Acegi配置实例

1、在web.xml中

 

 

<!-- ******应用范围内参数初始化，安全认证将放在applicationContext-acegi-security.xml****** -->
    <context-param>
  <param-name>contextConfigLocation</param-name>
  <param-value>
   /WEB-INF/context/applicationContext-*.xml
  </param-value>
    </context-param>

 

 

<!--Acegi Filter Chain Proxy -->
   <filter>
     <filter-name>Acegi Filter Chain Proxy</filter-name>
     <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class> 
     <init-param>
      <param-name>targetBeanName</param-name>
      <param-value>filterChainProxy</param-value>
    </init-param>
   </filter>

 

 <!--Acegi Filter Chain Proxy -->

 <filter-mapping>
      <filter-name>Acegi Filter Chain Proxy</filter-name>
      <url-pattern>/j_oa_security_check</url-pattern>
    </filter-mapping>
   
    <!-- LogOut -->
 <filter-mapping>
      <filter-name>Acegi Filter Chain Proxy</filter-name>
      <url-pattern>/j_spring_security_logout</url-pattern>
    </filter-mapping>
   
    <filter-mapping>
      <filter-name>Acegi Filter Chain Proxy</filter-name>
      <url-pattern>*.ao</url-pattern>
    </filter-mapping>
   
    <filter-mapping>
      <filter-name>Acegi Filter Chain Proxy</filter-name>
      <url-pattern>*.jsp</url-pattern>
    </filter-mapping>
 
 <filter-mapping>
      <filter-name>Acegi Filter Chain Proxy</filter-name>
      <url-pattern>*.servlet</url-pattern>
    </filter-mapping>
   
    <filter-mapping>
      <filter-name>Acegi Filter Chain Proxy</filter-name>
      <url-pattern>*.editDoc</url-pattern>
    </filter-mapping>
    <filter-mapping>
      <filter-name>Acegi Filter Chain Proxy</filter-name>
      <url-pattern>*.openAccessory</url-pattern>
    </filter-mapping>

 

 

 

 

 

2、applicationContext-acegi-security.xml中

 

 

<?xml version="1.0" encoding="UTF-8"?> 
<beans xmlns="http://www.springframework.org/schema/beans" 
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
    xmlns:security="http://www.springframework.org/schema/security" 
    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.0.xsd http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-2.0.xsd">
 
 <!-- ======================== FILTER CHAIN ======================= -->
 <!--
  FilterChainProxy会按顺序来调用这些filter,使这些filter能享用Spring ioc的功能,
  CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON定义了url比较前先转为小写
  PATTERN_TYPE_APACHE_ANT定义了使用Apache ant的匹配模式
  rememberMeProcessingFilter,,anonymousProcessingFilter
  channelProcessingFilter,filterInvocationInterceptor
 -->
<!-- CAS 单点登陆 用casProcessingFilter代替authenticationProcessingFilter实现单点登陆 -->
 <bean id="filterChainProxy" class="org.springframework.security.util.FilterChainProxy">
  <security:filter-chain-map path-type="ant"> 
    <!--security:filter-chain pattern="/**" 
                filters="httpSessionContextIntegrationFilter,logoutFilter,casProcessingFilter,exceptionTranslationFilter,filterInvocationInterceptor" /--> 
            <security:filter-chain pattern="/**" 
                filters="httpSessionContextIntegrationFilter,logoutFilter,authenticationProcessingFilter,exceptionTranslationFilter,filterInvocationInterceptor" /> 
        </security:filter-chain-map>
 </bean>
 
 <!-- ======================== AUTHENTICATION ======================= -->
     <!--
         通过Providers提供认证者列表,如果一个认证提供者失败可以尝试另外一个认证提供者,以保证获取不同来源的身份认证，如
         DaoAuthenticationProvider 从数据库中读取用户信息验证身份
         AnonymousAuthenticationProvider 匿名用户身份认证
         RememberMeAuthenticationProvider 已存cookie中的用户信息身份认证

         其它的还有
         AuthByAdapterProvider 使用容器的适配器验证身份
         CasAuthenticationProvider 根据Yale中心认证服务验证身份, 用于实现单点登录
         JaasAuthenticationProvider 从JASS登录配置中获取用户信息验证身份
         RemoteAuthenticationProvider 根据远程服务验证用户身份
         RunAsImplAuthenticationProvider 对身份已被管理器替换的用户进行验证
         X509AuthenticationProvider 从X509认证中获取用户信息验证身份
         TestingAuthenticationProvider 单元测试时使用

         每个认证者会对自己指定的证明信息进行认证，如DaoAuthenticationProvider仅对UsernamePasswordAuthenticationToken这个证明信息进行认证。
     -->
    <bean id="authenticationManager" class="org.springframework.security.providers.ProviderManager">
     <property name="providers">
         <list>
          <ref local="daoAuthenticationProvider"/>
          <!-- CAS 单点登陆 用casAuthenticationProvider代替 daoAuthenticationProvider实现单点登陆-->
          <!--ref bean="casAuthenticationProvider"/-->
            <ref local="anonymousAuthenticationProvider"/>
    <ref local="rememberMeAuthenticationProvider"/>
         </list>
      </property>
   </bean>
  
   <!-- 认证提供者  -->
   <!-- 用于认证匿名用户 -->
 <bean id="anonymousAuthenticationProvider" class="org.springframework.security.providers.anonymous.AnonymousAuthenticationProvider">
  <property name="key" value="blhOaWebKey2"/>
 </bean>
 
  <bean id="passwordEncoder" class="org.springframework.security.providers.encoding.Md5PasswordEncoder"/>
 <!--
  基于数据库的认证提供者
         authenticationDao 认证数据访问对象，用于获取用户信息，包括：用户名，用户密码，用户状态和用户权限
         userCache ehcache 缓存user信息。
         saltSource 对密码进行私钥加密
     -->
 <bean id="daoAuthenticationProvider" class="org.springframework.security.providers.dao.DaoAuthenticationProvider">
       <property name="userDetailsService">
        <ref bean="userManagerService"/>
       </property>
       <property name="passwordEncoder"><ref local="passwordEncoder"/></property>
       <property name="saltSource">
        <bean class="org.springframework.security.providers.dao.salt.ReflectionSaltSource">
         <property name="userPropertyToUse">
          <value>getUsername</value>
         </property>
        </bean>
       </property>
 </bean>
 
   
    <!-- ======================== FILTER        ======================= -->
  <!--
         每次request前 HttpSessionContextIntegrationFilter从Session中获取Authentication对象，在request完后
         又把Authentication对象保存到Session中供下次request使用,此filter必须其他Acegi filter前使用
         org.acegisecurity.context.HttpSessionContextIntegrationFilter
     -->
    
    
 <bean id="httpSessionContextIntegrationFilter" class="com.ber.acegi.extend.BerHttpSessionContextIntegrationFilter">
  <property name="loginFormUrl" value="/sof_login.jsp"/>
  <!-- 不需要登陆就可以访问的资源 -->
  <property name="noAuthenticationUrl">
   <list>
    <value>/j_oa_security_check</value>
    <value>/sof_login.jsp</value>
    <value>/sysmanage/ug/useradd.ao</value>
   </list>
  </property>
 </bean>
 
 <!--
  利用cookie自動登入
 -->
   <bean id="rememberMeServices" class="org.springframework.security.ui.rememberme.TokenBasedRememberMeServices">
  <property name="userDetailsService" ref="userManagerService"/>
  <property name="key" value="blhOaWebKey"/>
  <property name="tokenValiditySeconds" value="864000"/>
 </bean>
   
 <bean id="rememberMeAuthenticationProvider" class="org.springframework.security.providers.rememberme.RememberMeAuthenticationProvider">
  <property name="key" value="blhOaWebKey"/>
 </bean>
 
 <!--
  登出處理
 -->
 <bean id="logoutFilter" class="org.springframework.security.ui.logout.LogoutFilter">
  <!-- URL redirected to after logout -->
  <constructor-arg value="/sof_login.jsp"/> 
  <constructor-arg>
   <list>
    <ref bean="rememberMeServices"/>
    <bean class="org.springframework.security.ui.logout.SecurityContextLogoutHandler"/>
    </list>
  </constructor-arg>
 </bean>
 
 <!--
   处理基于表单的身份验证请求（Acegi提供了三个认证处理过滤器，另外两个是:BasicProcessingFilter和CasProcessingFilter）
         authenticationFailureUrl定义登录失败时转向的页面
         defaultTargetUrl定义登录成功时转向的页面
         filterProcessesUrl定义登录请求的页面
     -->
 <bean id="authenticationProcessingFilter" class="com.ber.acegi.extend.LogAuthenticationProcessingFilter">
       <property name="authenticationManager" ref="authenticationManager"/>
       <property name="authenticationFailureUrl" value="/sof_login.jsp?login_error=1"/>
       <property name="defaultTargetUrl" value="/jsp/desktop/main.jsp"/>
       <!--
     <property name="defaultTargetUrl" value="/jsp/mainFrame.jsp?showFirstMessage=1"/>
        -->
     <!-- CAS单点登陆 用/j_spring_cas_security_check代替 /j_oa_security_check实现单点登陆-->
     <!-- property name="filterProcessesUrl" value="/j_spring_cas_security_check"/-->
       <property name="filterProcessesUrl" value="/j_oa_security_check"/>
    </bean>
  
   <!--
         filterInvocationInterceptor在执行转向url前检查objectDefinitionSource中设定的用户权限信息
         过程：
         首先，objectDefinitionSource中定义了访问URL需要的属性信息(这里的属性信息仅仅是标志，告诉accessDecisionManager要用哪些voter来投票)
         然后，authenticationManager掉用自己的provider来对用户的认证信息进行校验。
         最后，有投票者根据用户持有认证和访问url需要的属性，调用自己的voter来投票，决定是否允许访问。-->
  
    <bean id="filterInvocationInterceptor" class="org.springframework.security.intercept.web.FilterSecurityInterceptor">
         <property name="authenticationManager"><ref bean="authenticationManager"/></property>
       <property name="accessDecisionManager"><ref local="httpRequestAccessDecisionManager"/></property>
       <property name="objectDefinitionSource"> <ref local="rdbmsFilterInvocationDefinitionSource" /></property>
       <property name="observeOncePerRequest" value="false"></property>
       <property name="alwaysReauthenticate" value="true"></property>
    </bean>
    <bean id="rdbmsFilterInvocationDefinitionSource"  class="com.ber.acegi.extend.RdbmsFilterInvocationDefinitionSource">
    <constructor-arg type="org.springframework.security.util.UrlMatcher"  ref="antUrlPathMatcher" />
    <property name="webresdbCache" ref="webresCacheBackend" />
    <property name="rdbmsInvocationDefinition">
     <bean class="com.ber.acegi.extend.RdbmsSecuredUrlDefinition">
      <constructor-arg index="0">
       <ref bean="dataSource"/>
      </constructor-arg>
      <constructor-arg index="1">
       <value>
      SELECT     MATCHURL_ AS url, MENUCODE_ AS role
      FROM         T_MENU_RESOURCE
      ORDER BY INDEX_ DESC
     </value>
      </constructor-arg>
      <property name="urlField" value="url"/>
      <property name="rolesField" value="role"/>
     </bean>
    </property>
    </bean>
    <bean id="antUrlPathMatcher"  class="org.springframework.security.util.AntUrlPathMatcher" /> 
  
    <bean id="webresCacheBackend"  class="org.springframework.cache.ehcache.EhCacheFactoryBean">
       <property name="cacheManager">
          <ref  bean="cacheManager"/>
       </property>
       <property name="cacheName">
          <value>webresdbCache</value>
       </property>
    </bean>
 
   
    <!-- httpRequestAccessDecisionManager（投票通过策略管理器）用于管理投票通过策略。Acegi提供三种投票通过策略的实现：
   AffirmativeBased（至少一个投票者同意方可通过），ConsensusBased（多数投票者同意方可通过），UnanimousBased（所有投
   票者同意方可通过）
   allowIfAllAbstainDecisions : 设定是否允许：“没人反对就通过”的投票策略
   decisionVoters : 投票者
 -->
    <bean id="httpRequestAccessDecisionManager" class="org.springframework.security.vote.AffirmativeBased">
      <property name="allowIfAllAbstainDecisions"><value>false</value></property>
      <property name="decisionVoters">
         <list>
             <ref bean="roleVoter"/>
         </list>
      </property>
   </bean>
   
   <!--
         必须是以rolePrefix设定的value开头的才会进行投票,否则为弃权
     -->
   <bean id="roleVoter" class="org.springframework.security.vote.RoleVoter">
     <property name="rolePrefix"><value>AUTH_</value></property>
   </bean>
   
 <bean id="exceptionTranslationFilter" class="org.springframework.security.ui.ExceptionTranslationFilter">
  <property name="authenticationEntryPoint">
   <ref bean="authenticationProcessingFilterEntryPoint"/>
   <!-- CAS 单点登陆 用casProcessingFilterEntryPoint代替authenticationProcessingFilterEntryPoint实现单点登陆 -->
   <!--ref bean="casProcessingFilterEntryPoint"/-->
  </property>
  <property name="accessDeniedHandler">
   <bean class="org.springframework.security.ui.AccessDeniedHandlerImpl">
    <property name="errorPage" value="/jsp/common/403.jsp"/>
   </bean>
  </property>
   </bean>
 <!--
    用户尚未通过身份验证时，会将控制转交到一个认证入口点，提供三种实现
    BasicProcessingFilterEnteyPoint :HTTP基本认证处理
    AuthenticationProcessingFilterEntryPoint :将用户重新定向到一个基于HTML表单的登入界面
    CasProssingFilterEntryPoint :将用户重新定向到一个基于Yale CAS登入界面
  --> 
  <bean id="authenticationProcessingFilterEntryPoint" class="org.springframework.security.ui.webapp.AuthenticationProcessingFilterEntryPoint">
    <property name="loginFormUrl" value="/sof_login.jsp"/>
    <property name="forceHttps" value="false"/>
    <property name="serverSideRedirect" value="false"></property>
 </bean>

</beans>