acegi+ssh动态实现基于角色的权限管理(一)

    第一次写blog,由于文笔差,请大家见谅.

    最近通过springside和springframework社区学习acegi,并将其加入到我的设计之中.,现在做到web-request,method interceptor,至于domain object级别和acl也没有去研究,但感觉做到这两步也就差不多了吧..

   jar包:

    spring1.2.jar   

    acegi-security-1.0.3.jar    

    commons-codec-1.3.jar

    ehcache-1.2.3.jar

 

   下边说一下我的实现步骤和方法.

    first:数据库结构的设计,我没有用acegi默认的数据库结构,分别用了6张表来实现自己的数据库表.

       权限资源表:存储受保护的url,method

CREATE TABLE `authorities` (
  `auth_ID` int(11) NOT NULL auto_increment,
  `authProtected` varchar(100) NOT NULL,
  `authNote` varchar(200) default NULL,
  `authType` int(2) NOT NULL,
  `authState` int(1) NOT NULL,
  PRIMARY KEY  (`auth_ID`),
  KEY `FK_authorities` (`authType`),
  CONSTRAINT `authorities_ibfk_1` FOREIGN KEY (`authType`) REFERENCES `authtype` (`type_ID`) ON UPDATE CASCADE
) ENGINE=InnoDB DEFAULT CHARSET=utf8;

 

     权限资源类型表:

CREATE TABLE `authtype` (
  `type_ID` int(11) NOT NULL auto_increment,
  `typeName` varchar(20) NOT NULL,
  `typeState` int(11) NOT NULL default '0',
  PRIMARY KEY  (`type_ID`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8;

     角色表:

CREATE TABLE `role` (
  `role_ID` int(11) NOT NULL auto_increment,
  `roleName` varchar(20) NOT NULL,
  `roleNote` varchar(50) default NULL,
  `roleState` int(11) NOT NULL default '0',
  PRIMARY KEY  (`role_ID`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8;

    角色_权限资源表:

CREATE TABLE `role_auth` (
  `role_auth_ID` int(11) NOT NULL auto_increment,
  `role_ID` int(11) NOT NULL,
  `auth_ID` int(11) NOT NULL,
  PRIMARY KEY  (`role_auth_ID`),
  KEY `FK_role_auth` (`role_ID`),
  KEY `FK_auth_role` (`auth_ID`),
  CONSTRAINT `role_auth_ibfk_1` FOREIGN KEY (`role_ID`) REFERENCES `role` (`role_ID`) ON UPDATE CASCADE,
  CONSTRAINT `role_auth_ibfk_2` FOREIGN KEY (`auth_ID`) REFERENCES `authorities` (`auth_ID`) ON UPDATE CASCADE
) ENGINE=InnoDB DEFAULT CHARSET=utf8;

   用户表:

CREATE TABLE `users` (
  `user_ID` int(11) NOT NULL auto_increment,
  `userName` varchar(40) NOT NULL,
  `userPass` varchar(40) NOT NULL,
  `enabled` int(1) NOT NULL default '0',
  PRIMARY KEY  (`user_ID`),
  UNIQUE KEY `userName` (`userName`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8;

  用户_角色表:

CREATE TABLE `user_role` (
  `user_role_ID` int(11) NOT NULL auto_increment,
  `user_ID` int(11) NOT NULL,
  `role_ID` int(11) NOT NULL,
  PRIMARY KEY  (`user_role_ID`),
  KEY `FK_user_role` (`user_ID`),
  KEY `FK_role_users` (`role_ID`),
  CONSTRAINT `user_role_ibfk_1` FOREIGN KEY (`user_ID`) REFERENCES `users` (`user_ID`) ON UPDATE CASCADE,
  CONSTRAINT `user_role_ibfk_2` FOREIGN KEY (`role_ID`) REFERENCES `role` (`role_ID`) ON UPDATE CASCADE
) ENGINE=InnoDB DEFAULT CHARSET=utf8;

 主要用到Users,Roles,Authorities三张表,由于Users,Roles多对对,Roles,Authorities也是多对多关系,加了2张中间表,另外authType为区分权限资源的类型,受保护的权限资源有url,method以及domain object的三种保护类型.

当然也可以不要这张表.

 

second:在web.xml配置如下:

<context-param>
   <param-name>contextConfigLocation</param-name>
   <param-value>/WEB-INF/spring.xml,/WEB-INF/spring_security_acegi.xml,
      /WEB-INF/spring_dao.xml,/WEB-INF/spring_service.xml,
      /WEB-INF/spring_action.xml</param-value>
  </context-param>

  <!-- set acegi filter -->
  <filter>
   <filter-name>acegiFilterChainProxy</filter-name>
   <filter-class>org.acegisecurity.util.FilterToBeanProxy</filter-class>
   <init-param>
    <param-name>targetClass</param-name>
    <!-- you can change there to set channelProcessingFilter -->
    <param-value>org.acegisecurity.util.FilterChainProxy</param-value>
   </init-param>
  </filter>
  <filter-mapping>
   <filter-name>acegiFilterChainProxy</filter-name>
   <url-pattern>/*</url-pattern>
  </filter-mapping>

  先通过ContextLoaderListener加载acegi的配置文件,存放在webApplicationContext中.然后将所有的过滤请求交给FilterChainProxy处理.

如果需要使用channelProcessingFilter 安全通道处理的话,在这里也可以加上.

以前使用openSessionInView,我只把spring.xml这个主配置文件通过ContextLoader

Listener加载,现在为了需要,全都用这个加载了.

 

  third:配置spring_security_acegi.xml

  通过ant加载所有的过滤器

  <!-- load all filter or inteceptor with ant -->
 <bean id="filterChainProxy" class="org.acegisecurity.util.FilterChainProxy">
  <property name="filterInvocationDefinitionSource">
   <value>
    CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON
    PATTERN_TYPE_APACHE_ANT
    /**=httpSessionContextIntegrationFilter,logoutFilter,basicProcessingFilter,authenticationProcessingFilter,securityContextHolderAwareRequestFilter,rememberMeProcessingFilter,anonymousProcessingFilter,exceptionTranslationFilter,filterInvocationInterceptor
   </value>
  </property>
 </bean>

  八个过滤器, 一个拦截器,注意的两个问题:

  1:注意过滤器之间的先后顺序,否则会出一些错误的.

  2:所有过滤器都写一行,不要换行,否则换行的那些过滤器在加载的时候会报什么bean name ""错误.

  下边就是这些过滤器了.

 
 <!-- 1. set httpSessionContextIntegrationFilter -->
 <bean id="httpSessionContextIntegrationFilter" class="org.acegisecurity.context.HttpSessionContextIntegrationFilter"/>
 集成所有过滤器的,没什么好说

 

 <!-- 2. set logoutFilter -->

 注销过滤器
 <bean id="logoutFilter" class="org.acegisecurity.ui.logout.LogoutFilter">
  <constructor-arg value="/admin_login.jsp"/>
  <constructor-arg>
   <list>
    <ref bean="rememberMeServices"/>
    <ref bean="securityContextLogoutHanlder"/>
   </list>
  </constructor-arg>
  <property name="filterProcessesUrl" value="/logout"/>
 </bean>
 <!-- set rememberMeServices -->
 <bean id="rememberMeServices" class="org.acegisecurity.ui.rememberme.TokenBasedRememberMeServices">
  <property name="userDetailsService" ref="hibernateDaoImpl"/>
  <property name="key" value="rememberMeUser"/>
  <property name="parameter" value="rememberMe"/>
  <property name="authenticationDetailsSource" ref="authenticationDetailsSourceHandler"/>
 </bean>
 <!-- set SecurityContextLogoutHandler -->
 <bean id="securityContextLogoutHanlder" class="org.acegisecurity.ui.logout.SecurityContextLogoutHandler"/>
这个过滤器用来注销用户信息,如果用了cookie保存的话,需要进行设置.

 

<bean id="authenticationDetailsSourceHandler" class="com.runsa.components.acegi.support.AuthenticationDetailsSourceHandler"/>

这个是自己实现的,为了解决ConCurrentSessionImpl与rememberMe冲突的问题

public class AuthenticationDetailsSourceHandler extends
  AuthenticationDetailsSourceImpl {

 /**
  * 解决rememberMe与ConCurrentSessionController冲突
  */
 @Override
 public Object buildDetails(HttpServletRequest request) {
  // TODO 自动生成方法存根
  HttpSession session = request.getSession(false);
  if(session == null ){
   session = request.getSession(true);
  }
  return super.buildDetails(request);
 }
}

 

 基本处理过滤器,设置了登录入口页面,这个可以不要

 <!-- 3.set basicProcessingFilter -->
 <bean id="basicProcessingFilter" class="org.acegisecurity.ui.basicauth.BasicProcessingFilter">
  <property name="authenticationManager" ref="authenticationManager"/>
  <property name="authenticationEntryPoint">
   <bean class="org.acegisecurity.ui.basicauth.BasicProcessingFilterEntryPoint">
    <property name="realmName" value="www.runsa.cn"/>
   </bean>
  </property>
 </bean>

 

 认证处理过滤器,应该是最重要的一个了吧

<!-- 4.set authenticationProcessingFilter -->
 <bean id="authenticationProcessingFilter" class="org.acegisecurity.ui.webapp.AuthenticationProcessingFilter">
  <property name="authenticationManager" ref="authenticationManager"/>
  <property name="authenticationFailureUrl" value="/admin_login.jsp?login_error=loginError"/>
  <property name="defaultTargetUrl" value="/admin/adminIndex.do"/>
  <property name="filterProcessesUrl" value="/check"/>
  <property name="rememberMeServices" ref="rememberMeServices"/>
  <property name="alwaysUseDefaultTargetUrl" value="true"/>
 </bean>

  authenticationManager认证管理器,这个等会在说

  authenticationFailureUrl认证失败页面

  defaultTargetUrl认证成功后转向的页面,我设置alwaysUseDefaultTargetUrl

为true,在认证成功后,自己做一些其他的处理.

 filterProcessesUrl认证时提交的form对应的ation

 rememberMeServices,认证时先通过cookie获取保存信息进行认证.

 

securityContextHolder处理过滤器,他用来存放securityContext信息,而securityContext存放Authorities[]权限信息,principal(存放用户信息)

<!-- 5.set securityContextHolderAwareRequestFilter -->
 <bean id="securityContextHolderAwareRequestFilter" class="org.acegisecurity.wrapper.SecurityContextHolderAwareRequestFilter"/>

 

cookie处理过滤器

<!-- 6.set rememberMeProcessingFilter -->
 <bean id="rememberMeProcessingFilter" class="org.acegisecurity.ui.rememberme.RememberMeProcessingFilter">
  <property name="authenticationManager" ref="authenticationManager"/>
  <property name="rememberMeServices" ref="rememberMeServices"/>
 </bean>

记录cookie信息

 

匿名处理过滤器

 <!-- 7.set anonymousProcessingFilter -->
 <bean id="anonymousProcessingFilter" class="org.acegisecurity.providers.anonymous.AnonymousProcessingFilter">
  <property name="key" value="anonymousUser"/>
  <property name="userAttribute" value="isAnonymous,ROLE_ANONYMOUS"/>
 </bean>

 

异常处理过滤器

 <!-- 8. set exceptionTranslationFilter -->
 <bean id="exceptionTranslationFilter" class="org.acegisecurity.ui.ExceptionTranslationFilter">
  <property name="authenticationEntryPoint">
   <bean class="org.acegisecurity.ui.webapp.AuthenticationProcessingFilterEntryPoint">
    <property name="loginFormUrl" value="/admin_login.jsp?login_error=noLogin"/>
    <property name="forceHttps" value="false"/>
   </bean>
  </property>
  <property name="accessDeniedHandler">
   <bean class="org.acegisecurity.ui.AccessDeniedHandlerImpl">
    <property name="errorPage" value="/admin/deny.jsp"/>
   </bean>
  </property>
 </bean>

在认证失败后,一般会抛出AccessDeniedException,过滤器捕获此异常并转向errorPage页面.

 

资源调用拦截器

 <!-- 9. set filterInvocationInterceptor -->
 <bean id="filterInvocationInterceptor" class="org.acegisecurity.intercept.web.FilterSecurityInterceptor">
  <property name="authenticationManager" ref="authenticationManager"/>
  <property name="accessDecisionManager" ref="httpAccessDecisionManager"/>
  <property name="objectDefinitionSource" ref="filterDefinitionSource"/>
 </bean>

如果需要从配置文件加载保护资源的话,要相对简单

CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON

PATTERN_TYPE_APACHE_ANT

/admin/* = ROLE_ADMIN

/* = ROLE_USER,ROLE_ANONYMOUS

这样就可以了

但为了实现配置动态更新,从数据库获取保护资源.这个等会再说.

 

在过滤拦截保护资源时,需要访问决策管理器,三种投票方式

 org.acegisecurity.vote.ConsensusBased多数投票者同意可通过

org.acegisecurity.vote.UnanimousBased全部投票者同意可通过

org.acegisecurity.vote.AffirmativeBased至少一个投票者同意可通过

一般选最后一个 就可以了

 <!-- set httpAccessDecisionManager -->
 <bean id="httpAccessDecisionManager" class="org.acegisecurity.vote.AffirmativeBased">
  <property name="allowIfAllAbstainDecisions" value="false"/>
  <property name="decisionVoters">
   <list>
    <bean class="org.acegisecurity.vote.RoleVoter">
     <property name="rolePrefix" value="ROLE_"/>
    </bean>
    <bean class="org.acegisecurity.vote.AuthenticatedVoter"/>
   </list>
  </property>
 </bean>

 

 晕 超过2W了  换一页

评论

1 楼 sscmqhk 2008-05-06  

问个问题 你的代码里的那个 DB下的 已经.pSC的后缀的文件是啥文件...要用说明打开....