Spring Security 取Session中的值和修改userDetails

注意是SessionScrope

1.在session中取得spring security的登录用户名如下

${session.SPRING_SECURITY_CONTEXT.authentication.principal.username}

 

spring security 把SPRING_SECURITY_CONTEXT 放入了session 没有直接把username 放进去。

 下面一段代码主要描述的是session中的存的变量

[java]  view plain copy

1. 存跳转时候的URL  
2. session {SPRING_SECURITY_SAVED_REQUEST_KEY=SavedRequest[http://localhost:8080/AVerPortal/resourceAction/resourceIndex.action]}  
3.   
4. 存的是登录成功时候session中存的信息  
5. session {SPRING_SECURITY_CONTEXT=org.springframework.security.context.SecurityContextImpl@87b16984: Authentication: org.springframework.security.providers.cas.CasAuthenticationToken@87b16984: Principal: com.avi.casExtends.UserInfo@ff631d80: Username: test; Password: [PROTECTED]; Enabled: true; AccountNonExpired: true; credentialsNonExpired: true; AccountNonLocked: true; Granted Authorities: ROLE_ADMIN; Password: [PROTECTED]; Authenticated: true; Details: org.springframework.security.ui.WebAuthenticationDetails@12afc: RemoteIpAddress: 127.0.0.1; SessionId: AE56E8925195DFF4C50ABD384574CCEA; Granted Authorities: ROLE_ADMIN Assertion: org.jasig.cas.client.validation.AssertionImpl@661a11 Credentials (Service/Proxy Ticket): ST-3-1lX3acgZ6HNgmhvjXuxB-cas, userId=2, userName=test}  

2.在页面端用tag获取

<%@ taglib prefix='security' uri='http://www.springframework.org/security/tags'%>

 

<security:authentication property="principal.username"></security:authentication> 

或者

<security:authorize ifAllGranted="ROLE_ADMIN">

 <security:authentication property="principal.username"></security:authentication> 

</security:authorize>

 

或者取session中的值

#session.SPRING_SECURITY_CONTEXT.authentication.principal.username等同于

 

3.在后台获取

UserDetails userDetails = (UserDetails) SecurityContextHolder.getContext()
    .getAuthentication()
    .getPrincipal();

 

userDetails.getUsername()

 

想要获取更多的信息得扩展userDetails的默认实现类user类和UserDetailsService接口

由于springsecurity是把整个user信息放入session中的即：session.SPRING_SECURITY_CONTEXT.authentication.principal

这个就是代表着user对象

 

因此我做了扩展增加user里的信息 加上userId

代码如下：扩展user

[java]  view plain copy

1. package com.avi.casExtends;  
2.   
3. import org.springframework.security.GrantedAuthority;  
4. import org.springframework.security.userdetails.User;  
5.   
6. public class UserInfo extends User{  
7.     private static final long serialVersionUID = 1L;  
8.   
9.     private String userId;  
10.   
11.     @SuppressWarnings("deprecation")  
12.     public UserInfo(String username, String password, boolean enabled, GrantedAuthority[] authorities)  
13.         throws IllegalArgumentException {  
14.         super(username,password, enabled, authorities);  
15.     }  
16.   
17.     public String getUserId() {  
18.         return userId;  
19.     }  
20.   
21.     public void setUserId(String userId) {  
22.         this.userId = userId;  
23.     }  
24.   
25.     public static long getSerialVersionUID() {  
26.         return serialVersionUID;  
27.     }  
28.   
29.     
30. }  

 

实现userDetailsservice接口

[java]  view plain copy

1. package com.avi.casExtends;  
2.   
3. import java.util.HashMap;  
4. import java.util.List;  
5. import java.util.Map;  
6.   
7. import org.springframework.dao.DataAccessException;  
8. import org.springframework.security.GrantedAuthority;  
9. import org.springframework.security.GrantedAuthorityImpl;  
10. import org.springframework.security.userdetails.UserDetails;  
11. import org.springframework.security.userdetails.UserDetailsService;  
12. import org.springframework.security.userdetails.UsernameNotFoundException;  
13.   
14. import com.avi.dao.AccountDao;  
15. import com.avi.data.User;  
16.   
17. public class UserInfoService implements UserDetailsService{  
18.       
19.     private AccountDao accountDao;  
20.     private Map<String, UserInfo> userMap = null;  
21.   
22.     public UserInfoService() {  
23.          
24.           
25.     }  
26.     public void fillMap(){  
27.          userMap = new HashMap<String, UserInfo>();  
28.          List<User> users = accountDao.findAllUsers();  
29.          UserInfo userInfo = null;  
30.          for(User user:users){  
31.             userInfo = new UserInfo(user.getUserName(),user.getPassword(),true,new GrantedAuthority[]{  
32.                 new GrantedAuthorityImpl(user.getRole()),  
33.             });  
34.             userInfo.setUserId(user.getId().toString());  
35.               
36.              userMap.put(user.getUserName(), userInfo);  
37.          }  
38.     }  
39.       
40.     public UserDetails loadUserByUsername(String username)  
41.         throws UsernameNotFoundException, DataAccessException {  
42.         if(userMap==null)  
43.             fillMap();  
44.         return userMap.get(username);  
45.     }  
46.   
47.     public AccountDao getAccountDao() {  
48.         return accountDao;  
49.     }  
50.   
51.     public void setAccountDao(AccountDao accountDao) {  
52.         this.accountDao = accountDao;  
53.     }  
54.   
55.     public Map<String, UserInfo> getUserMap() {  
56.         return userMap;  
57.     }  
58.   
59.     public void setUserMap(Map<String, UserInfo> userMap) {  
60.         this.userMap = userMap;  
61.     }  
62.   
63. }  

 

 private AccountDao accountDao;是注入进来的查数据库的类

 

然后修改XML文件指定所要用到的service

[java]  view plain copy

1. <authentication-provider user-service-ref="userDetailsService"/>  
2.   
3. <bean id="userDetailsService" class="com.avi.casExtends.UserInfoService" singleton="false">  
4.         <property name="accountDao" ref="accountDao"/>  
5. </bean>  

 

 

 

 

${session.SPRING_SECURITY_CONTEXT.authentication.principal.username}