第一步,配置文件
<?xml version="1.0" encoding="UTF-8"?> <beans:beans xmlns="http://www.springframework.org/schema/security" xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.1.xsd"> <http auto-config="true"> <!-- 图片可以匿名访问 --> <intercept-url pattern="/images/**" access="IS_AUTHENTICATED_ANONYMOUSLY"/> <!-- js可以匿名访问 --> <intercept-url pattern="/javaScript/**" access="IS_AUTHENTICATED_ANONYMOUSLY"/> <!-- css样式可以匿名访问 --> <intercept-url pattern="/css/**" access="IS_AUTHENTICATED_ANONYMOUSLY"/> <!-- 登录处理地址样式可以匿名访问 --> <intercept-url pattern="/login" access="IS_AUTHENTICATED_ANONYMOUSLY"/> <!-- 登录界面可以匿名访问 --> <intercept-url pattern="/login.jsp*" access="IS_AUTHENTICATED_ANONYMOUSLY"/> <!-- 除以上其他地址需要登录 --> <intercept-url pattern="/**" access="ROLE_USER"/> <!--登录表单配置,包括失败跳转地址、登录处理地址、表单用户名域名称、表单密码域名称 --> <!-- login-processing-url 指定action可以做登录前的一些验证 default-target-url 指定action可以做登录成功后的一些事 --> <form-login login-page="/login.jsp" authentication-failure-url="/login.jsp?login_error=1" login-processing-url="/login" username-parameter="loginName" password-parameter="loginPassword" default-target-url="/index.jsp" always-use-default-target="true"/> <!-- session-fixation-protection=none防止伪造session max-sessions 同一账号可以登录几次 error-if-maximum-exceeded =true 表示第二次登录被阻止 =false第二次登录时将会把第一次T掉 --> <session-management invalid-session-url="/login.jsp" session-fixation-protection="none"> <concurrency-control max-sessions="1" error-if-maximum-exceeded="true"/> </session-management> </http> <!-- 配置权限管理 --> <authentication-manager> <!-- 提供获取登录用户的服务 --> <authentication-provider user-service-ref="dataBaseUserDetailsService"></authentication-provider> </authentication-manager> </beans:beans>
第二步,编写三个类
DataBaseUserDetailsService.java
package cn.**.service.login;
import org.springframework.security.core.userdetails.UserDetailsService;
/**
* <p>用于spring-security登录</p>
* @version 1.0
*/
public interface DataBaseUserDetailsService extends UserDetailsService{
}
DataBaseUserDetailsServiceImpl.java
package cn.**.service.login.impl;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import cn.flyingsoft.bean.user.User;
import cn.flyingsoft.service.base.BaseService;
import cn.flyingsoft.service.login.DataBaseUserDetailsService;
import cn.flyingsoft.service.message.MessageService;
import cn.flyingsoft.service.user.UserService;
/**
* <p>用于spring-security登录</p>
* @version 1.0
*/
public class DataBaseUserDetailsServiceImpl extends BaseService implements DataBaseUserDetailsService {
/**
* 用户服务
*/
private UserService userService ;
/**
* <p>根据用户名获取用户信息</p>
* @version 1.0
* @see org.springframework.security.core.userdetails.UserDetailsService#loadUserByUsername(java.lang.String)
* @param username
* @return UserDetails
* @throws UsernameNotFoundException
*/
public UserDetails loadUserByUsername(String userName) throws UsernameNotFoundException {
User user = userService.getUser(userName) ;
if(user == null){
return null ;
}
return new DataBaseUserDetails(user);
}
/**
* @param userService the userService to set
*/
public void setUserService(UserService userService) {
this.userService = userService;
}
}
DataBaseUserDetails.java
package cn.flyingsoft.service.login.impl;
import java.util.ArrayList;
import java.util.Collection;
import java.util.List;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.userdetails.UserDetails;
import cn.flyingsoft.bean.user.User;
/**
* <p>用于spring-security登录</p>
* @version 1.0
*/
public class DataBaseUserDetails implements UserDetails {
private static final long serialVersionUID = 6104648032859713159L;
/**
* 用户实体
*/
private User user ;
public DataBaseUserDetails(User user){
this.user = user ;
}
public Collection<GrantedAuthority> getAuthorities() {
List<GrantedAuthority> list = new ArrayList<GrantedAuthority>() ;
list.add(new GrantedAuthority(){
private static final long serialVersionUID = -1182852062644443773L;
public String getAuthority() {
return "ROLE_USER";
}
}) ;
return list;
}
public String getPassword() {
return user.getLoginPassWord() ;
}
public String getUsername() {
return user.getLoginName() ;
}
public boolean isAccountNonExpired() {
return true ;
}
public boolean isAccountNonLocked() {
return true ;
}
public boolean isCredentialsNonExpired() {
return true ;
}
public boolean isEnabled() {
return true ;
}
public User getUser(){
return user ;
}
}
注:一定要重写DataBaseUserDetails和User的toString()、hasCode()两个方法,不然重复登录不会启作用。