今天看到appfuse2.0.2里acegi的配置文件非常奇怪,到appfuse官网查看原来将appfuse2.0.2包含的acegi1.0升级到了acegi2.0 ,同1.0比起变化很大,名称也改为spring security2.0.下面是简单配置使用步骤
1、第一件事是把下面的filter声明添加到 web.xml 文件中:
- <filter>
- <filter-name>springSecurityFilterChain</filter-name>
- <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
- </filter>
- <filter-mapping>
- <filter-name>springSecurityFilterChain</filter-name>
- <url-pattern>/*</url-pattern>
- </filter-mapping>
2.配置信息都放到application-security.xml里(名称可改),要加上命名空间
- <beans:beans xmlns="http://www.springframework.org/schema/security"
- xmlns:beans="http://www.springframework.org/schema/beans"
- xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.0.xsd
- http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-2.0.2.xsd">
- ...
- </beans:beans>
3、其次为路径,地址增加权限。
<intercept-url pattern="/**" access="ROLE_USER" />
这表示,我们要保护应用程序中的所有URL,只有拥有 ROLE_USER角色的用户才能访问。
例如:
- <http auto-config="true" lowercase-comparisons="false">
- <!--intercept-url pattern="/images/*" filters="none"/>
- <intercept-url pattern="/styles/*" filters="none"/>
- <intercept-url pattern="/scripts/*" filters="none"/-->
- <intercept-url pattern="/admin/*" access="ROLE_ADMIN"/>
- <intercept-url pattern="/passwordHint.html*" access="ROLE_ANONYMOUS,ROLE_ADMIN,ROLE_USER"/>
- <intercept-url pattern="/signup.html*" access="ROLE_ANONYMOUS,ROLE_ADMIN,ROLE_USER"/>
- <intercept-url pattern="/a4j.res/*.html*" access="ROLE_ANONYMOUS,ROLE_ADMIN,ROLE_USER"/>
- <!-- APF-737, OK to remove line below if you're not using JSF -->
- <intercept-url pattern="/**/*.html*" access="ROLE_ADMIN,ROLE_USER"/>
- <form-login login-page="/login.jsp" authentication-failure-url="/login.jsp?error=true" login-processing-url="/j_security_check"/>
- <remember-me user-service-ref="userDao" key="e37f4b31-0c45-11dd-bd0b-0800200c9a66"/>
- </http>
4、 指定数据库 和 密码加密
- <authentication-provider user-service-ref="userDao">
- <password-encoder ref="passwordEncoder"/>
- </authentication-provider>
5、方法授权
- <global-method-security>
- <protect-pointcut expression="execution(* *..service.UserManager.getUsers(..))" access="ROLE_ADMIN"/>
- <protect-pointcut expression="execution(* *..service.UserManager.removeUser(..))" access="ROLE_ADMIN"/>
- </global-method-security>
6、Session控制
Acegi2.0 的session 控制真是简单,只能用简单得一米来形容J
首先在web.xml 中加个Listener:
- <listener>
- <listener-class>
- org.springframework.security.ui.session.HttpSessionEventPublisher
- </listener-class>
- </listener>
然后在application-security.xml 中配置规则:
- <http>
- <concurrent-session-control max-sessions="1" />
- </http>
- 或
- <http>
- <concurrent-session-control max-sessions="1" exception-if-maximum-exceeded="true" />
- </http>
解释说明:两个配置都只允许用户登录一次,exception-if-maximum-exceeded 默认为false,此值表示:
用户第二次登录时,前一次的登录信息都被清空。当exception-if-maximum-exceeded="true"时系统会拒
绝第二次登录。