Spring security HTTP Basic认证

　　Spring security框架集成了多种流行的安全认证服务，为我们提供了多种多样的安全认证服务。在这里讨论一下它为我们提供的HTTP Basic认证服务。要实现HTTP Basic认证服务，需要实现这几步：

 

　　一。导入Spring security相关jar包

 

 

        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-core</artifactId>
            <version>3.0.5.RELEASE</version>
        </dependency>
        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-core-tiger</artifactId>
            <version>2.0.5.RELEASE</version>
        </dependency>
        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-config</artifactId>
            <version>3.0.5.RELEASE</version>
        </dependency>
        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-acl</artifactId>
            <version>3.0.5.RELEASE</version>
        </dependency>
        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-taglibs</artifactId>
            <version>3.0.5.RELEASE</version>
        </dependency>

 

 

　　二。在web.xml配置filter

 

 

<filter>
        <filter-name>springSecurityFilterChain</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    </filter>

    <filter-mapping>
        <filter-name>springSecurityFilterChain</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

 

 

　　三。配置spring-security.xml文件

 

 

<?xml version="1.0" encoding="UTF-8"?>

<beans:beans xmlns="http://www.springframework.org/schema/security"
             xmlns:beans="http://www.springframework.org/schema/beans"
             xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
             xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
                        http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.0.xsd">

    <!--<global-method-security pre-post-annotations="enabled">-->
        <!--&lt;!&ndash; AspectJ pointcut expression that locates our "post" method and applies security that way-->
        <!--<protect-pointcut expression="execution(* bigbank.*Service.post*(..))" access="ROLE_TELLER"/>-->
        <!--&ndash;&gt;-->
    <!--</global-method-security>-->

    <http use-expressions="true">
        <intercept-url pattern="/secure/extreme/**" access="hasRole('ROLE_SUPERVISOR')" requires-channel="https"/>
        <intercept-url pattern="/secure/**" access="isAuthenticated()"/>
        <!-- Disable web URI authorization, as we're using <global-method-security> and have @Secured the services layer instead
        <intercept-url pattern="/listAccounts.html" access="isRememberMe()" />
        <intercept-url pattern="/post.html" access="hasRole('ROLE_TELLER')" />
        -->
        <intercept-url pattern="/**" access="isAuthenticated()"/>
        <!--<form-login/>-->
        <!--<logout/>-->
        <!--<remember-me/>-->
        <http-basic/>
        <!--
    Uncomment to enable X509 client authentication support
        <x509 />
-->
        <!-- Uncomment to limit the number of sessions a user can have -->
        <!--<session-management invalid-session-url="/timeout.jsp">-->
            <!--<concurrency-control max-sessions="1" error-if-maximum-exceeded="true"/>-->
        <!--</session-management>-->

    </http>

    <!--
    Usernames/Passwords are
        rod/koala
        dianne/emu
        scott/wombat
        peter/opal
    -->
    <authentication-manager>
        <authentication-provider>
            <password-encoder hash="md5"/>
            <user-service>
                <user name="rod" password="a564de63c2d0da68cf47586ee05984d7"
                      authorities="ROLE_SUPERVISOR, ROLE_USER, ROLE_TELLER"/>
                <user name="dianne" password="65d15fe9156f9c4bbffd98085992a44e" authorities="ROLE_USER,ROLE_TELLER"/>
                <user name="scott" password="2b58af6dddbd072ed27ffc86725d7d3a" authorities="ROLE_USER"/>
                <user name="peter" password="22b5c9accc6e1ba628cedc63a72d57f8" authorities="ROLE_USER"/>
            </user-service>
        </authentication-provider>
    </authentication-manager>

</beans:beans>

 

 

　　这样就可以使用Spring security提供的HTTP Basic认证服务。但这也有很多的缺点，首要就是用户账号的安全性低，其次因为是在配置文件中添加用户账户的，所以局限性太强，如果想要添加大量的用户这种实现方式就不行了。以后我会再讨论Spring security为我们提供的其它认证服务。