JSF的权限设计

角色受限采访URL。
由于JSF的流程在Servlet Filter之后， 所以不能使用Filter的层面获取到JSF的一些请求路径信息，即javax.faces.context.FacesContext.getCurrentInstance()应该是空的。
这里可以使用javax.faces.event.PhaseListener来获取请求和输出路径信息。在face-config.xml配置好即可获取到请求和输出的页面路径。例如，用户当前处于公用页面A.jsf, 现在按链接想跳转到B.jsf; JSF首先会恢复A.jsf的视图，这时PhaseListener，验证合法就输出视图到B.jsf， 这时又会来到PhaseListener 恢复视图B.jsf, 可以将鉴权的代码添加到或BeforeParse， AfterParse方法里。
ParseListener对h:outputLink或CommandLink是应该是可行的，因为只是对链接进行限制。 如果对于CommandButton可能是不行的，例如A.jsf 点击按钮action="#{bBean.bAction}",
public String bAction() ...{
//能够进入到方法内部，如果这里是很多逻辑操作，数据操作的话。。。。
return "B_JSF";
//只有在return之后ParseListener才能限制鉴权，那就晚了。而链接就不同，因为它没什么逻辑操作。
}

这种鉴权就要用到下面提到的第二种方法。

package web;

import java.io.IOException;
import javax.faces.context.ExternalContext;
import javax.faces.context.FacesContext;
import javax.faces.event.PhaseEvent;
import javax.faces.event.PhaseId;
import javax.faces.event.PhaseListener;
import javax.servlet.ServletContext;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;

/** *//**
* @author zealvampire
* @version 1.0 2006-10-17
*/
public class SecurityPhaseListener implements PhaseListener ...{

private static final long serialVersionUID = 6186106530012195240L;

private static final Log log = LogFactory.getLog(SecurityPhaseListener.class);


/**//* (non-Javadoc)
* @see javax.faces.event.PhaseListener#afterPhase(javax.faces.event.PhaseEvent)
*/
public void afterPhase(PhaseEvent event) ...{

PhaseId phaseId = event.getPhaseId();
if (phaseId == PhaseId.RESTORE_VIEW || phaseId == PhaseId.INVOKE_APPLICATION) ...{
FacesContext currentContext = FacesContext.getCurrentInstance();
String viewId= currentContext.getViewRoot().getViewId();
//ViewId 就是我们需要的路径，类似URL
}

/**//* (non-Javadoc)
* @see javax.faces.event.PhaseListener#beforePhase(javax.faces.event.PhaseEvent)
*/
public void beforePhase(PhaseEvent event) ...{
}

/** *//**
* (non-Javadoc)
* @see javax.faces.event.PhaseListener#getPhaseId()
*/
public PhaseId getPhaseId() ...{
return PhaseId.ANY_PHASE;
}

}

face-config.xml
<faces-config>
<lifecycle>
<phase-listener>
web.SecurityPhaseListener
</phase-listener>
</lifecycle>
</face-config>


2. 扑获JSF中用户要执行的Action
例子，用户在A.jsf点击CommandButton action="#{bBean.bAction}" 要是我们能在这个动作执行之前扑获到它并进行鉴权的话， 那就Sofu了。
这个我是看Myfaces源码以及看face-config.xml格式看到的， 里面有个ActionListener, 猜猜是什么东西？ 是的，就像写Swing一样，用来处理消息和动作的。先看看Myfaces的默认实现。
/**//*
* Copyright 2004 The Apache Software Foundation.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.apache.myfaces.application;

import javax.faces.FacesException;
import javax.faces.application.Application;
import javax.faces.application.NavigationHandler;
import javax.faces.component.ActionSource;
import javax.faces.context.FacesContext;
import javax.faces.el.EvaluationException;
import javax.faces.el.MethodBinding;
import javax.faces.event.AbortProcessingException;
import javax.faces.event.ActionEvent;
import javax.faces.event.ActionListener;

import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;


/** *//**
* @author Manfred Geiler (latest modification by $Author: mbr $)
* @author Anton Koinov
* @version $Revision: 231425 $ $Date: 2005-08-11 07:49:45 -0400 (Thu, 11 Aug 2005) $
*/
public class ActionListenerImpl
implements ActionListener
...{
private static final Log log = LogFactory.getLog(ActionListenerImpl.class);

public void processAction(ActionEvent actionEvent) throws AbortProcessingException
...{
FacesContext facesContext = FacesContext.getCurrentInstance();
Application application = facesContext.getApplication();

ActionSource actionSource = (ActionSource)actionEvent.getComponent();
MethodBinding methodBinding = actionSource.getAction();

String fromAction;
String outcome;
if (methodBinding == null)
...{
fromAction = null;
outcome = null;
}
else
...{
fromAction = methodBinding.getExpressionString();
try
...{
outcome = (String) methodBinding.invoke(facesContext, null);
}
catch (EvaluationException e)
...{
Throwable cause = e.getCause();
if (cause != null && cause instanceof AbortProcessingException)
...{
throw (AbortProcessingException)cause;
}
else
...{
throw new FacesException("Error calling action method of component with id " + actionEvent.getComponent().getClientId(facesContext), e);
}
}
catch (RuntimeException e)
...{
throw new FacesException("Error calling action method of component with id " + actionEvent.getComponent().getClientId(facesContext), e);
}
}

NavigationHandler navigationHandler = application.getNavigationHandler();
navigationHandler.handleNavigation(facesContext,
fromAction,
outcome);
//Render Response if needed
facesContext.renderResponse();

}
}

看到fromAction = methodBinding.getExpressionString();这个你就偷笑了吧，那确实，这个就是我们要的bBean.bAction 模仿这个类重新写一个类吧,。然后在face-config.xml配置一下。

<application>
<variable-resolver>
org.springframework.web.jsf.DelegatingVariableResolver
</variable-resolver>
<action-listener>OurOwnActionListenerImpl</action-listener>
</application>

ActionListener是一个接口，我想在其他JSF的实现,应该也是通过的吧。