今天看到appfuse2.0.2里acegi的配置文件非常奇怪,到appfuse官网查看原来将appfuse2.0.2包含的acegi1.0升级到了acegi2.0 ,同1.0比起变化很大,名称也改为spring security2.0.下面是简单配置使用步骤
1、第一件事是把下面的filter声明添加到 web.xml 文件中:
<filter> <filter-name>springSecurityFilterChain</filter-name> <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class> </filter> <filter-mapping> <filter-name>springSecurityFilterChain</filter-name> <url-pattern>/*</url-pattern> </filter-mapping>
2.配置信息都放到application-security.xml里(名称可改),要加上命名空间
<beans:beans xmlns="http://www.springframework.org/schema/security" xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.0.xsd http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-2.0.2.xsd"> ... </beans:beans>
3、其次为路径,地址增加权限。
<intercept-url pattern="/**" access="ROLE_USER" />
这表示,我们要保护应用程序中的所有URL,只有拥有 ROLE_USER角色的用户才能访问。
例如:
<http auto-config="true" lowercase-comparisons="false"> <!--intercept-url pattern="/images/*" filters="none"/> <intercept-url pattern="/styles/*" filters="none"/> <intercept-url pattern="/scripts/*" filters="none"/--> <intercept-url pattern="/admin/*" access="ROLE_ADMIN"/> <intercept-url pattern="/passwordHint.html*" access="ROLE_ANONYMOUS,ROLE_ADMIN,ROLE_USER"/> <intercept-url pattern="/signup.html*" access="ROLE_ANONYMOUS,ROLE_ADMIN,ROLE_USER"/> <intercept-url pattern="/a4j.res/*.html*" access="ROLE_ANONYMOUS,ROLE_ADMIN,ROLE_USER"/> <!-- APF-737, OK to remove line below if you're not using JSF --> <intercept-url pattern="/**/*.html*" access="ROLE_ADMIN,ROLE_USER"/> <form-login login-page="/login.jsp" authentication-failure-url="/login.jsp?error=true" login-processing-url="/j_security_check"/> <remember-me user-service-ref="userDao" key="e37f4b31-0c45-11dd-bd0b-0800200c9a66"/> </http>
4、 指定数据库 和 密码加密
<authentication-provider user-service-ref="userDao"> <password-encoder ref="passwordEncoder"/> </authentication-provider>
5、方法授权
<global-method-security> <protect-pointcut expression="execution(* *..service.UserManager.getUsers(..))" access="ROLE_ADMIN"/> <protect-pointcut expression="execution(* *..service.UserManager.removeUser(..))" access="ROLE_ADMIN"/> </global-method-security>
6、Session控制
Acegi2.0 的session 控制真是简单,只能用简单得一米来形容J
首先在web.xml 中加个Listener:
<listener> <listener-class> org.springframework.security.ui.session.HttpSessionEventPublisher </listener-class> </listener>
然后在application-security.xml 中配置规则:
<http> <concurrent-session-control max-sessions="1" /> </http> 或 <http> <concurrent-session-control max-sessions="1" exception-if-maximum-exceeded="true" /> </http>
解释说明:两个配置都只允许用户登录一次,exception-if-maximum-exceeded 默认为false,此值表示:
用户第二次登录时,前一次的登录信息都被清空。当exception-if-maximum-exceeded="true"时系统会拒
绝第二次登录。