class<?> getSecureObjectClass() {  
45.         return FilterInvocation.class;  
46.     }  
47.   
48.     @Override  
49.     public SecurityMetadataSource obtainSecurityMetadataSource() {  
50.         return this.securityMetadataSource;  
51.     }  
52.   
53.     public FilterInvocationSecurityMetadataSource getSecurityMetadataSource() {  
54.         return this.securityMetadataSource;  
55.     }  
56.   
57.   
58.     public void invoke(FilterInvocation fi) throws IOException,  
59.             ServletException {  
60.         InterceptorStatusToken token = super.beforeInvocation(fi);  
61.         try {  
62.             fi.getChain().doFilter(fi.getRequest(), fi.getResponse());  
63.         } finally {  
64.             super.afterInvocation(token, null);  
65.         }  
66.     }  
67.   
68.     public void setSecurityMetadataSource(  
69.             FilterInvocationSecurityMetadataSource securityMetadataSource) {  
70.         this.securityMetadataSource = securityMetadataSource;  
71.     }  
72.   
73. }