费死个劲,贴部分strus2.1+spring3.0+hibernate3 构造的spring security3.0的工程:
<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security"
xmlns:beans="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.0.xsd"
>
<!-- 监听各种用户认证事件 -->
<beans:bean id="loggerListener" class="org.springframework.security.authentication.event.LoggerListener" />
<!-- 监控各种用户授权事件 >-->
<beans:bean id="authorizationLoggerListener" class="org.springframework.security.access.event.LoggerListener"/>
<http auto-config="true" access-denied-page="/403.jsp" >
<intercept-url pattern="/login.jsp" filters="none" />
<form-login login-page="/login.jsp" authentication-failure-url="/login.jsp?error=true" default-target-url="/main.jsp" />
<logout logout-success-url="/login.jsp"/>
<http-basic />
<custom-filter before ="FILTER_SECURITY_INTERCEPTOR" ref ="dbSecurityInterceptor" />
</http>
<authentication-manager alias="authenticationManager" >
<authentication-provider user-service-ref="securityManager" />
</authentication-manager>
<!-- 用户查询 -->
<beans:bean id="securityManager"
class="com.oumasoft.security.business.service.impl.BaseUserDetailsServiceImpl">
<beans:property name="baseuserdetailsDao" ref="baseuserdetailsDao" />
</beans:bean>
<beans:bean id="accessDecisionManager" class="org.springframework.security.access.vote.AffirmativeBased">
<beans:property name="allowIfAllAbstainDecisions" value="false"/>
<beans:property name="decisionVoters">
<beans:list>
<beans:bean class="org.springframework.security.access.vote.RoleVoter">
<beans:property name="rolePrefix" value="ROLE_" />
</beans:bean>
<beans:bean class="org.springframework.security.access.vote.AuthenticatedVoter"/>
</beans:list>
</beans:property>
</beans:bean>
<beans:bean id="dbSecurityInterceptor" class="org.springframework.security.web.access.intercept.FilterSecurityInterceptor">
<beans:property name="authenticationManager" ref="authenticationManager"/>
<beans:property name="accessDecisionManager" ref="accessDecisionManager"/>
<beans:property name="objectDefinitionSource" ref="secureresourceDefinitionSource" />
</beans:bean>
<!-- 项目实现的URL-授权查询服务 -->
<beans:bean id="secureresourceDefinitionSource" class="com.oumasoft.security.intercept.web.SecureResourceDefinitionSource" >
<beans:property name="resourceService" ref="resourceService" />
</beans:bean>
<beans:bean id="resourceService" class="com.oumasoft.security.business.service.impl.ResourceServiceImpl" >
<beans:property name="resourceDao" ref="resourceDao" />
</beans:bean>
</beans:beans>
<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:p="http://www.springframework.org/schema/p" xmlns:context="http://www.springframework.org/schema/context"
xmlns:aop="http://www.springframework.org/schema/aop" xmlns:tx="http://www.springframework.org/schema/tx"
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.0.xsd
http://www.springframework.org/schema/aop
http://www.springframework.org/schema/aop/spring-aop-3.0.xsd http://www.springframework.org/schema/tx
http://www.springframework.org/schema/tx/spring-tx-2.5.xsd ">
<bean id="propertyConfigurer"
class="org.springframework.beans.factory.config.PropertyPlaceholderConfigurer">
<property name="location" value="classpath:config.properties" />
</bean>
<bean id="dataSource" class="org.apache.commons.dbcp.BasicDataSource" destroy-method="close">
<property name="driverClassName" value="${datasource.driverClassName}"></property>
<property name="url" value="${datasource.url}" />
<property name="username" value="${datasource.username}" />
<property name="password" value="${datasource.password}" />
</bean>
<bean id="sessionFactory"
class="org.springframework.orm.hibernate3.LocalSessionFactoryBean">
<property name="dataSource" ref="dataSource" />
<property name="mappingResources">
<list>
<value>com/oumasoft/security/bean/Resource.hbm.xml</value>
<value>com/oumasoft/security/bean/Role.hbm.xml</value>
<value>com/oumasoft/security/bean/BaseUserDetails.hbm.xml</value>
</list>
</property>
<property name="hibernateProperties">
<props>
<prop key="hibernate.dialect">
org.hibernate.dialect.SQLServerDialect
</prop>
<prop key="show_sql">true</prop>
</props>
</property>
</bean>
<bean id="txManager" class="org.springframework.jdbc.datasource.DataSourceTransactionManager">
<property name="dataSource" ref="dataSource"></property>
</bean>
<!-- 事务增强切面-->
<aop:config>
<aop:pointcut id="daoMethod" expression="execution(* com.oumasoft.security.business.service.*.*(..))"/>
<aop:advisor pointcut-ref="daoMethod" advice-ref="txAdvice"/>
</aop:config>
<!-- 事务增强切面END -->
<!-- 事务增强 -->
<tx:advice id="txAdvice" transaction-manager="txManager">
<tx:attributes>
<tx:method name="get*"/>
<tx:method name="add*" rollback-for="Exception"/>
<tx:method name="update*"/>
<tx:method name="remove*"/>
</tx:attributes>
</tx:advice>
<!-- 事务增强END -->
<!-- DAO -->
<bean id="baseuserdetailsDao" class="com.oumasoft.security.dao.impl.BaseUserDetailsDaoImpl">
<property name="sessionFactory">
<ref local="sessionFactory" />
</property>
</bean>
<!-- DAO -->
<bean id="resourceDao" class="com.oumasoft.security.dao.impl.ResourceDaoImpl">
<property name="sessionFactory">
<ref local="sessionFactory" />
</property>
</bean>
</beans>
package com.oumasoft.security.bean;
import java.util.ArrayList;
import java.util.Collection;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
import java.util.Set;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.GrantedAuthorityImpl;
import org.springframework.security.core.userdetails.UserDetails;
import org.apache.commons.lang.StringUtils;
public class BaseUserDetails implements UserDetails {
private Integer id;
private String name;
private String password;
private boolean disabled;
private Set<Role> roles;
private Map<String, List<Resource>> roleResources;
public boolean isDisabled() {
return disabled;
}
public void BaseUserDetails() {
}
//根据User返回这个User所拥有的权限列表
public Collection<GrantedAuthority> getAuthorities() {
List<GrantedAuthority> grantedAuthorities = new ArrayList<GrantedAuthority>(
roles.size());
for (Role role : roles) {
grantedAuthorities.add(new GrantedAuthorityImpl(role.getName()));
}
return grantedAuthorities;
}
public String getAuthoritiesString() {
List<String> authorities = new ArrayList<String>();
for (GrantedAuthority authority : this.getAuthorities()) {
authorities.add(authority.getAuthority());
}
return StringUtils.join(authorities.toArray(), ",");
}
public Map<String, List<Resource>> getRoleResources() {
// init roleResources for the first time
if (this.roleResources == null) {
this.roleResources = new HashMap<String, List<Resource>>();
for (Role role : this.roles) {
String roleName = role.getName();
Set<Resource> resources = role.getResources();
for (Resource resource : resources) {
String key = roleName + "_" + resource.getType();
if (!this.roleResources.containsKey(key)) {
this.roleResources.put(key, new ArrayList<Resource>());
}
this.roleResources.get(key).add(resource);
}
}
}
return this.roleResources;
}
public String getRoleResourceString() {
// init roleResources for the first time
if (this.roleResources != null) {
List<String> resourcestring = new ArrayList<String>();
for (Role role : this.roles) {
String roleName = role.getName();
Set<Resource> resources = role.getResources();
for (Resource resource : resources) {
String key = roleName + "_" + resource.getType();
if (this.roleResources.containsKey(key)) {
resourcestring.add(resource.getValue());
}
}
}
return StringUtils.join(resourcestring.toArray(), ",");
}
return null;
}
public String getPassword() {
return password;
}
public String getUsername() {
return name;
}
public boolean isAccountNonExpired() {
return true;
}
public boolean isAccountNonLocked() {
return true;
}
public boolean isCredentialsNonExpired() {
return true;
}
public boolean isEnabled() {
return !disabled;
}
public Integer getId() {
return id;
}
public void setId(Integer id) {
this.id = id;
}
public String getName() {
return name;
}
public void setName(String name) {
this.name = name;
}
public void setDisabled(boolean disabled) {
this.disabled = disabled;
}
public Set<Role> getRoles() {
return roles;
}
public void setRoles(Set<Role> roles) {
this.roles = roles;
}
public void setRoleResources(Map<String, List<Resource>> roleResources) {
this.roleResources = roleResources;
}
public void setPassword(String password) {
this.password = password;
}
}
package com.oumasoft.security.business.service.impl;
import org.springframework.security.core.userdetails.UserDetailsService;
import com.oumasoft.security.bean.BaseUserDetails;
import com.oumasoft.security.business.service.IBaseUserDetailsService;
import com.oumasoft.security.dao.IBaseUserDetailsDao;
public class BaseUserDetailsServiceImpl implements UserDetailsService,IBaseUserDetailsService {
private IBaseUserDetailsDao baseuserdetailsDao;
public BaseUserDetails loadUserByUsername(String username) {
return this.getBaseuserdetailsDao().loadUserByUsername(username);
}
public IBaseUserDetailsDao getBaseuserdetailsDao() {
return baseuserdetailsDao;
}
public void setBaseuserdetailsDao(IBaseUserDetailsDao baseuserdetailsDao) {
this.baseuserdetailsDao = baseuserdetailsDao;
}
}
<?xml version="1.0" encoding="UTF-8"?>
<web-app id="WebApp_9" version="2.4" xmlns="http://java.sun.com/xml/ns/j2ee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd">
<display-name>Struts Blank</display-name>
<context-param>
<param-name>contextConfigLocation</param-name>
<param-value>classpath*:applicationContext-*.xml</param-value>
</context-param>
<!-- Spring security Filter -->
<filter>
<filter-name>springSecurityFilterChain</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
<filter-name>springSecurityFilterChain</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<filter>
<filter-name>struts2</filter-name>
<filter-class>org.apache.struts2.dispatcher.FilterDispatcher</filter-class>
</filter>
<filter-mapping>
<filter-name>struts2</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<listener>
<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>
<filter>
<filter-name>CharacterEncodingFilter</filter-name>
<filter-class>org.springframework.web.filter.CharacterEncodingFilter</filter-class>
<init-param>
<param-name>encoding</param-name>
<param-value>GBK</param-value>
</init-param>
<init-param>
<param-name>forceEncoding</param-name>
<param-value>true</param-value>
</init-param>
</filter>
<filter-mapping>
<filter-name>CharacterEncodingFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<servlet>
<description>This is the description of my J2EE component</description>
<display-name>This is the display name of my J2EE component</display-name>
<servlet-name>HelloServlet</servlet-name>
<servlet-class>com.oumasoft.security.servlet.HelloServlet</servlet-class>
</servlet>
<servlet-mapping>
<servlet-name>HelloServlet</servlet-name>
<url-pattern>/HelloServlet</url-pattern>
</servlet-mapping>
<servlet>
<servlet-name>dwr-invoker</servlet-name>
<servlet-class>org.directwebremoting.servlet.DwrServlet</servlet-class>
<init-param>
<param-name>debug</param-name>
<param-value>true</param-value>
</init-param>
<init-param>
<param-name>logLevel</param-name>
<param-value>debug</param-value>
</init-param>
<init-param>
<param-name>crossDomainSessionSecurity</param-name>
<param-value>false</param-value>
</init-param>
<init-param>
<param-name>activeReverseAjaxEnabled</param-name>
<param-value>true</param-value>
</init-param>
<init-param>
<param-name>initApplicationScopeCreatorsAtStartup</param-name>
<param-value>true</param-value>
</init-param>
<init-param>
<param-name>maxWaitAfterWrite</param-name>
<param-value>500</param-value>
</init-param>
<load-on-startup>1</load-on-startup>
</servlet>
<servlet-mapping>
<servlet-name>dwr-invoker</servlet-name>
<url-pattern>/dwr/*</url-pattern>
</servlet-mapping>
<welcome-file-list>
<welcome-file>/login.jsp</welcome-file>
</welcome-file-list>
<session-config>
<session-timeout>-1</session-timeout>
</session-config>
</web-app>