spring security2学习笔记二(自定义数据结构及登陆页面)

 

一、定义数据结构（mysql）:

      ①角色表：

      CREATE TABLE `role` (
      `id` int(11) NOT NULL auto_increment,
      `name` varchar(50) NOT NULL,
      PRIMARY KEY  (`id`)
       ) ENGINE=InnoDB DEFAULT CHARSET=utf8;

      ②用户表：

      CREATE TABLE `user` (
      `id` int(11) NOT NULL auto_increment,
      `username` varchar(50) NOT NULL default '',
      `password` varchar(50) NOT NULL,
      `status` int(11) NOT NULL,
      PRIMARY KEY  (`id`)
       ) ENGINE=InnoDB DEFAULT CHARSET=utf8;

       注：status为1才有效

       ③用户角色连接表：

       CREATE TABLE `user_role` (
       `user_id` int(20) default NULL,
       `role_id` int(20) default NULL,
       KEY `FK_user` (`user_id`),
       KEY `FK_role` (`role_id`),
       CONSTRAINT `FK_role` FOREIGN KEY (`role_id`) REFERENCES `role` (`id`),
       CONSTRAINT `FK_user` FOREIGN KEY (`user_id`) REFERENCES `user` (`id`)
        ) ENGINE=InnoDB DEFAULT CHARSET=utf8;
二、添加hibernate、spring框架后，applicationContext.xml:

     
<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 xmlns:tx="http://www.springframework.org/schema/tx"
 xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.0.xsd">
 <bean id="dataSource"
  class="org.apache.commons.dbcp.BasicDataSource">
  <property name="driverClassName"
   value="com.mysql.jdbc.Driver">
  </property>
  <property name="url" value="jdbc:mysql://localhost:3306/ss"></property>
  <property name="username" value="root"></property>
  <property name="password" value="root"></property>
 </bean>
 <bean id="sessionFactory"
  class="org.springframework.orm.hibernate3.LocalSessionFactoryBean">
  <property name="dataSource">
   <ref bean="dataSource"></ref>
  </property>
  <property name="hibernateProperties">
   <props>
    <prop key="hibernate.dialect">
     org.hibernate.dialect.MySQLDialect
    </prop>
   </props>
  </property>
  <property name="mappingResources">
   <list>
    <value>ss/model/Role.hbm.xml</value>
    <value>ss/model/UserRole.hbm.xml</value>
    <value>ss/model/User.hbm.xml</value></list>
  </property></bean>
 </beans>

三、spring security配置文件：(applicationContext-Security.xml)

     <?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security"
    xmlns:beans="http://www.springframework.org/schema/beans"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.springframework.org/schema/beans
    http://www.springframework.org/schema/beans/spring-beans-2.0.xsd
    http://www.springframework.org/schema/security
    http://www.springframework.org/schema/security/spring-security-2.0.4.xsd">
 <http auto-config='true'>
  <intercept-url pattern="/login.jsp" access="IS_AUTHENTICATED_ANONYMOUSLY" />
  <intercept-url pattern="/admin.jsp" access="ROLE_ADMIN" />
  <intercept-url pattern="/**" access="ROLE_USER" />

   <!——此处配置自定义登陆页面——>
<form-login login-page="/login.jsp"
                authentication-failure-url="/login.jsp?error=true"
                default-target-url="/index.jsp" />
 </http>

 <authentication-provider>
  <jdbc-user-service data-source-ref="dataSource"
  users-by-username-query="select username,password,status as enabled
                                         from user
                                        where username=?"
            authorities-by-username-query="select u.username,r.name as authority
                                             from user u
                                             join user_role ur
                                               on u.id=ur.user_id
                                             join role r
                                               on r.id=ur.role_id
                                            where u.username=?"/>
 </authentication-provider>

 
</beans:beans>

其中，

login-page表示用户登陆时显示我们自定义的login.jsp。

 

 四、自定义的登陆页面：

login.jsp:

<%@ page language="java" import="java.util.*" pageEncoding="utf-8"%>
<%
 String path = request.getContextPath();
 String basePath = request.getScheme() + "://"
   + request.getServerName() + ":" + request.getServerPort()
   + path + "/";
%>

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
 <head>
  <base href="<%=basePath%>">

  <title>My JSP 'login.jsp' starting page</title>

  <meta http-equiv="pragma" content="no-cache">
  <meta http-equiv="cache-control" content="no-cache">
  <meta http-equiv="expires" content="0">
  <meta http-equiv="keywords" content="keyword1,keyword2,keyword3">
  <meta http-equiv="description" content="This is my page">
  <!--
 <link rel="stylesheet" type="text/css" href="styles.css">
 -->

 </head>

 <body>
  <div class="error ${param.error == true ? '' : 'hide'}">
   登陆失败
   <br>
   ${sessionScope['SPRING_SECURITY_LAST_EXCEPTION'].message}
  </div>
  <form
   action="${pageContext.request.contextPath}/j_spring_security_check"
   style="width: 260px; text-align: center;">
   <fieldset>
    <legend>
     登陆
    </legend>
    用户：
    <input type="text" name="j_username" style="width: 150px;"
     value="${sessionScope['SPRING_SECURITY_LAST_USERNAME']}" />
    <br />
    密码：
    <input type="password" name="j_password" style="width: 150px;" />
    <br />
    <input type="checkbox" name="_spring_security_remember_me" />
    两周之内不必登陆
    <br />
    <input type="submit" value="登陆" />
    <input type="reset" value="重置" />
   </fieldset>
  </form>

 </body>
</html>

 

users-by-username-query为根据用户名查找用户，系统通过传入的用户名查询当前用户的登录名，密码和是否被禁用这一状态。

authorities-by-username-query为根据用户名查找权限，系统通过传入的用户名查询当前用户已被授予的所有权限。

authentication-failure-url表示用户登陆失败时，跳转到哪个页面。当用户输入的登录名和密码不正确时，系统将再次跳转到/login.jsp，并添加一个error=true参数作为登陆失败的标示。

 

default-target-url表示登陆成功时，跳转到哪个页面。