Spring Security简单Demo

 

Spring Security简单Demo

1.创建项目且引入相关的.jar文件

spring-security-acl-2.0.5.jar

spring-security-core-2.0.5.jar

spring-security-taglibs-2.0.5.jar

2.创建相应的实体类：用户、角色、资源

2.1用户类:User.java需要实现UserDetails接口，具体内容如下：

package com.zsw.entity;
import java.util.ArrayList;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
import java.util.Set;
import javax.persistence.Entity;
import javax.persistence.FetchType;
import javax.persistence.GeneratedValue;
import javax.persistence.Id;
import javax.persistence.JoinColumn;
import javax.persistence.JoinTable;
import javax.persistence.ManyToMany;
import javax.persistence.Transient;
import org.apache.commons.lang.StringUtils;
import org.hibernate.annotations.Cache;
import org.hibernate.annotations.CacheConcurrencyStrategy;
import org.hibernate.annotations.Proxy;
import org.springframework.security.GrantedAuthority;
import org.springframework.security.GrantedAuthorityImpl;
import org.springframework.security.userdetails.UserDetails;
/**
 * 用户类
 * @author Administrator
 */
@Entity
@Proxy(lazy = false)
@Cache(usage = CacheConcurrencyStrategy.READ_WRITE)
public  class User  implements UserDetails {
 
  private  static  final  long serialVersionUID = 8026813053768023527L;
  /**
  * 编号ID
  */
    @Id
 @GeneratedValue
  private Integer id;
  private  String name;  //用户名
 
  private  String password;  //密码
 
  private  boolean disabled;  //是否关闭
 
  /**
  * 用户所有的角色
  */
 @ManyToMany(targetEntity = Role. class, fetch = FetchType.EAGER)
    @JoinTable(name =  "user_role", joinColumns = @JoinColumn(name =  "user_id"), inverseJoinColumns = @JoinColumn(name =  "role_id"))
    @Cache(usage = CacheConcurrencyStrategy.READ_WRITE)
  private Set<Role> roles;
 
 @Transient
  private Map< String, List<Resource>> roleResources;
 
  /**
  * The default constructor
  */
  public User() {
 }
  /**
  * 根据User返回这个User所拥有的权限列表
  */
  public GrantedAuthority[] getAuthorities() {
  List<GrantedAuthority> grantedAuthorities =  new ArrayList<GrantedAuthority>(roles.size());
      for(Role role : roles) {
      grantedAuthorities.add( new GrantedAuthorityImpl(role.getName()));
     }
         return grantedAuthorities.toArray( new GrantedAuthority[roles.size()]);
 }
 
  /**
  * Returns the authorites string
  * 
  * eg. 
  *    downpour --- ROLE_ADMIN,ROLE_USER
  *    robbin --- ROLE_ADMIN
  * 
  * @return
  */
  public  String getAuthoritiesString() {
     List< String> authorities =  new ArrayList< String>();
      for(GrantedAuthority authority :  this.getAuthorities()) {
         authorities.add(authority.getAuthority());
     }
      return StringUtils.join(authorities,  ",");
 }
  public  String getPassword() {
   return password;
 }
  public  String getUsername() {
   return name;
 }
  public  boolean isAccountNonExpired() {
   return true;
 }
  public  boolean isAccountNonLocked() {
   return true;
 }
  public  boolean isCredentialsNonExpired() {
   return true;
 }
  public  boolean isEnabled() {
   return !disabled;
 }
  public Integer getId() {
   return id;
 }
  public  String getName() {
   return name;
 }
  public  boolean isDisabled() {
   return disabled;
 }
  public Set<Role> getRoles() {
   return roles;
 }
 
  /**
  * 在User对象中设置一个缓存机制，在第一次取的时候，
  * 通过遍历User所有的Role，获取相应的Resource信息。
  * @return
  */
  public Map< String, List<Resource>> getRoleResources() {
   // init roleResources for the first time
   if( this.roleResources == null) {
   
    this.roleResources =  new HashMap< String, List<Resource>>();
   
    for(Role role :  this.roles) {
     String roleName = role.getName();
    Set<Resource> resources = role.getResources();
     for(Resource resource : resources) {
      String key = roleName +  "_" + resource.getType();
      if(! this.roleResources.containsKey(key)) {
       this.roleResources.put(key,  new ArrayList<Resource>());
     }
      this.roleResources.get(key).add(resource);     
    }
   }
   
  }
   return  this.roleResources;
 }
  public  void setId(Integer id) {
   this.id = id;
 }
  public  void setName( String name) {
   this.name = name;
 }
  public  void setPassword( String password) {
   this.password = password;
 }
  public  void setDisabled( boolean disabled) {
   this.disabled = disabled;
 }
  public  void setRoles(Set<Role> roles) {
   this.roles = roles;
 }
 
}

其中，接口UserDetails定义的方法如下：

public  interface UserDetails  extends Serializable {
    
    GrantedAuthority[] getAuthorities();
     String getPassword();
     String getUsername();
     boolean isAccountNonExpired();
     boolean isAccountNonLocked();
     boolean isCredentialsNonExpired();
     boolean isEnabled();
}

2.2角色：Role.java具体的内容如下：

package com.zsw.entity;
import java.util.Set;
import javax.persistence.Entity;
import javax.persistence.FetchType;
import javax.persistence.GeneratedValue;
import javax.persistence.Id;
import javax.persistence.JoinColumn;
import javax.persistence.JoinTable;
import javax.persistence.ManyToMany;
import org.hibernate.annotations.Cache;
import org.hibernate.annotations.CacheConcurrencyStrategy;
/**
 * 角色
 * @author Administrator
 */
@Entity
@Cache(usage = CacheConcurrencyStrategy.READ_WRITE)
public  class Role {
 
 @Id
 @GeneratedValue
  private Integer id; 
  private  String name; 
  private  String description; 
 @ManyToMany(targetEntity = Resource. class, fetch = FetchType.EAGER)
    @JoinTable(name =  "role_resource", joinColumns = @JoinColumn(name =  "role_id"), inverseJoinColumns = @JoinColumn(name =  "resource_id"))
    @Cache(usage = CacheConcurrencyStrategy.READ_WRITE)
  private Set<Resource> resources;
  public Role() {  
 }
  public Integer getId() {
   return id;
 }
  public  String getName() {
   return name;
 }
  public  String getDescription() {
   return description;
 }
  public Set<Resource> getResources() {
   return resources;
 }
  public  void setId(Integer id) {
   this.id = id;
 }
  public  void setName( String name) {
   this.name = name;
 }
  public  void setDescription( String description) {
   this.description = description;
 }
  public  void setResources(Set<Resource> resources) {
   this.resources = resources;
 }
}

2.3资源Resource.java具体的内容如下：

package com.zsw.entity;
import java.util.ArrayList;
import java.util.List;
import java.util.Set;
import javax.persistence.Entity;
import javax.persistence.FetchType;
import javax.persistence.GeneratedValue;
import javax.persistence.Id;
import javax.persistence.ManyToMany;
import javax.persistence.Transient;
import org.apache.commons.lang.StringUtils;
import org.hibernate.annotations.Cache;
import org.hibernate.annotations.CacheConcurrencyStrategy;
/**
 * 资源
 * Resource可能分成多种类型，比如MENU,URL,METHOD等等
 */
@Entity
@Cache(usage = CacheConcurrencyStrategy.READ_WRITE)
public  class Resource {
 @Id
    @GeneratedValue
  private Integer id; 
  private  String type; 
  private  String value;
 
 @ManyToMany(mappedBy =  "resources", targetEntity = Role. class, fetch = FetchType.EAGER)
    @Cache(usage = CacheConcurrencyStrategy.READ_WRITE)
  private Set<Role> roles;
 
  public Resource() {
 }
 
  /**
  * 获取资源中所有角色名称
  * @return
  */
    @Transient
  public  String getRoleAuthorities() {
     List< String> roleAuthorities =  new ArrayList< String>();
      for(Role role : roles) {
      roleAuthorities.add(role.getName());
     }
         return StringUtils.join(roleAuthorities,  ",");
    }
  public Integer getId() {
   return id;
 }
  public  String getType() {
   return type;
 }
  public  String getValue() {
   return value;
 }
  public Set<Role> getRoles() {
   return roles;
 }
  public  void setId(Integer id) {
   this.id = id;
 }
  public  void setType( String type) {
   this.type = type;
 }
  public  void setValue( String value) {
   this.value = value;
 }
  public  void setRoles(Set<Role> roles) {
   this.roles = roles;
 }
}

3.定义一个接口SecurityManager.java用于获取所有的资源信息

package com.zsw.security;
import java.util.Map;
/**
 * 安全管理
 * @author Administrator
 */
public  interface SecurityManager {     
  public Map< String,  String> loadUrlAuthorities();        
}

其具体的实现类如下：

package com.zsw.security.support;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
import org.hibernate.SessionFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.dao.DataAccessException;
import org.springframework.orm.hibernate3.support.HibernateDaoSupport;
import org.springframework.security.userdetails.UserDetails;
import org.springframework.security.userdetails.UserDetailsService;
import org.springframework.security.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Service;
import com.zsw.entity.Resource;
import com.zsw.entity.User;
import com.zsw.security.SecurityManager;
@Service( "securityManager")
public  class SecurityManagerSupport  extends HibernateDaoSupport  implements UserDetailsService, SecurityManager {
    @Autowired
     public  void init(SessionFactory sessionFactory) {
         super.setSessionFactory(sessionFactory);
    }
    
     /**
     * 根据用户名获取用户对象
     * 实现了UserDetailsService接口中的loadUserByUsername方法
     */
     public UserDetails loadUserByUsername( String userName)  throws UsernameNotFoundException, DataAccessException {
        List<User> users = getHibernateTemplate().find( "FROM User user WHERE user.name = ? AND user.disabled = false", userName);
         if(users.isEmpty()) {
             throw  new UsernameNotFoundException( "User " + userName +  " has no GrantedAuthority");
        }
         return users.get(0);
    }
    
     /**
     * 获取所有资源，对应所有的角色
     */
     public Map< String,  String> loadUrlAuthorities() {
        Map< String,  String> urlAuthorities =  new HashMap< String,  String>();
        List<Resource> urlResources = getHibernateTemplate().find( "FROM Resource resource WHERE resource.type = ?",  "URL");
         for(Resource resource : urlResources) {
            urlAuthorities.put(resource.getValue(), resource.getRoleAuthorities());
        }
         return urlAuthorities;
    }
}

4.创建一个监听器，在系统启动的时候，把所有的资源load到内存作为缓存

package com.zsw.web.loader;
import java.util.Map;
import javax.servlet.ServletContext;
import javax.servlet.ServletContextEvent;
import javax.servlet.ServletContextListener;
import org.springframework.web.context.support.WebApplicationContextUtils;
import com.zsw.security.SecurityManager;
/**
 * ------------------------------------------------------------
 * 这是一个监听器
 * 主要有2个方法，一个是应用启动时执行，另一个是应用关闭时执行
 * 在系统启动的时候，把所有的资源load到内存作为缓存 
 * ------------------------------------------------------------
 * 监听器的使用实际上适用于取代那些响应用户请求的Servelt，
 * 所以Listener类中无须提供用户请求的方法，
 * Listener的作用是为整个WEB应用提供后台服务。
 * ------------------------------------------------------------
 * @author 周尚武
 */
public  class ServletContextLoaderListener  implements ServletContextListener {
  /**
  * 应用启动时，该方法调用
  * 将资源的存放在servletContext中
  */
  public  void contextInitialized(ServletContextEvent servletContextEvent) {
  ServletContext servletContext = servletContextEvent.getServletContext();
  SecurityManager securityManager =  this.getSecurityManager(servletContext);
  Map< String,  String> urlAuthorities = securityManager.loadUrlAuthorities();
  servletContext.setAttribute( "urlAuthorities", urlAuthorities);
 }
  /**
     * 应用关闭时该方法调用
     */
  public  void contextDestroyed(ServletContextEvent servletContextEvent) {
  servletContextEvent.getServletContext().removeAttribute( "urlAuthorities");
 }
  protected SecurityManager getSecurityManager(ServletContext servletContext) {
   return (SecurityManager) WebApplicationContextUtils.getWebApplicationContext(servletContext).getBean( "securityManager");
 }
}

5.获取当前用户

package com.zsw.security.support;
import org.springframework.security.context.SecurityContextHolder;
import com.zsw.entity.User;
/**
 * Spring Security提供了一个线程安全的对象：SecurityContextHolder，
 * 通过这个对象，我们可以访问当前的登录用户
 * @author Administrator
 */
public  class SecurityUserHolder {
 
  /**
  * 获取当前用户
  * @return
  */
  public  static User getCurrentUser() {
   return (User) SecurityContextHolder.getContext().getAuthentication().getPrincipal();
 }
}

6.对资源进行认证

package com.zsw.security.interceptor;
import java.util.Collection;
import java.util.Iterator;
import java.util.Map;
import javax.servlet.ServletContext;
import org.springframework.beans.factory.InitializingBean;
import org.springframework.security.ConfigAttributeDefinition;
import org.springframework.security.ConfigAttributeEditor;
import org.springframework.security.intercept.web.FilterInvocation;
import org.springframework.security.intercept.web.FilterInvocationDefinitionSource;
import org.springframework.security.util.AntUrlPathMatcher;
import org.springframework.security.util.RegexUrlPathMatcher;
import org.springframework.security.util.UrlMatcher;
/**
 * 资源拦截器
 * 编写自己的FilterInvocationDefinitionSource实现类，对资源进行认证 
 */
public  class SecureResourceFilterInvocationDefinitionSource  implements FilterInvocationDefinitionSource, InitializingBean {
    
     private UrlMatcher urlMatcher;
     private  boolean useAntPath = true;    
     private  boolean lowercaseComparisons = true;
    
     public  void setUseAntPath( boolean useAntPath) {
         this.useAntPath = useAntPath;
    }
     public  void setLowercaseComparisons( boolean lowercaseComparisons) {
         this.lowercaseComparisons = lowercaseComparisons;
    }
     public  void afterPropertiesSet()  throws  Exception {
     
         this.urlMatcher =  new RegexUrlPathMatcher();        
         if (useAntPath) {
             this.urlMatcher =  new AntUrlPathMatcher();
        }
        
         if ( "true".equals(lowercaseComparisons)) {
             if (! this.useAntPath) {
                ((RegexUrlPathMatcher)  this.urlMatcher).setRequiresLowerCaseUrl(true);
            }
        }  else  if ( "false".equals(lowercaseComparisons)) {
             if ( this.useAntPath) {
                ((AntUrlPathMatcher)  this.urlMatcher).setRequiresLowerCaseUrl(false);
            }
        }        
    }
     public ConfigAttributeDefinition getAttributes(Object filter)  throws IllegalArgumentException {
        
        FilterInvocation filterInvocation = (FilterInvocation) filter;
         String requestURI = filterInvocation.getRequestUrl();
        Map< String,  String> urlAuthorities =  this.getUrlAuthorities(filterInvocation);        
         String grantedAuthorities = null;
         for(Iterator<Map.Entry< String,  String>> iter = urlAuthorities.entrySet().iterator(); iter.hasNext();) {
            Map.Entry< String,  String> entry = iter.next();
             String url = entry.getKey();
            
             if(urlMatcher.pathMatchesUrl(url, requestURI)) {
                grantedAuthorities = entry.getValue();
                 break;
            }            
        }
        
         if(grantedAuthorities != null) {
            ConfigAttributeEditor configAttrEditor =  new ConfigAttributeEditor();
            configAttrEditor.setAsText(grantedAuthorities);
             return (ConfigAttributeDefinition) configAttrEditor.getValue();
        }        
         return null;
    }
    @SuppressWarnings( "unchecked")
  public Collection getConfigAttributeDefinitions() {
         return null;
    }
    @SuppressWarnings( "unchecked")
  public  boolean supports(Class clazz) {
         return true;
    }
    @SuppressWarnings( "unchecked")
  private Map< String,  String> getUrlAuthorities(FilterInvocation filterInvocation) {
        ServletContext servletContext = filterInvocation.getHttpRequest().getSession().getServletContext();
         return (Map< String,  String>)servletContext.getAttribute( "urlAuthorities");
    }
}

7.创建登陆login页面及登陆成功后的index页面：

login.jsp

< %@ page language= "java"  contentType= "text/html; charset=UTF-8"  pageEncoding= "UTF-8" %>
< !DOCTYPE html PUBLIC  "-//W3C//DTD XHTML 1.0 Transitional//EN"   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd" >
< html xmlns= "http://www.w3.org/1999/xhtml"  lang= "zh-CN" >
< head>
 < title>Spring Security< /title>
< /head>
< body>
    < form method= "post"  id= "loginForm"  action= "${pageContext.request.contextPath}/j_spring_security_check" >
        < p>User Name：< /p>
        < p>< input type= "text"  name= "j_username"  id= "j_username"  />< /p>
        < p>Password：< /p>     
        < p>< input type= "password"  name= "j_password"  id= "j_password"  />< /p>
        < p>< input type= "submit"  value= "submit"  />< /p>
    < /form>      
< /body>
< /html> 

index.jsp

< p>
 < a href= "${pageContext.request.contextPath}/j_spring_security_logout" >logout< /a>
< /p>
< p>Hello ${currentUser.name}, your role is: ${currentUser.authoritiesString}< /p>

8.相关的配置文件：

8.1web.xml

< ?xml version= "1.0"  encoding= "UTF-8" ?>
< web-app id= "Yoda"  version= "2.4"  xmlns= "http://java.sun.com/xml/ns/j2ee"
    xmlns:xsi= "http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation= "http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd" >
 < display-name>Yoda< /display-name>
     <!--- Spring ApplicationContext Definition -->
    < context-param>
        < param-name>contextConfigLocation< /param-name>
        < param-value>/WEB-INF/classes/applicationContext-*.xml< /param-value>
    < /context-param>
    
     <!--- 
     Spring security Filter
     这个Filter会拦截所有的URL请求，并且对这些URL请求进行Spring Security的验证。 
     -->
    < filter>
   < filter-name>springSecurityFilterChain< /filter-name>
   < filter-class>org.springframework.web.filter.DelegatingFilterProxy< /filter-class>
 < /filter>
 < filter-mapping>
   < filter-name>springSecurityFilterChain< /filter-name>
   < url-pattern>/*< /url-pattern>
 < /filter-mapping>
 < servlet>
  < servlet-name>index< /servlet-name>
  < servlet-class>com.zsw.web.servlet.Index< /servlet-class>
 < /servlet> 
 < servlet-mapping>
  < servlet-name>index< /servlet-name>
  < url-pattern>/index< /url-pattern>
 < /servlet-mapping>
    < listener>
        < listener-class>org.springframework.web.context.ContextLoaderListener< /listener-class>
    < /listener>    
    < listener>
        < listener-class>com.zsw.web.loader.ServletContextLoaderListener< /listener-class>
    < /listener>
    
< /web-app>

8.2applicationContext-security.xml

< ?xml version= "1.0"  encoding= "UTF-8" ?>
< beans:beans xmlns= "http://www.springframework.org/schema/security"
    xmlns:beans= "http://www.springframework.org/schema/beans"
    xmlns:xsi= "http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation= "http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.5.xsd
                        http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-2.0.4.xsd ">
 
 < beans:bean id= "loggerListener"  class= "org.springframework.security.event.authentication.LoggerListener"  />
 < http access-denied-page= "/403.jsp"  >
  < intercept-url pattern= "/static/**"  filters= "none"  />
  < intercept-url pattern= "/template/**"  filters= "none"  />
  < intercept-url pattern= "/"  filters= "none"  />
  < intercept-url pattern= "/login.jsp"  filters= "none"  />
   <!--- 登录认证 -->
     < form-login login-page= "/login.jsp"  authentication-failure-url= "/login.jsp?error=true"  default-target-url= "/index"  />
      <!--- 注销处理 -->
     < logout logout-success-url= "/login.jsp" />
      <!--- 基本认证 -->
     < http-basic />
 < /http>
 < authentication-manager alias= "authenticationManager" />
 
  <!--- 配置UserDetailsService来指定用户和权限  -->
 < authentication-provider user-service-ref= "securityManager" >
  < password-encoder hash= "md5" />
 < /authentication-provider>
 
 < beans:bean id= "accessDecisionManager"  class= "org.springframework.security.vote.AffirmativeBased" >
     < beans:property name= "allowIfAllAbstainDecisions"  value= "false" />
     < beans:property name= "decisionVoters" >
         < beans:list>
             < beans:bean class= "org.springframework.security.vote.RoleVoter" />
             < beans:bean class= "org.springframework.security.vote.AuthenticatedVoter" />
         < /beans:list>
     < /beans:property>
 < /beans:bean>
 
  <!--- 
         由于我们所实现的是FilterSecurityInterceptor中的一个开放接口，
         所以我们实际上定义了一个新的bean，
         并通过<custom-filter after="LAST" />插入到过滤器链中去。
  -->
 < beans:bean id= "resourceSecurityInterceptor"  class= "org.springframework.security.intercept.web.FilterSecurityInterceptor" >
  < beans:property name= "authenticationManager"  ref= "authenticationManager" />
     < beans:property name= "accessDecisionManager"  ref= "accessDecisionManager" />
     < beans:property name= "objectDefinitionSource"  ref= "secureResourceFilterInvocationDefinitionSource"  />
     < beans:property name= "observeOncePerRequest"  value= "false"  />
     < custom-filter after= "LAST"  />
 < /beans:bean>
 
 < beans:bean id= "secureResourceFilterInvocationDefinitionSource"  class= "com.zsw.security.interceptor.SecureResourceFilterInvocationDefinitionSource"  />
 
< /beans:beans>

9. 以上Demo下载地址：

 http://download.csdn.net/source/3500432