spring-security3 配置和使用（二）承上-CSDN博客

本文链接：https://blog.csdn.net/kong0csd/article/details/84118512

2、xml配置,配置内容如下:

Xml代码

<? xml version = "1.0" encoding = "UTF-8" ?>

< beans:beans xmlns = "http://www.springframework.org/schema/security" xmlns:beans = "http://www.springframework.org/schema/beans" xmlns:xsi = "http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation ="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.0.xsd" > <!-- auto-config = true 则使用from-login. 如果不使用该属性则默认为http-basic(没有session). access-denied-page:出错后跳转到的错误页面; -- >

< http auto-config = "true" access-denied-page = "/common/403.jsp" >

< intercept-url pattern = "/index.jsp" access = "ROLE_USER" />

< intercept-url pattern = "/login.jsp" filters = "none" />

< intercept-url pattern = "/common/**" filters = "none" />

< intercept-url pattern = "/script/**" filters = "none" />

< intercept-url pattern = "/admin.jsp" access = "ROLE_ADMIN" />

< intercept-url pattern = "/user.jsp" access = "ROLE_USER" />

<!-- id登陆唯一. 后登陆的账号会挤掉第一次登陆的账号 error-if-maximum-exceeded = "true" 禁止2次登陆; session-fixation-protection = "none" 防止伪造sessionid攻击. 用户登录成功后会销毁用户当前的session. 创建新的session,并把用户信息复制到新session中. -- >

< session-management session-fixation-protection = "none" >

< concurrency-control />

</ session-management >

< form-login login-page = "/login.jsp" authentication-failure-url = "/common/403.jsp" default-target-url = "/admin.jsp" />

< logout logout-success-url = "/login.jsp" />

< http-basic />

</ http > <!-- 连接池.我spring配置文件中配的有.所以这里就注掉了. < beans:bean id = "dataSource" class = "org.apache.commons.dbcp.BasicDataSource" > < beans:property name = "driverClassName" value = "com.mysql.jdbc.Driver" /> < beans:property name = "url" value = "jdbc:mysql://localhost/demo" />

< beans:property name = "username" value = "root" />

< beans:property name = "password" value = "root" />

</ beans:bean > -- >

< authentication-manager >

< authentication-provider >

<!-- 密码加密方式. 常用的有md5 和 sha. salt-source:忘记了.. 手头api关了,网速卡就不上网查了. 类似在md5上又加了一层. 放置暴力破解. 追加安全性.

< password-encoder hash = "md5" >

< salt-source user-property = "username" />

</ password-encoder > -- >

< jdbc-user-service data-source-ref = "dataSource" users-by-username-query = "select username,password,enabled from user where username = ? and enabled = 1" authorities-by-username-query = "select u.username,r.name from user u join user_role ur on u.uid = ur.uid join role r on r.rid = ur.rid where u.username = ?" /> <!-- 使用固定的用户名和密码及权限来做验证.

< userservice >

< user name = "admin" password = "admin" authorities = "ROLE_USER, ROLE_ADMIN" />

< user name = "user" password = "user" authorities = "ROLE_USER" />

</ user-service > -- >

</ authentication-provider > </ authentication-manager >  <!-- 此配置只是自己学习的一个小demo. 数据库也建的比较随意比较简单. 使用的是角色权限. 个人比较推荐组权限来控制.. (由于工作经验限制,此处为个人理解) 我的库如下: user:username\password\enabled role:name\desc user_role:uid\rid -- > </ beans:beans >

<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security"
xmlns:beans="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
http://www.springframework.org/schema/security

http://www.springframework.org/schema/security/spring-security-3.0.xsd">

<http auto-config="true" access-denied-page="/common/403.jsp">

<intercept-url pattern="/index.jsp" access="ROLE_USER" />
<intercept-url pattern="/login.jsp" filters="none" />
<intercept-url pattern="/common/**" filters="none" />
<intercept-url pattern="/script/**" filters="none" />
<intercept-url pattern="/admin.jsp" access="ROLE_ADMIN" />
<intercept-url pattern="/user.jsp" access="ROLE_USER" />



<session-management session-fixation-protection="none">
<concurrency-control/>
</session-management>

<form-login login-page="/login.jsp"
authentication-failure-url="/common/403.jsp"
default-target-url="/admin.jsp" />

<logout logout-success-url="/login.jsp"/>
<http-basic />
</http>


<authentication-manager>
<authentication-provider>


<jdbc-user-service data-source-ref="dataSource"
users-by-username-query="select username,password,enabled from user where username = ? and enabled = 1"
authorities-by-username-query="select u.username,r.name from user u join user_role ur on u.uid = ur.uid join role r on r.rid = ur.rid where u.username = ?" />

</authentication-provider>
</authentication-manager>

</beans:beans>

spring security3 所需要的包整合：

aopalliance-1.0.jar
aspectjrt-1.5.4.jar
aspectjweaver.jar
commons-codec-1.3.jar
commons-collections-3.2.jar
commons-logging-1.1.1.jar
jstl-1.1.2.jar
log4j-1.2.14.jar
spring-aop-2.0.8.jar
spring-beans-2.0.8.jar
spring-context-2.0.8.jar
spring-core-2.0.8.jar
spring-dao-2.0.8.jar
spring-jdbc-2.0.8.jar
spring-security-acl-2.0.4.jar
spring-security-core-2.0.4.jar
spring-security-core-tiger-2.0.4.jar
spring-security-taglibs-2.0.4.jar
spring-support-2.0.8.jar
spring-web-2.0.8.jar
spring-webmvc-2.0.8.jar
standard-1.1.2.jar