Spring Security 取Session中的值和修改userDetails(转)

1.在session中取得spring security的登录用户名如下

${session.SPRING_SECURITY_CONTEXT.authentication.principal.username}

spring security 把SPRING_SECURITY_CONTEXT 放入了session 没有直接把username 放进去。

下面一段代码主要描述的是session中的存的变量

view plaincopy to clipboardprint?
存跳转时候的URL  
session {SPRING_SECURITY_SAVED_REQUEST_KEY=SavedRequest[http://localhost:8080/AVerPortal/resourceAction/resourceIndex.action]}  
 
存的是登录成功时候session中存的信息  
session {SPRING_SECURITY_CONTEXT=org.springframework.security.context.SecurityContextImpl@87b16984: Authentication: org.springframework.security.providers.cas.CasAuthenticationToken@87b16984: Principal: com.avi.casExtends.UserInfo@ff631d80: Username: test; Password: [PROTECTED]; Enabled: true; AccountNonExpired: true; credentialsNonExpired: true; AccountNonLocked: true; Granted Authorities: ROLE_ADMIN; Password: [PROTECTED]; Authenticated: true; Details: org.springframework.security.ui.WebAuthenticationDetails@12afc: RemoteIpAddress: 127.0.0.1; SessionId: AE56E8925195DFF4C50ABD384574CCEA; Granted Authorities: ROLE_ADMIN Assertion: org.jasig.cas.client.validation.AssertionImpl@661a11 Credentials (Service/Proxy Ticket): ST-3-1lX3acgZ6HNgmhvjXuxB-cas, userId=2, userName=test} 
存跳转时候的URL
session {SPRING_SECURITY_SAVED_REQUEST_KEY=SavedRequest[http://localhost:8080/AVerPortal/resourceAction/resourceIndex.action]}

存的是登录成功时候session中存的信息
session {SPRING_SECURITY_CONTEXT=org.springframework.security.context.SecurityContextImpl@87b16984: Authentication: org.springframework.security.providers.cas.CasAuthenticationToken@87b16984: Principal: com.avi.casExtends.UserInfo@ff631d80: Username: test; Password: [PROTECTED]; Enabled: true; AccountNonExpired: true; credentialsNonExpired: true; AccountNonLocked: true; Granted Authorities: ROLE_ADMIN; Password: [PROTECTED]; Authenticated: true; Details: org.springframework.security.ui.WebAuthenticationDetails@12afc: RemoteIpAddress: 127.0.0.1; SessionId: AE56E8925195DFF4C50ABD384574CCEA; Granted Authorities: ROLE_ADMIN Assertion: org.jasig.cas.client.validation.AssertionImpl@661a11 Credentials (Service/Proxy Ticket): ST-3-1lX3acgZ6HNgmhvjXuxB-cas, userId=2, userName=test}

2.在页面端用tag获取

Java代码  

1. <%@ taglib prefix='security' uri='http://www.springframework.org/security/tags'%>    
2.   
3. <security:authentication property="principal.username"></security:authentication>   

<%@ taglib prefix='security' uri='http://www.springframework.org/security/tags'%> 

<security:authentication property="principal.username"></security:authentication> 

或者

Java代码  

1. <security:authorize ifAllGranted="ROLE_ADMIN">   
2.   
3.  <security:authentication property="principal.username"></security:authentication>    
4.   
5. </security:authorize>  

<security:authorize ifAllGranted="ROLE_ADMIN">

 <security:authentication property="principal.username"></security:authentication> 

</security:authorize>

或者取session中的值

#session.SPRING_SECURITY_CONTEXT.authentication.principal.username等同于

3.在后台获取

Java代码  

1. UserDetails userDetails = (UserDetails) SecurityContextHolder.getContext()   
2.     .getAuthentication()   
3.     .getPrincipal();   
4.   
5.   
6. userDetails.getUsername()  

UserDetails userDetails = (UserDetails) SecurityContextHolder.getContext()
    .getAuthentication()
    .getPrincipal();


userDetails.getUsername()

想要获取更多的信息得扩展userDetails的默认实现类user类和UserDetailsService接口

由于springsecurity是把整个user信息放入session中的即：session.SPRING_SECURITY_CONTEXT.authentication.principal

这个就是代表着user对象

因此我做了扩展增加user里的信息 加上userId

代码如下：扩展user

Java代码  

1.  expand sourceview plaincopy to clipboardprint?   
2. package com.avi.casExtends;      
3.      
4. import org.springframework.security.GrantedAuthority;      
5. import org.springframework.security.userdetails.User;      
6.      
7. public class UserInfo extends User{      
8.     private static final long serialVersionUID = 1L;      
9.      
10.     private String userId;      
11.      
12.     @SuppressWarnings("deprecation")      
13.     public UserInfo(String username, String password, boolean enabled, GrantedAuthority[] authorities)      
14.         throws IllegalArgumentException {      
15.         super(username,password, enabled, authorities);      
16.     }      
17.      
18.     public String getUserId() {      
19.         return userId;      
20.     }      
21.      
22.     public void setUserId(String userId) {      
23.         this.userId = userId;      
24.     }      
25.      
26.     public static long getSerialVersionUID() {      
27.         return serialVersionUID;      
28.     }      
29.      
30.         
31. }     
32. package com.avi.casExtends;   
33.   
34. import org.springframework.security.GrantedAuthority;   
35. import org.springframework.security.userdetails.User;   
36.   
37. public class UserInfo extends User{   
38.  private static final long serialVersionUID = 1L;   
39.   
40.     private String userId;   
41.   
42.     @SuppressWarnings("deprecation")   
43.  public UserInfo(String username, String password, boolean enabled, GrantedAuthority[] authorities)   
44.         throws IllegalArgumentException {   
45.         super(username,password, enabled, authorities);   
46.     }   
47.   
48.  public String getUserId() {   
49.   return userId;   
50.  }   
51.   
52.  public void setUserId(String userId) {   
53.   this.userId = userId;   
54.  }   
55.   
56.  public static long getSerialVersionUID() {   
57.   return serialVersionUID;   
58.  }   
59.   
60.      
61. }   
62.     
63.   
64. 实现userDetailsservice接口   
65.   
66. + expand sourceview plaincopy to clipboardprint?   
67. package com.avi.casExtends;      
68.      
69. import java.util.HashMap;      
70. import java.util.List;      
71. import java.util.Map;      
72.      
73. import org.springframework.dao.DataAccessException;      
74. import org.springframework.security.GrantedAuthority;      
75. import org.springframework.security.GrantedAuthorityImpl;      
76. import org.springframework.security.userdetails.UserDetails;      
77. import org.springframework.security.userdetails.UserDetailsService;      
78. import org.springframework.security.userdetails.UsernameNotFoundException;      
79.      
80. import com.avi.dao.AccountDao;      
81. import com.avi.data.User;      
82.      
83. public class UserInfoService implements UserDetailsService{      
84.           
85.     private AccountDao accountDao;      
86.     private Map<String, UserInfo> userMap = null;      
87.      
88.     public UserInfoService() {      
89.              
90.               
91.     }      
92.     public void fillMap(){      
93.          userMap = new HashMap<String, UserInfo>();      
94.          List<User> users = accountDao.findAllUsers();      
95.          UserInfo userInfo = null;      
96.          for(User user:users){      
97.             userInfo = new UserInfo(user.getUserName(),user.getPassword(),true,new GrantedAuthority[]{      
98.                 new GrantedAuthorityImpl(user.getRole()),      
99.             });      
100.             userInfo.setUserId(user.getId().toString());      
101.                   
102.              userMap.put(user.getUserName(), userInfo);      
103.          }      
104.     }      
105.           
106.     public UserDetails loadUserByUsername(String username)      
107.         throws UsernameNotFoundException, DataAccessException {      
108.         if(userMap==null)      
109.             fillMap();      
110.         return userMap.get(username);      
111.     }      
112.      
113.     public AccountDao getAccountDao() {      
114.         return accountDao;      
115.     }      
116.      
117.     public void setAccountDao(AccountDao accountDao) {      
118.         this.accountDao = accountDao;      
119.     }      
120.      
121.     public Map<String, UserInfo> getUserMap() {      
122.         return userMap;      
123.     }      
124.      
125.     public void setUserMap(Map<String, UserInfo> userMap) {      
126.         this.userMap = userMap;      
127.     }      
128.      
129. }     
130. package com.avi.casExtends;   
131.   
132. import java.util.HashMap;   
133. import java.util.List;   
134. import java.util.Map;   
135.   
136. import org.springframework.dao.DataAccessException;   
137. import org.springframework.security.GrantedAuthority;   
138. import org.springframework.security.GrantedAuthorityImpl;   
139. import org.springframework.security.userdetails.UserDetails;   
140. import org.springframework.security.userdetails.UserDetailsService;   
141. import org.springframework.security.userdetails.UsernameNotFoundException;   
142.   
143. import com.avi.dao.AccountDao;   
144. import com.avi.data.User;   
145.   
146. public class UserInfoService implements UserDetailsService{   
147.     
148.  private AccountDao accountDao;   
149.  private Map<String, UserInfo> userMap = null;   
150.   
151.     public UserInfoService() {   
152.           
153.            
154.     }   
155.     public void fillMap(){   
156.       userMap = new HashMap<String, UserInfo>();   
157.          List<User> users = accountDao.findAllUsers();   
158.          UserInfo userInfo = null;   
159.          for(User user:users){   
160.           userInfo = new UserInfo(user.getUserName(),user.getPassword(),true,new GrantedAuthority[]{   
161.            new GrantedAuthorityImpl(user.getRole()),   
162.           });   
163.           userInfo.setUserId(user.getId().toString());   
164.              
165.              userMap.put(user.getUserName(), userInfo);   
166.          }   
167.     }   
168.        
169.     public UserDetails loadUserByUsername(String username)   
170.         throws UsernameNotFoundException, DataAccessException {   
171.      if(userMap==null)   
172.       fillMap();   
173.         return userMap.get(username);   
174.     }   
175.   
176.  public AccountDao getAccountDao() {   
177.   return accountDao;   
178.  }   
179.   
180.  public void setAccountDao(AccountDao accountDao) {   
181.   this.accountDao = accountDao;   
182.  }   
183.   
184.  public Map<String, UserInfo> getUserMap() {   
185.   return userMap;   
186.  }   
187.   
188.  public void setUserMap(Map<String, UserInfo> userMap) {   
189.   this.userMap = userMap;   
190.  }   
191.   
192. }   
193.     
194.   
195.  private AccountDao accountDao;是注入进来的查数据库的类   
196.   
197. 然后修改XML文件指定所要用到的service   
198.   
199. + expand sourceview plaincopy to clipboardprint?   
200. <authentication-provider user-service-ref="userDetailsService"/>      
201.      
202. <bean id="userDetailsService" class="com.avi.casExtends.UserInfoService" singleton="false">      
203.         <property name="accountDao" ref="accountDao"/>      
204. </bean>     
205. <authentication-provider user-service-ref="userDetailsService"/>   
206.   
207. <bean id="userDetailsService" class="com.avi.casExtends.UserInfoService" singleton="false">   
208.   <property name="accountDao" ref="accountDao"/>   
209. </bean>    
210.   
211.   
212. ${session.SPRING_SECURITY_CONTEXT.authentication.principal.username}