spring-security3 配置和使用.

cleverbing

浏览: 15569 次
性别:
来自: 火星

最近访客更多访客>>

ceoajun

shlice

chennengwen

博主相关

博客

微博

相册

留言

关于我

文章分类

社区版块

存档分类

Spring 配置管理 Security XML Web

最近项目中要使用到spring-security，闲来没事就研究了下。发现入门挺简单的，在这里把自己的心得发下，希望对没有接触过想接触的朋友有帮助。

1、在spring-security官网下载最新jar然后拷贝jar到项目的lib下。
2、在classpath下添加security配置文件,例如applicationContext-security.xml.网上现在大多都是2.0的schema. 要根据自己使用的版本而定.下面是3.0的schema.

Xml代码
01.<?xml version="1.0" encoding="UTF-8"?>
02. <beans:beans xmlns="http://www.springframework.org/schema/security" 03.    xmlns:beans="http://www.springframework.org/schema/beans" 04.    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 05.    xsi:schemaLocation="http://www.springframework.org/schema/beans   06.    http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
07.    http://www.springframework.org/schema/security
08.    http://www.springframework.org/schema/security/spring-security-3.0.xsd"> 09.
10. </beans:beans> <?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security"
xmlns:beans="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
http://www.springframework.org/schema/security
http://www.springframework.org/schema/security/spring-security-3.0.xsd">

</beans:beans>

3、然后在web.xml中添加配置,内容如下:

Xml代码
01.
02.        <context-param> 03.        <param-name>contextConfigLocation</param-name> 04.        <param-value> 05.            classpath*:/applicationContext*.xml
06.        </param-value> 07.    </context-param> 08.
09.    <filter> 10.        <filter-name>springSecurityFilterChain</filter-name> 11.        <filter-class> 12.            org.springframework.web.filter.DelegatingFilterProxy
13.        </filter-class> 14.    </filter> 15.    <filter-mapping> 16.        <filter-name>springSecurityFilterChain</filter-name> 17.        <url-pattern>/*</url-pattern> 18.    </filter-mapping> 19.    <listener> 20.        <listener-class> 21.            org.springframework.web.context.ContextLoaderListener
22.        </listener-class> 23.    </listener> 
        <context-param>
<param-name>contextConfigLocation</param-name>
<param-value>
classpath*:/applicationContext*.xml
</param-value>
</context-param>

<filter>
<filter-name>springSecurityFilterChain</filter-name>
<filter-class>
org.springframework.web.filter.DelegatingFilterProxy
</filter-class>
</filter>
<filter-mapping>
<filter-name>springSecurityFilterChain</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<listener>
<listener-class>
org.springframework.web.context.ContextLoaderListener
</listener-class>
</listener>

配置起来很简单,由于我的security是整合到现有项目中的.一些jar可能已经存在. 单独做demo的朋友配置的时候可能会出现问题.

本想分开发挣点积分..但怕大家看起来累.. 就发到一起吧.. (*^__^*)

使用篇

1、建立login.jsp页面.内容如下:

Html代码
01.<form action="<%=path %>/j_spring_security_check" method="post">
02.        USERNAME:<input type="text" name="j_username" value="${sessionScope['SPRING_SECURITY_LAST_USERNAME']}" /><br/> 03.        PASSWORD:<input type="password" name="j_password" value="" /><br/> 04.        <input type="checkbox" name="_spring_security_remember_me" />两周之内不必登陆<br/> 05.        <input type="submit">        06.    </form> <form action="<%=path %>/j_spring_security_check" method="post">
    USERNAME:<input type="text" name="j_username" value="${sessionScope['SPRING_SECURITY_LAST_USERNAME']}" /><br/>
    PASSWORD:<input type="password" name="j_password" value="" /><br/>
    <input type="checkbox" name="_spring_security_remember_me" />两周之内不必登陆<br/>
<input type="submit">
    </form>

j_spring_security_check : 为security验证中心(不知道怎么说合适.暂时这么理解吧..).
j_username: 验证用户名;
j_password: 验证密码;
${sessionScope['SPRING_SECURITY_LAST_USERNAME']}:使用最后一次登录用户名.
_spring_security_remember_me:记住我...

2、xml配置,配置内容如下:

Xml代码
01.<?xml version="1.0" encoding="UTF-8"?>
02. <beans:beans xmlns="http://www.springframework.org/schema/security" 03.    xmlns:beans="http://www.springframework.org/schema/beans" 04.    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 05.    xsi:schemaLocation="http://www.springframework.org/schema/beans   06.    http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
07.    http://www.springframework.org/schema/security
08.    http://www.springframework.org/schema/security/spring-security-3.0.xsd"> 09.
10.     13.    <http auto-config="true" access-denied-page="/common/403.jsp"> 14.         15.        <intercept-url pattern="/index.jsp" access="ROLE_USER" /> 16.        <intercept-url pattern="/login.jsp" filters="none" /> 17.        <intercept-url pattern="/common/**" filters="none" /> 18.        <intercept-url pattern="/script/**" filters="none" /> 19.        <intercept-url pattern="/admin.jsp" access="ROLE_ADMIN" /> 20.        <intercept-url pattern="/user.jsp" access="ROLE_USER" /> 21.
22.         23.         27.        <session-management session-fixation-protection="none"> 28.            <concurrency-control/> 29.        </session-management> 30.
31.         32.        <form-login login-page="/login.jsp" 33.            authentication-failure-url="/common/403.jsp" 34.            default-target-url="/admin.jsp" /> 35.         36.        <logout logout-success-url="/login.jsp"/> 37.        <http-basic /> 38.
39.    </http> 40.
41.     50.
51.     52.    <authentication-manager> 53.        <authentication-provider> 54.             61.              62.            <jdbc-user-service data-source-ref="dataSource" 63.                users-by-username-query="select username,password,enabled from user where username = ? and enabled = 1" 64.                authorities-by-username-query="select u.username,r.name from user u join user_role ur on u.uid = ur.uid join role r on r.rid = ur.rid where u.username = ?" /> 65.             72.        </authentication-provider> 73.    </authentication-manager> 74.    
77.
78.     85.</beans:beans> <?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security"
xmlns:beans="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
http://www.springframework.org/schema/security
http://www.springframework.org/schema/security/spring-security-3.0.xsd">


<http auto-config="true" access-denied-page="/common/403.jsp">

<intercept-url pattern="/index.jsp" access="ROLE_USER" />
<intercept-url pattern="/login.jsp" filters="none" />
<intercept-url pattern="/common/**" filters="none" />
<intercept-url pattern="/script/**" filters="none" />
<intercept-url pattern="/admin.jsp" access="ROLE_ADMIN" />
<intercept-url pattern="/user.jsp" access="ROLE_USER" />



<session-management session-fixation-protection="none">
<concurrency-control/>
</session-management>


<form-login login-page="/login.jsp"
authentication-failure-url="/common/403.jsp"
default-target-url="/admin.jsp" />

<logout logout-success-url="/login.jsp"/>
<http-basic />

</http>




<authentication-manager>
<authentication-provider>


<jdbc-user-service data-source-ref="dataSource"
users-by-username-query="select username,password,enabled from user where username = ? and enabled = 1"
authorities-by-username-query="select u.username,r.name from user u join user_role ur on u.uid = ur.uid join role r on r.rid = ur.rid where u.username = ?" />

</authentication-provider>
</authentication-manager>



</beans:beans>

以上配置结束后可以完成用户登录\权限验证等操作.
配置和使用到这里就结束了. 今天下午的小心得.. spring-security很强大. 在这里感谢family168的在线帮助. 谢谢.. 希望对没有接触过spring-security的朋友有所帮助.

本文来自http://www.cnblogs.com/wenxiu/archive/2011/01/22/1942084.html

分享到：