本人近来刚学会了一点基本spring-security 的使用,想一想还是可以跟大家分享一下。
Spring Security是基于Spring的的权限认证框架,先给大家看看,applicationContext-security.xml的配置:
而web.xml文件的配置如下:
通过上面的配置,spring-security权限框架的设置基本可以满足于测试了。要把用户从数据库中取出来进行分配其角色,则需要用java代码通过继承UserDetails和UserDetailsService来进行有效的处理。这还有代码于我在进行更多的测试。
Spring Security是基于Spring的的权限认证框架,先给大家看看,applicationContext-security.xml的配置:
<?xml version="1.0" encoding="UTF-8"?>
<b:beans xmlns="http://www.springframework.org/schema/security"
xmlns:b="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.0.xsd">
<http auto-config="true">
<!--这里是用来设置默认的登录页面的-->
<form-login login-page="/login.jsp"
authentication-failure-url="/login.jsp/error=true"
default-target-url="/login"
/>
<!--intercept用于设置拦截器,分配拦截器-->
<intercept-url pattern="/admin.jsp" access="ROLE_ADMIN"/>
<intercept-url pattern="/**" access="ROLE_USER"/>
</http>
<!--这里设置了两个用户,admin和bob-->
<authentication-manager>
<authentication-provider>
<user-service>
<user name="admin" password="admin" authorities="ROLE_USER,ROLE_ADMIN" />
<user name="bob" password="bob" authorities="ROLE_USER" />
</user-service>
</authentication-provider>
</authentication-manager>
</b:beans>
而web.xml文件的配置如下:
<?xml version="1.0" encoding="UTF-8"?>
<web-app version="2.5"
xmlns="http://java.sun.com/xml/ns/javaee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://java.sun.com/xml/ns/javaee
http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd">
<context-param>
<param-name>contextConfigLocation</param-name>
<param-value>
classpath:applicationContext-*.xml
</param-value>
</context-param>
<listener>
<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>
<!--
- Publishes events for session creation and destruction through the application
- context. Optional unless concurrent session control is being used.
-->
<listener>
<listener-class>org.springframework.security.web.session.HttpSessionEventPublisher</listener-class>
</listener>
<listener>
<listener-class>org.springframework.web.util.Log4jConfigListener</listener-class>
</listener>
<filter>
<filter-name>springSecurityFilterChain</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
<filter-name>springSecurityFilterChain</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
</web-app>
通过上面的配置,spring-security权限框架的设置基本可以满足于测试了。要把用户从数据库中取出来进行分配其角色,则需要用java代码通过继承UserDetails和UserDetailsService来进行有效的处理。这还有代码于我在进行更多的测试。