Spring Security学习总结一

nhy520

浏览: 957118 次
性别:
来自: 北京

最近访客更多访客>>

yunzhu

k0521klb

remote_silence

prog

博主相关

博客

微博

相册

留言

关于我

文章分类

社区版块

存档分类

Security Spring Bean JSP UI

security.xml
各种过滤器实战,常用九个如下
一链之 RememberMeProcessingFilter

1。使用，选上remember me后，一旦页面关闭或者服务器重启，还可以记得用户的登陆状态。
<input type="checkbox" id="remember" name="j_remember_me"> Remember me
2.设置 security.xml

    <bean id="rememberMeFilter" class="org.acegisecurity.ui.rememberme.RememberMeProcessingFilter">
        <property name="authenticationManager" ref="authenticationManager" />
        <property name="rememberMeServices" ref="rememberMeServices" />
    </bean>

登陆，登出中 <property name="rememberMeServices" ref="rememberMeServices" />
</bean>

二链之 RememberMeProcessingFilter 安全拦截器
   
    <bean id="securityInterceptor"
        class="org.acegisecurity.intercept.web.FilterSecurityInterceptor">
        <property name="authenticationManager" ref="authenticationManager" />
        <property name="accessDecisionManager" ref="accessDecisionManager" />
        <property name="objectDefinitionSource">
            <value>
                CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON
                PATTERN_TYPE_APACHE_ANT
                /admin/**=ROLE_ADMIN           
                /user/**=ROLE_USER
            </value>
        </property>
    </bean>

三。链之 authenticationProcessingFilter 登陆验证
1.login.jsp
<%
      String error = request.getParameter("login_error");
      if(error!=null) {
        out.println("<p><font color=\"red\">");
        out.println(error);
        out.println("</font></p>");
      }
    %>
     <form action="j_login.do" method="POST">
      Username: <input type="text" name="j_username" />
      Password: <input type="password" name="j_password">
      <input name="submit" type="submit" value="Login">
    </form>

    <bean id="authenticationProcessingFilter"
        class="org.acegisecurity.ui.webapp.AuthenticationProcessingFilter">
        <property name="authenticationManager" ref="authenticationManager" />
        <property name="authenticationFailureUrl" value="/login.jsp?login_error=Login%20failed." /> 
        <property name="defaultTargetUrl" value="/helloWorld.jsp" />   
        <property name="filterProcessesUrl" value="/j_login.do" /> 
    </bean>

四。链之 logoutFilter
<a href="j_logout.do">logout</a></p>

五链之 exceptionFilter,如果用户未能被认证，AuthenticationException就会被抛出；
即使用户成功地通过了身份验证，他们仍可能不被授予访问某些受保护页面所必需的权限。这样，AcessDeniedException就会被抛出。

    <bean id="exceptionFilter" class="org.acegisecurity.ui.ExceptionTranslationFilter">
        
        <property name="authenticationEntryPoint">
            <bean class="org.acegisecurity.ui.webapp.AuthenticationProcessingFilterEntryPoint">
                <property name="loginFormUrl" value="/login.jsp" />
                <property name="forceHttps" value="false" />
            </bean>
        </property>
        
        <property name="accessDeniedHandler">
            <bean class="org.acegisecurity.ui.AccessDeniedHandlerImpl" />
            
        </property>
    </bean>
六链之 HttpSessionContextIntegrationFilter ，不知道有什么用处哪？？？？

    <bean id="httpSessionContextIntegrationFilter"
        class="org.acegisecurity.context.HttpSessionContextIntegrationFilter" />

————————————————————————————————————

    <bean id="filterChainProxy" class="org.acegisecurity.util.FilterChainProxy">
        <property name="filterInvocationDefinitionSource">
            <value>
                CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON
                PATTERN_TYPE_APACHE_ANT
/**=channelProcessingFilter
ConcurrentSessionFilter .................
httpSessionContextIntegrationFilter,
logoutFilter,
authenticationProcessingFilter,
rememberMeFilter,
AnonymousProcessingFilter,.................
exceptionFilter
,securityInterceptor
            </value>
        </property>
    </bean>
    <bean id="authenticationManager" class="org.acegisecurity.providers.ProviderManager">        <property name="providers">            <list>                <ref bean="daoAuthenticationProvider" />            </list>        </property>    </bean>        <bean id="daoAuthenticationProvider"        class="org.acegisecurity.providers.dao.DaoAuthenticationProvider">        <property name="userDetailsService" ref="userDetailsService" />    </bean>        <bean id="userDetailsService"        class="org.acegisecurity.userdetails.memory.InMemoryDaoImpl">        <property name="userMap">            <value>                admin=password,enabled,ROLE_ADMIN,ROLE_USER                test=test,enabled,ROLE_USER                guest=guest,disabled,ROLE_USER            </value>        </property>    </bean>
    
    <bean id="accessDecisionManager"
        class="org.acegisecurity.vote.AffirmativeBased">
        <property name="decisionVoters">
            <list>
                <bean class="org.acegisecurity.vote.RoleVoter" />
            </list>
        </property>
        <property name="allowIfAllAbstainDecisions" value="false" />
    </bean>

附件：spring的光盘\source\10Acegi\Spring_Acegi

补记：七链之channelProcessingfilter 通道，
login.jsp=REQUIRES_SECURE_CHANNEL 有安全映射的，表明login.jsp应该通过HTTPS进行发送.
即跳到https://127.0.0.1:8443/ssh/login.jsp ,但是为什么显示出错？？？？？？？是要上网吗？

<bean id="channelProcessingFilter"
  class="org.acegisecurity.securechannel.ChannelProcessingFilter">
  <property name="filterInvocationDefinitionSource">
   <value>
    CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON
    PATTERN_TYPE_APACHE_ANT
    /login.jsp=REQUIRES_SECURE_CHANNEL
    /**=REQUIRES_INSECURE_CHANNEL
   </value>
  </property>
  <property name="channelDecisionManager"
   ref="channelDecisionManager">
  </property>
</bean>
<bean id="channelDecisionManager"
  class="org.acegisecurity.securechannel.ChannelDecisionManagerImpl">
  <property name="channelProcessors">
   <list>
    <bean
     class="org.acegisecurity.securechannel.SecureChannelProcessor" />
    <bean
     class="org.acegisecurity.securechannel.InsecureChannelProcessor" />
   </list>
  </property>
</bean>