spring security3.2 总结

最新推荐文章于 2024-04-23 10:33:06 发布

山闻愚

最新推荐文章于 2024-04-23 10:33:06 发布

阅读量1.1k

点赞数

分类专栏： spring java 文章标签： spring security

本文链接：https://blog.csdn.net/xjj1314/article/details/38363525

版权

java 同时被 2 个专栏收录

17 篇文章 0 订阅

订阅专栏

spring

6 篇文章 0 订阅

订阅专栏

spring security 总共有11个过滤器，依顺序如下：

'SecurityContextPersistenceFilter'
'WebAsyncManagerIntegrationFilter'
'LogoutFilter'
'UsernamePasswordAuthenticationFilter'
'BasicAuthenticationFilter'
'RequestCacheAwareFilter'
'SecurityContextHolderAwareRequestFilter'
'AnonymousAuthenticationFilter'
'SessionManagementFilter'
'ExceptionTranslationFilter'
'FilterSecurityInterceptor'

每个过滤器依次调用。
主要是会用到UsernamePasswordAuthenticationFilter、FilterSecurityInterceptor

bean配置：

<?xml version="1.0" encoding="UTF-8"?>

<beans xmlns="http://www.springframework.org/schema/beans"
    xmlns:sec="http://www.springframework.org/schema/security"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.springframework.org/schema/beans
        http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
        http://www.springframework.org/schema/security
        http://www.springframework.org/schema/security/spring-security-3.2.xsd"

<bean id="passwordEncoder" class="org.springframework.security.authentication.encoding.Md5PasswordEncoder" />
   
   <bean id="saltSource" class="org.springframework.security.authentication.dao.ReflectionSaltSource">
        <property name="userPropertyToUse" value="username"/>
   </bean>

   
   <bean id="messageSource"
        class="org.springframework.context.support.ReloadableResourceBundleMessageSource">
        <property name="basename"
            value="classpath:messages_zh_CN"/>
   </bean>

   
   <bean id="userCache"
        class="org.springframework.security.core.userdetails.cache.EhCacheBasedUserCache">
        <property name="cache" ref="userEhCache" />
   </bean>

   <bean id="userEhCache" class="org.springframework.cache.ehcache.EhCacheFactoryBean">
        <property name="cacheName" value="userCache" />
        <property name="cacheManager" ref="cacheManager" />
   </bean>

   <bean id="cacheManager"

class="org.springframework.cache.ehcache.EhCacheManagerFactoryBean" />

<bean id="userDetailsService" class="com.phms.security.SysUserDetailsService" />

    <sec:http pattern="/**/*.css" security="none"/>
    <sec:http pattern="/**/*.jpg" security="none"/>
    <sec:http pattern="/**/*.jpeg" security="none"/>
    <sec:http pattern="/**/*.gif" security="none"/>
    <sec:http pattern="/**/*.png" security="none"/>
    <sec:http pattern="/**/*.js" security="none"/>
   <sec:http pattern="/login.jsp" security="none"/>

<sec:http auto-config="true" entry-point-ref="authenticationProcessingFilterEntryPoint">

       
       <sec:access-denied-handler ref="accessDeniedHandler"/>

<!-- 配置登录UsernamePasswordAuthenticationFilter的属性

UsernamePasswordAuthenticationFilter，对用户进行授权，比如进行密码验证。

它会自动注入bean：userDetailsService、passwordEncoder、userCache、messageSource。

如果不需要授权成功或失败后进行特殊处理，下面两行：

authentication-failure-handler-ref="authenticationFailureHandler"
authentication-success-handler-ref="authenticationSuccessHandler

可以配置为：

authentication-failure-url="/login.jsp?error=true"
default-target-url="/welcome”。

            login-processing-url="/j_spring_security_check"        登入页面form action 这个不配置的话，默认就是action=“/j_spring_security_check”，可以改
            password-parameter="j_password"                              帐号默认name="j_username"，可以改
            username-parameter="j_username"                            密码默认name="j_password"，可以改
           (没用过spring security 的要注意,网上很多介绍spring security 的，但是不给登入页面，新手刚开始不知道默认是这个，然后又不知道哪里配置，

登入后始终达不到想要的目的。)

-->
       <sec:form-login login-page="/login.jsp"
            login-processing-url="/j_spring_security_check"
            password-parameter="j_password"
            username-parameter="j_username"
            authentication-failure-handler-ref="authenticationFailureHandler"
            authentication-success-handler-ref="authenticationSuccessHandler"/>

<sec:logout invalidate-session="true" logout-url="/logout" logout-success-url="/login.jsp" />

<sec:session-management invalid-session-url="/login.jsp" />


       <sec:custom-filter ref="filterSecurityInterceptor" before="FILTER_SECURITY_INTERCEPTOR"/>
   </sec:http>

<bean id="authenticationSuccessHandler"
        class="org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler">
        <property name="defaultTargetUrl" value="/welcome"/>
    </bean>
    
    <bean id="authenticationFailureHandler"
        class="org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler">
        <property name="defaultFailureUrl" value="/login.jsp?error=true"/>
    </bean>

<bean id="filterSecurityInterceptor" class="org.springframework.security.web.access.intercept.FilterSecurityInterceptor">
       
        <property name="securityMetadataSource" ref="securityMetadataSource" />
       
       <property name="rejectPublicInvocations" value="true"/>
        
        <property name="authenticationManager" ref="authenticationManager" />
        
        
        <property name="accessDecisionManager" ref="accessDecisionManager" />
   </bean>

<!-- 验证授权异常，退回到登入页面
       authenticationProcessingFilterEntryPoint，accessDeniedHandler什么时候用,可以研究一下ExceptionTranslationFilter。
       从ExceptionTranslationFilter知道，
       1.authenticationProcessingFilterEntryPoint针对AuthenticationException异常时行处理，此异常只在authentication的时候使用，Authentication成功后，

不会再进行 Authentication,所以authenticationProcessingFilterEntryPoint，在filterSecurityInterceptor.alwaysReauthenticate默认为false情况下只会在登入时候使用。
2.accessDeniedHandler在用户不为匿名访问情况下，针对AccessDeniedException异常时行处理，此异常在accessDecisionManager时候使用，

在系统运行时对所有资源进行认证。所以accessDecisionManager只要用户有访问，它就会被调用。
     -->
    <bean id="authenticationProcessingFilterEntryPoint" class="com.phms.security.SysLoginUrlAuthenticationEntryPoint">
        <property name="loginFormUrl" value="/login.jsp?error=true"/>
    </bean>
    <!-- 认证权限不足，退回到登入页面
       authenticationProcessingFilterEntryPoint，accessDeniedHandler什么时候用,可以研究一下ExceptionTranslationFilter。
       从ExceptionTranslationFilter知道，
       1.authenticationProcessingFilterEntryPoint针对AuthenticationException异常时行处理，此异常只在authentication的时候使用，Authentication成功后，

不会再进行 Authentication, 所以authenticationProcessingFilterEntryPoint，在filterSecurityInterceptor.alwaysReauthenticate默认为false情况下只会在登入时候使用。
2.accessDeniedHandler在用户不为匿名访问情况下，针对AccessDeniedException异常时行处理，此异常在accessDecisionManager时候使用，

在系统运行时对所有资源进行认证。所以accessDecisionManager只要用户有访问，它就会被调用。
    -->
   <bean id="accessDeniedHandler" class="org.springframework.security.web.access.AccessDeniedHandlerImpl" >
       <property name="errorPage" value="/login.jsp?error=denied"/>
   </bean>

   
   <bean id="accessDecisionManager" class="org.springframework.security.access.vote.AffirmativeBased">
        <constructor-arg name="decisionVoters">
            <list>
                <ref bean="authenticatedVoter"/>
                <ref bean="roleVoter"/>
            </list>
        </constructor-arg>
        <property name="messageSource" ref="messageSource"/>
   </bean>

   
   <bean id="authenticatedVoter" class="org.springframework.security.access.vote.AuthenticatedVoter" />
   
   <bean id="roleVoter" class="org.springframework.security.access.vote.RoleVoter">
       
        <property name="rolePrefix" value="R_"/>
   </bean>

    
   <sec:authentication-manager alias="authenticationManager">
        <sec:authentication-provider ref="authenticationProvider" />
    </sec:authentication-manager>

   
   <bean id="authenticationProvider" class="org.springframework.security.authentication.dao.DaoAuthenticationProvider">
       
        <property name="hideUserNotFoundExceptions" value="false" />
        
        <property name="userDetailsService" ref="userDetailsService" />
        <property name="passwordEncoder" ref="passwordEncoder" />
        <property name="saltSource" ref="saltSource" />
   </bean>


/**
* 根据用户名，加载用户的认证信息，包括用户的权限和用户登录信息
* 提供给spring security authentication manager 进行认证
* @author swy
*/
public class SysUserDetailsService implements UserDetailsService {

   protected final Logger log = LoggerFactory.getLogger(SysUserDetailsService.class);
    @Autowired
    private MessageSource messageSource;

   @Override
   public UserDetails loadUserByUsername(String username)
           throws UsernameNotFoundException {

       //此处可以通过数据库访问取得用户信息

       Collection<GrantedAuthority> auths = new ArrayList<GrantedAuthority>();
       GrantedAuthority grantedAuthority = new SimpleGrantedAuthority("R_A");
       auths.add(grantedAuthority);

        //UserBO 必须实现UserDetails
       UserDetails user = new UserBO("1","admin","c3ce8345d3599ab8a4c337d9fb0d0d93",true,true,true,true,auths);

        if(log.isDebugEnabled()) log.debug(StringUtils.bean2Str(user.getAuthorities()));

        return user;
   }

   public MessageSource getMessageSource() {
       return messageSource;
   }

   public void setMessageSource(MessageSource messageSource) {
       this.messageSource = messageSource;
   }

   public static void main(String[] args) {
       //生成MD5加密的密码
       MessageDigestPasswordEncoder mp = new MessageDigestPasswordEncoder("MD5");
       System.out.println(mp.encodePassword("1", "admin"));
   }
}

/**
* 取得资源和权限的关系映射
* @author swy
*
*/
@Service("securityMetadataSource")
public class SysFilterInvocationSecurityMetadataSource implements FilterInvocationSecurityMetadataSource {

   private static final Logger log = LoggerFactory.getLogger(SysFilterInvocationSecurityMetadataSource.class);
   private final static List<ConfigAttribute> NULL_CONFIG_ATTRIBUTE = Collections.emptyList();
        //权限集合
        private Map<RequestMatcher, Collection<ConfigAttribute>> requestMap;

        @Override
        public Collection<ConfigAttribute> getAttributes(Object object)
                throws IllegalArgumentException {
            final HttpServletRequest request = ((FilterInvocation) object).getRequest();
            System.out.println("URL资源："+request.getRequestURI()+ " -> ");

            for (Map.Entry<RequestMatcher, Collection<ConfigAttribute>> entry : this.bindRequestMap().entrySet()) {
                if (entry.getKey().matches(request)) {
                   LogUtils.autolog(log,"URL资源："+request.getRequestURI()+ " -> " + entry.getValue());
                    return entry.getValue();
                }
            }
            return NULL_CONFIG_ATTRIBUTE;
        }

        @Override
        public Collection<ConfigAttribute> getAllConfigAttributes() {
            Set<ConfigAttribute> allAttributes = new HashSet<ConfigAttribute>();

            for (Map.Entry<RequestMatcher, Collection<ConfigAttribute>> entry : this.bindRequestMap().entrySet()) {
                allAttributes.addAll(entry.getValue());
            }

            return allAttributes;
        }


        @Override
        public boolean supports(Class<?> clazz) {
            return FilterInvocation.class.isAssignableFrom(clazz);
        }

        private Map<String,String> loadResuorce(){
            Map<String,String> map = new LinkedHashMap<String,String>();
//此处可以通过数据库访问取得用户信息
            List<Map<String,String>> list = new ArrayList<Map<String,String>>();
            map.put("/welcome", "R_A,IS_AUTHENTICATED_ANONYMOUSLY");
            map.put("/menu/*", "R_A,R_B");
            map.put("/order/*", "R_A,R_B");
            return map;
        }

        protected Map<RequestMatcher, Collection<ConfigAttribute>> bindRequestMap(){
            Map<RequestMatcher, Collection<ConfigAttribute>> map =
                    new LinkedHashMap<RequestMatcher, Collection<ConfigAttribute>>();

            Map<String,String> resMap = this.loadResuorce();
            for(Map.Entry<String,String> entry:resMap.entrySet()){
                String key = entry.getKey();
                Collection<ConfigAttribute> atts = new ArrayList<ConfigAttribute>();
                atts = SecurityConfig.createListFromCommaDelimitedString(entry.getValue());
                map.put(new AntPathRequestMatcher(key), atts);
            }

            return map;
        }

        @PostConstruct
        public void afterPropertiesSet() throws Exception{
            this.requestMap = this.bindRequestMap();
        }

        public void refreshResuorceMap(){
            this.requestMap = this.bindRequestMap();
        }
}

/**
       验证授权异常，退回到登入页面
       authenticationProcessingFilterEntryPoint，accessDeniedHandler什么时候用,可以研究一下ExceptionTranslationFilter。
       从ExceptionTranslationFilter知道，
       1.authenticationProcessingFilterEntryPoint针对AuthenticationException异常时行处理，此异常只在authentication的时候使用，Authentication成功后，不会再进行 Authentication,
       所以authenticationProcessingFilterEntryPoint，在filterSecurityInterceptor.alwaysReauthenticate默认为false情况下只会在登入时候使用。
       2.accessDeniedHandler在用户不为匿名访问情况下，针对AccessDeniedException异常时行处理，此异常在accessDecisionManager时候使用，在系统运行时对所有资源进行认证。
       所以accessDecisionManager只要用户有访问，它就会被调用。
* @author swy
*
*/
@SuppressWarnings("deprecation")
public class SysLoginUrlAuthenticationEntryPoint extends LoginUrlAuthenticationEntryPoint {
   private static final Log logger = LogFactory.getLog(SysLoginUrlAuthenticationEntryPoint.class);

    private final RedirectStrategy redirectStrategy = new DefaultRedirectStrategy();

    public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException authException)
            throws IOException, ServletException {
        if (logger.isDebugEnabled()) {
            logger.debug("SysLoginUrlAuthenticationEntryPoint: " + getLoginFormUrl());
        }

        String redirectUrl = null;
        if (isUseForward()) {

            if (isForceHttps() && "http".equals(request.getScheme())) {
                // First redirect the current request to HTTPS.
                // When that request is received, the forward to the login page will be used.
                redirectUrl = buildHttpsRedirectUrlForRequest(request);
            }

            if (redirectUrl == null) {
                String loginForm = determineUrlToUseForThisRequest(request, response, authException);

                if (logger.isDebugEnabled()) {
                    logger.debug("Server side forward to: " + loginForm);
                }
                // 传递异常到页面
                request.setAttribute(WebAttributes.AUTHENTICATION_EXCEPTION, authException);

                RequestDispatcher dispatcher = request.getRequestDispatcher(loginForm);

                dispatcher.forward(request, response);

                return;
            }
        } else {
            // redirect to login page. Use https if forceHttps true

            redirectUrl = buildRedirectUrlToLoginPage(request, response, authException);

            //传递异常到页面
            request.getSession(true).setAttribute(WebAttributes.AUTHENTICATION_EXCEPTION, authException);

            redirectStrategy.sendRedirect(request, response, redirectUrl);
        }
    }

}

login.jsp：

<%@ page language="java" contentType="text/html; charset=UTF-8" pageEncoding="UTF-8"%>
<%@ taglib prefix="sec" uri="http://www.springframework.org/security/tags" %>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
    <title>登入</title>
</head>

<body>
   <table width="100%" height="100%" bgcolor="#FFFFFF">
       <tr align="center">
           <td>
           <div class="easyui-panel" title="登入" style="width:400px;height:auto;" align="center">
           <br/>
            <form action="${pageContext.request.contextPath}/j_spring_security_check" method="post">
                  
               <div style="display:${param.error == true ? 'block' : 'none'}">
                   <font color="red" size="10">登入失败:${sessionScope['SPRING_SECURITY_LAST_EXCEPTION'].message}</font>
                   </div>
               <div style="display:${param.error == 'denied' ? 'block' : 'none'}">
                   <font color="red" size="10">登入失败2:${SPRING_SECURITY_403_EXCEPTION.message}</font>
                   </div>
               帐号：<input name="j_username"><br/><br/>
               密码：<input type="password" name="j_password"><br/><br/>
               <input type="submit" value="登陆">
            </form>
            </div>
           </td>
       </tr>
   </table>
</body>
</html>

山闻愚

关注

0
点赞
踩
0

收藏

觉得还不错? 一键收藏
0
评论
spring security3.2 总结

xmlns:sec="http://www.springframework.org/schema/security" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.springframework.org/schema/beans
复制链接

扫一扫

专栏目录