Spring Security{Authenticate---Spring LDAP and Authorize---Database}

applicationContext.xml

//在web.xml配置完filterChainProxy后，一旦提交登录请求后，就会进行过滤。依次执行下面的filter...
//authenticationProcessingFilter --- 主要是用于表单验证。
<beans:bean id="authenticationProcessingFilter"
class="org.springframework.security.ui.webapp.AuthenticationProcessingFilter">
<property name="authenticationManager" ref="authenticationManager"/>
<property name="authenticationFailureUrl" value="/login.jsp?error=true"/>
<property name="defaultTargetUrl" value="/"/>
<property name="filterProcessesUrl" value="/j_spring_security_check"/>
</beans:bean>
    <beans:bean id="authenticationManager"
         class="org.springframework.security.providers.ProviderManager">
         <property name="providers">
             <list>
                 <b:ref local="ldapAuthProvider" />
             </list>
         </property>
     </beans:bean>

<ldap-server id="contextSource" url="ldap://ldapserver:port/dc=example,dc=com" manager-dn="uid=admin,ou=system" manager-password="your-pwd" />

<beans:bean id="ldapAuthProvider" class="org.springframework.security.providers.ldap.LdapAuthenticationProvider">
 <custom-authentication-provider />

  <beans:constructor-arg>

    <beans:bean class="org.springframework.security.providers.ldap.authenticator.BindAuthenticator">

      <beans:constructor-arg ref="contextSource"/>

      <beans:property name="userSearch" ref="userSearch"/>

    </beans:bean>

  </beans:constructor-arg>

  <beans:constructor-arg>

    <beans:bean class="com.mycompany.web.security.MyAuthoritiesPopulator">

      <beans:constructor-arg ref="myUserServiceBean"/>

    </beans:bean>

  </beans:constructor-arg>

</beans:bean>

<beans:bean id="userSearch"
class="org.springframework.security.ldap.search.FilterBasedLdapUserSearch">
  <beans:constructor-arg index="0" value="ou=Development" />
  <beans:constructor-arg index="1" value="(uid={0})" />
  <beans:constructor-arg index="2" ref="contextSource" />
  <beans:property name="searchSubtree" value="true" />
</beans:bean>

// **************************************************** resource - role ***********************************************************
<beans:bean id="filterSecurityInterceptor"
        class="org.springframework.security.intercept.web.FilterSecurityInterceptor" autowire="byType">
        <custom-filter before="FILTER_SECURITY_INTERCEPTOR" />
        <beans:property name="objectDefinitionSource" ref="filterInvocationDefinitionSource" />
    </beans:bean>

    <beans:bean id="filterInvocationDefinitionSource"
        class="com.family168.springsecuritybook.ch05.JdbcFilterInvocationDefinitionSourceFactoryBean">
        <beans:property name="dataSource" ref="dataSource"/>
        <beans:property name="resourceQuery" value="
            select re.res_string,r.name
              from role r
              join resc_role rr
                on r.id=rr.role_id
              join resc re
                on re.id=rr.resc_id
          order by re.priority
        "/>
    </beans:bean>

    <beans:bean id="dataSource" class="org.springframework.jdbc.datasource.DriverManagerDataSource">
        <beans:property name="driverClassName" value="org.hsqldb.jdbcDriver"/>
        <beans:property name="url" value="jdbc:hsqldb:res:/hsqldb/test"/>
        <beans:property name="username" value="sa"/>
        <beans:property name="password" value=""/>
    </beans:bean>

//****************************************************************************************
MyAuthoritiesPopulator:

public class MyAuthoritiesPopulator implements LdapAuthoritiesPopulator {

    private MyUserService userService;


    public MyAuthoritiesPopulator(MyUserService userService){

       this.userService = userService;

    }


    @Override
    public GrantedAuthority[] getGrantedAuthorities(DirContextOperations userData, String username) {

          Set userPerms = new HashSet();

        //get users permissions from service

        Set permissions = userService.getPermissions(username);

        for (MyPermission perm : permissions) {

                userPerms.add(new GrantedAuthorityImpl(perm.getName()));
        }

        return userPerms.toArray(new GrantedAuthority[userPerms.size()] );

    }

}

//*******************************************************************************
JdbcFilterInvocationDefinitionSourceFactoryBean:

public class JdbcFilterInvocationDefinitionSourceFactoryBean
    extends JdbcDaoSupport implements FactoryBean {
    private String resourceQuery;

    public boolean isSingleton() {
        return true;
    }

    public Class getObjectType() {
        return FilterInvocationDefinitionSource.class;
    }

    public Object getObject() {
        return new DefaultFilterInvocationDefinitionSource(this
            .getUrlMatcher(), this.buildRequestMap());
    }

    protected Map<String, String> findResources() {
        ResourceMapping resourceMapping = new ResourceMapping(getDataSource(),
                resourceQuery);

        Map<String, String> resourceMap = new LinkedHashMap<String, String>();

        for (Resource resource : (List<Resource>) resourceMapping.execute()) {
            String url = resource.getUrl();
            String role = resource.getRole();

            if (resourceMap.containsKey(url)) {
                String value = resourceMap.get(url);
                resourceMap.put(url, value + "," + role);
            } else {
                resourceMap.put(url, role);
            }
        }

        return resourceMap;
    }

    protected LinkedHashMap<RequestKey, ConfigAttributeDefinition> buildRequestMap() {
        LinkedHashMap<RequestKey, ConfigAttributeDefinition> requestMap = null;
        requestMap = new LinkedHashMap<RequestKey, ConfigAttributeDefinition>();

        ConfigAttributeEditor editor = new ConfigAttributeEditor();

        Map<String, String> resourceMap = this.findResources();

        for (Map.Entry<String, String> entry : resourceMap.entrySet()) {
            RequestKey key = new RequestKey(entry.getKey(), null);
            editor.setAsText(entry.getValue());
            requestMap.put(key,
                (ConfigAttributeDefinition) editor.getValue());
        }

        return requestMap;
    }

    protected UrlMatcher getUrlMatcher() {
        return new AntUrlPathMatcher();
    }

    public void setResourceQuery(String resourceQuery) {
        this.resourceQuery = resourceQuery;
    }

    private class Resource {
        private String url;
        private String role;

        public Resource(String url, String role) {
            this.url = url;
            this.role = role;
        }

        public String getUrl() {
            return url;
        }

        public String getRole() {
            return role;
        }
    }

    private class ResourceMapping extends MappingSqlQuery {
        protected ResourceMapping(DataSource dataSource,
            String resourceQuery) {
            super(dataSource, resourceQuery);
            compile();
        }

        protected Object mapRow(ResultSet rs, int rownum)
            throws SQLException {
            String url = rs.getString(1);
            String role = rs.getString(2);
            Resource resource = new Resource(url, role);

            return resource;
        }
    }
}