sping AOP 权限管理方案浅析

此权限系统把待访问的业务方法作为要访问的资源，通过spring aop 对接口进行拦截，然后经过自己代码的管理，可以实现细粒度的权限管理。细化到一个方法上。
方法拦截部分代码：

package test;

import java.security.Permission;

import org.aopalliance.intercept.MethodInterceptor;
import org.aopalliance.intercept.MethodInvocation;

public class PermissionCheckAroundAdvice implements MethodInterceptor {

	SecurityManager securityMgr= new SecurityManager();


	public SecurityManager getSecurityMgr() {
		return securityMgr;
	}
	public void setSecurityMgr(SecurityManager securityMgr) {
		this.securityMgr = securityMgr;
	}


	public Object invoke(MethodInvocation invocation) throws Throwable {
		// TODO Auto-generated method stub
		System.out.println("(被调用方法接口类名: "
				+ invocation.getMethod().getDeclaringClass().getName() + ")");
		System.out.println("(被调用方法名：" + invocation.getMethod().getName()+ ")");
		String methodName = invocation.getMethod().getDeclaringClass().getName()
		        + "." + invocation.getMethod().getName();
		System.out.println("(被调用方法全名：" + methodName + ")");
		System.out.println("有否权限:"+securityMgr.checkPermission(methodName));
		if(securityMgr.checkPermission(methodName))
			return invocation.proceed();
		System.out.println("Goodbye! NO Permission!(by " + this.getClass().getName() + ")");
		return "--";
	}

}

他会拦截业务层调用的每一个方法。试想既然我知道了 你调用的哪个方法而且方法是我自己写得 方法是做什么的我当然知道。接下来是不是就可以对权限细化做具体实现了。
SecurityManager：

package test;

public class SecurityManager {
	User user;

	public User getUser() {
		return user;
	}

	public void setUser(User user) {
		this.user = user;
	}

	public boolean checkPermission(String privilege){
		return checkPermission(user,privilege);
	}
	public boolean checkPermission(User user, String privilege){
		return user.isPermission(privilege);
    }
}

User:

package test;

import java.util.ArrayList;
import java.util.Iterator;
import java.util.List;

public class User {

	List privilages=new ArrayList();
	String name;
	public User(){

	}
	public List getPrivilages() {
		return privilages;
	}
	public void setPrivilages(List privilages) {
		this.privilages = privilages;
	}
	public String getName() {
		return name;
	}
	public void setName(String name) {
		this.name = name;
	}

	public boolean isPermission(String pri){
		Iterator it=privilages.iterator();
		System.out.println("privilages : "+privilages.size());
		String p="";
		boolean pass=false;
		while(it.hasNext()){
			p=(String) it.next();
			System.out.println(p);
			if(p.equals(pri)){
				pass=true;
				break;
			}
		}
		return pass;
	}

}

Service:

package test;

public interface Service {

	public String getBeanInfo();
}

ServiceBean:

package test;

public class ServiceBean implements Service{

	ResourceBean bean;

	public void setBean(ResourceBean bean) {
		this.bean = bean;
	}

	public String getBeanInfo() {
		// TODO Auto-generated method stub
		String result="";
		result+=bean.getMethod1();
		result+=bean.getMethod2();
		result+=bean.getMethod3();

		return result;
	}

}

ResourceBean:

package test;

public interface ResourceBean extends Resource{

		public void theMethod();
		public String getMethod1();
		public String getMethod2();
		public String getMethod3();
}

ResourceBeanImpl:

package test;

public class ResourceBeanImpl implements ResourceBean {

	public void theMethod(){
		System.out.println(this.getClass().getName()
				+"."+new Exception().getStackTrace()[0].getMethodName()
				+"()"
				+" say Hello!");
	}
	public String getMethod1(){
		return "zhangsan";
	}
	public String getMethod2(){
		return "lisi";

	}
	public String getMethod3(){
		return "wangwu";
	}
	public void afterPropertiesSet(){
		System.out.println("事件监听：类 ResourceBeanImpl属性设置完毕");
	}
}

Resource:

package test;

public interface Resource {

}

测试类SpringAopTest：

package test;

import org.springframework.context.ApplicationContext;
import org.springframework.context.support.ClassPathXmlApplicationContext;

public class SpringAopTest {

	public static void main(String[] args) {
		ApplicationContext ctx
		    =new ClassPathXmlApplicationContext("applicationContext.xml");
		String name="";
	    Service sb= (Service) ctx.getBean("service");
	        name=sb.getBeanInfo();

	        System.out.println("test result::"+name);
	}
}

下面是配置文件applicationContext.xml

<?xml version="1.0" encoding="UTF-8"?>
<beans
	xmlns="http://www.springframework.org/schema/beans"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.5.xsd">


   <bean id="bean" class="org.springframework.aop.framework.ProxyFactoryBean">
       <property name="proxyInterfaces">
           <value>
              test.ResourceBean
           </value>
       </property>
       <property name="target">
           <ref local="beanTarget"/>
       </property>
       <property name="interceptorNames">
          <list>
            <value>permissionAroundAdvisor</value>
          </list>
       </property>
   </bean>
   <bean id="service" class="org.springframework.aop.framework.ProxyFactoryBean">
        <property name="proxyInterfaces">
             <value>test.Service</value>
        </property>
        <property name="target">
             <ref local="serviceBean"/>
        </property>
        <property name="interceptorNames">
          <list>
            <value>permissionAroundAdvisor</value>
          </list>
       </property>
   </bean>

   <bean id="beanTarget" class="test.ResourceBeanImpl"/>
   <bean id="user" class="test.User">
       <property name="name">
           <value>tester</value>
       </property>
       <property name="privilages">
          <list>
            <value>test.ResourceBean.getMethod3</value>
            <value>test.ResourceBean.getMethod1</value>
              <value>test.ResourceBean.getMethod2</value>
            <value>test.Service.getBeanInfo</value>
          </list>
       </property>
   </bean>
   <bean id="securityMgr" class="test.SecurityManager">
       <property name="user">
          <ref local="user"/>
       </property>
   </bean>
   <bean id="serviceBean" class="test.ServiceBean">
       <property name="bean">
          <ref local="bean"/>
       </property>
   </bean>
   <bean id="permissionAroundAdvisor" class="org.springframework.aop.support.RegexpMethodPointcutAdvisor">
     <property name="advice" >
       <ref local="thePermissionAroundAdvice"/>
     </property>
     <property name="pattern">
       <value>.*</value>
     </property>
   </bean>
   <bean id="thePermissionAroundAdvice" class="test.PermissionCheckAroundAdvice"> 
         <property name="securityMgr">
            <ref local="securityMgr"/>
         </property>
   </bean>
</beans>

处理权限问题一般需要资源库（就是具有权限可以访问什么资源），权限（分出一个个权限让他们对应资源库中的资源，设定具有这个权限可以对什么资源进行访问），角色（拥有什么权限可以有多个），用户（具有什么角色）。
权限细粒度的划分可以通过对权限和角色等进行设计实现对应现实生活中的权限实现。这里对其的德代码实现使用spring aop 。
上面已经可以得到你访问的时候调用的各个业务方法。配置文件中定义有user节点中有privilages属性这里面可以定义用户对应角色下的权限的所有资源。我们可以拦截到他是否越权。然后可以对其越权行为进行屏蔽。
这里只是一个简单的原型。希望可以给大家带来帮助
下面是代码包