spring security 配置文件小结(1)

# 一 、方式一：用户名密码都在配置文件中。  
# <?xml version="1.0" encoding="UTF-8"?>  
# <beans:beans xmlns="http://www.springframework.org/schema/security"  
#     xmlns:beans="http://www.springframework.org/schema/beans"  
#     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"  
#     xsi:schemaLocation="http://www.springframework.org/schema/beans  
#     http://www.springframework.org/schema/beans/spring-beans-2.0.xsd  
#     http://www.springframework.org/schema/security  
#     http://www.springframework.org/schema/security/spring-security-2.0.4.xsd">  
#   
#     <http auto-config='true'>  
#         <intercept-url pattern="/admin.jsp" access="ROLE_ADMIN" />  
#         <intercept-url pattern="/**" access="ROLE_USER" />  
#     </http>  
#   
#     <authentication-provider>  
#         <user-service>  
#             <user name="admin" password="admin" authorities="ROLE_USER, ROLE_ADMIN" />  
#             <user name="user" password="user" authorities="ROLE_USER" />  
#         </user-service>  
#     </authentication-provider>  
#   
# </beans:beans>  
#   
#   
# 二、方式二：运用spring security 提供的默认表结构，authentication部分修改如下：  
#     <authentication-provider>  
#         <jdbc-user-service data-source-ref="dataSource"/>  
#     </authentication-provider>  
#   
#     <beans:bean id="dataSource" class="org.springframework.jdbc.datasource.DriverManagerDataSource">  
#         <beans:property name="driverClassName" value="org.hsqldb.jdbcDriver"/>  
#         <beans:property name="url" value="jdbc:hsqldb:res:/hsqldb/test"/>  
#         <beans:property name="username" value="sa"/>  
#         <beans:property name="password" value=""/>  
#     </beans:bean>  
#       
#       
# 三、方式三：运用原先本地的数据库，authentication修改如下：  
#     <authentication-provider>  
#         <jdbc-user-service data-source-ref="dataSource"  
#             users-by-username-query="select username,password,status as enabled  
#                                          from user  
#                                         where username=?"  
#             authorities-by-username-query="select u.username,r.name as authority  
#                                              from user u  
#                                              join user_role ur  
#                                                on u.id=ur.user_id  
#                                              join role r  
#                                                on r.id=ur.role_id  
#                                             where u.username=?"/>  
#     </authentication-provider>  
#               
#  注：  
#  users-by-username-query为根据用户名查找用户，系统通过传入的用户名查询当前用户的登录名，密码和是否被禁用这一状态。  
#  authorities-by-username-query为根据用户名查找权限，系统通过传入的用户名查询当前用户已被授予的所有权限。  
#    
# 四、方式四；在方式三的基础上，修改登录页面  
# 在xml中的http标签中添加一个form-login标签。  
#   
# <http auto-config='true'>  
#     <intercept-url pattern="/login.jsp" access="IS_AUTHENTICATED_ANONYMOUSLY" />[1]  
#     <intercept-url pattern="/admin.jsp" access="ROLE_ADMIN" />  
#     <intercept-url pattern="/**" access="ROLE_USER" />  
#     <form-login login-page="/login.jsp"[2]  
#                 authentication-failure-url="/login.jsp?error=true"[3]  
#                 default-target-url="/" />[4]  
# </http>  
#           
#    
# 1、让没登陆的用户也可以访问login.jsp。[1]  
#   
# 这是因为配置文件中的“/**”配置，要求用户访问任意一个系统资源时，必须拥有ROLE_USER角色，/login.jsp也不例外，如果我们不为/login.jsp单独配置访问权限，会造成用户连登陆的权限都没有，这是不正确的。  
#    
#  2、login-page表示用户登陆时显示我们自定义的login.jsp。[2]  
#   
# 这时我们访问系统显示的登陆页面将是我们上面创建的login.jsp。  
#    
#  3、authentication-failure-url表示用户登陆失败时，跳转到哪个页面。[3]  
#   
# 当用户输入的登录名和密码不正确时，系统将再次跳转到/login.jsp，并添加一个error=true参数作为登陆失败的标示。  
#    
#    
#  4、default-target-url表示登陆成功时，跳转到哪个页面。[4]  
#    
#  五、方式五:使用数据配置角色可以访问的资源（控制到URL级别）（可以参见工程005）  
# <!--从配置文件上可以看到，Spring Security所需的数据应该是一系列URL网址和访问这些网址所需的权限：  
#   
# <intercept-url pattern="/login.jsp" access="IS_AUTHENTICATED_ANONYMOUSLY" />  
# <intercept-url pattern="/admin.jsp" access="ROLE_ADMIN" />  
# <intercept-url pattern="/**" access="ROLE_USER" />  
#               
# SpringSecurity 所做的就是在系统初始化时，将以上XML中的信息转换为特定的数据格式，而框架中其他组件可以利用这些特定格式的数据，用于控制之后的验证操作。现在这些资源信息都保存在数据库中了，从数据库中取出数据，然后让它等同于从xml文件中取出，需要做以下几步。  
# -->  
#  1、实现一个符合该功能的类，主要参看该类中1-5步骤，了解即可。  
#  <!--  
#   
# public class JdbcFilterInvocationDefinitionSourceFactoryBean  
#     extends JdbcDaoSupport implements FactoryBean {  
#     private String resourceQuery;  
#   
#     public boolean isSingleton() {  
#         return true;  
#     }  
#   
#     public Class getObjectType() {  
#         return FilterInvocationDefinitionSource.class;  
#     }  
#     //4、 使用urlMatcher和requestMap创建DefaultFilterInvocationDefinitionSource。  
#     public Object getObject() {  
#         return new DefaultFilterInvocationDefinitionSource(this  
#             .getUrlMatcher(), this.buildRequestMap());  
#     }  
#     //2、这样我们可以执行它的execute()方法获得所有资源信息。并把它封装到map中。  
#    
#     protected Map<String, String> findResources() {  
#         ResourceMapping resourceMapping = new ResourceMapping(getDataSource(),  
#                 resourceQuery);  
#   
#         Map<String, String> resourceMap = new LinkedHashMap<String, String>();  
#   
#         for (Resource resource : (List<Resource>) resourceMapping.execute()) {  
#             String url = resource.getUrl();  
#             String role = resource.getRole();  
#   
#             if (resourceMap.containsKey(url)) {  
#                 String value = resourceMap.get(url);  
#                 resourceMap.put(url, value + "," + role);  
#             } else {  
#                 resourceMap.put(url, role);  
#             }  
#         }  
#   
#         return resourceMap;  
#     }  
#       
#       
# /*    <intercept-url pattern="/login.jsp" access="IS_AUTHENTICATED_ANONYMOUSLY" />  
#     <intercept-url pattern="/admin.jsp" access="ROLE_ADMIN" />  
#     <intercept-url pattern="/**" access="ROLE_USER" />*/  
#   
#     //3、使用获得的资源信息组装requestMap。再把第二步封装到map中的方法进一步加工，使它等价于“如spring从上面模式的配置文件中读取一样”  
#     protected LinkedHashMap<RequestKey, ConfigAttributeDefinition> buildRequestMap() {  
#         LinkedHashMap<RequestKey, ConfigAttributeDefinition> requestMap = null;  
#         requestMap = new LinkedHashMap<RequestKey, ConfigAttributeDefinition>();  
#   
#         ConfigAttributeEditor editor = new ConfigAttributeEditor();  
#   
#         Map<String, String> resourceMap = this.findResources();  
#   
#         for (Map.Entry<String, String> entry : resourceMap.entrySet()) {  
#             RequestKey key = new RequestKey(entry.getKey(), null);  
#             editor.setAsText(entry.getValue());  
#             requestMap.put(key,  
#                 (ConfigAttributeDefinition) editor.getValue());  
#         }  
#   
#         return requestMap;  
#     }  
#   
#     protected UrlMatcher getUrlMatcher() {  
#         return new AntUrlPathMatcher();  
#     }  
#   
#     public void setResourceQuery(String resourceQuery) {  
#         this.resourceQuery = resourceQuery;  
#     }  
#   
#     private class Resource {  
#         private String url;  
#         private String role;  
#   
#         public Resource(String url, String role) {  
#             this.url = url;  
#             this.role = role;  
#         }  
#   
#         public String getUrl() {  
#             return url;  
#         }  
#   
#         public String getRole() {  
#             return role;  
#         }  
#     }  
#     //1、我们通过定义一个MappingSqlQuery实现数据库操作。  
#     private class ResourceMapping extends MappingSqlQuery {  
#         protected ResourceMapping(DataSource dataSource,  
#             String resourceQuery) {  
#             super(dataSource, resourceQuery);  
#             compile();  
#         }  
#   
#         protected Object mapRow(ResultSet rs, int rownum)  
#             throws SQLException {  
#             String url = rs.getString(1);  
#             String role = rs.getString(2);  
#             Resource resource = new Resource(url, role);  
#   
#             return resource;  
#         }  
#     }  
# }  
#   
#  -->  
#  2、替换原有功能的切入点  
#  在spring中配置我们编写的代码。  
#   
# <beans:bean id="filterInvocationDefinitionSource"  
#     class="com.family168.springsecuritybook.ch005.JdbcFilterInvocationDefinitionSourceFactoryBean">  
#     <beans:property name="dataSource" ref="dataSource"/>  
#     <beans:property name="resourceQuery" value="  
#         select re.res_string,r.name  
#           from role r  
#           join resc_role rr  
#             on r.id=rr.role_id  
#           join resc re  
#             on re.id=rr.resc_id  
#       order by priority  
#     "/>  
# </beans:bean>  
#               
# 下一步使用这个filterInvocationDefinitionSource创建filterSecurityInterceptor，并使用它替换系统原来创建的那个过滤器。  
#   
# <beans:bean id="filterSecurityInterceptor"  
#     class="org.springframework.security.intercept.web.FilterSecurityInterceptor" autowire="byType">  
#     <custom-filter before="FILTER_SECURITY_INTERCEPTOR" />  
#     <beans:property name="objectDefinitionSource" ref="filterInvocationDefinitionSource" />  
# </beans:bean>  
#               
# 注意这个custom-filter标签，它表示将filterSecurityInterceptor放在框架原来的 FILTER_SECURITY_INTERCEPTOR过滤器之前，这样我们的过滤器会先于原来的过滤器执行，因为它的功能与老过滤器完全一样，所以这就等于把原来的过滤器替换掉了。  
#    
#  3、完整的配置文件如下所示：  
#   
# <?xml version="1.0" encoding="UTF-8"?>  
# <beans:beans xmlns="http://www.springframework.org/schema/security"  
#     xmlns:beans="http://www.springframework.org/schema/beans"  
#     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"  
#     xsi:schemaLocation="http://www.springframework.org/schema/beans  
#     http://www.springframework.org/schema/beans/spring-beans-2.0.xsd  
#     http://www.springframework.org/schema/security  
#     http://www.springframework.org/schema/security/spring-security-2.0.4.xsd">  
#   
#     <http auto-config="true"/>  
#   
#     <authentication-provider>  
#         <jdbc-user-service data-source-ref="dataSource"  
#             users-by-username-query="select username,password,status as enabled  
#                                        from user  
#                                       where username=?"  
#             authorities-by-username-query="select u.username,r.name as authority  
#                                              from user u  
#                                              join user_role ur  
#                                                on u.id=ur.user_id  
#                                              join role r  
#                                                on r.id=ur.role_id  
#                                             where u.username=?"/>  
#     </authentication-provider>  
#   
#     <beans:bean id="filterSecurityInterceptor"  
#         class="org.springframework.security.intercept.web.FilterSecurityInterceptor" autowire="byType">  
#         <custom-filter before="FILTER_SECURITY_INTERCEPTOR" />  
#         <beans:property name="objectDefinitionSource" ref="filterInvocationDefinitionSource" />  
#     </beans:bean>  
#   
#     <beans:bean id="filterInvocationDefinitionSource"  
#         class="com.family168.springsecuritybook.ch05.JdbcFilterInvocationDefinitionSourceFactoryBean">  
#         <beans:property name="dataSource" ref="dataSource"/>  
#         <beans:property name="resourceQuery" value="  
#             select re.res_string,r.name  
#               from role r  
#               join resc_role rr  
#                 on r.id=rr.role_id  
#               join resc re  
#                 on re.id=rr.resc_id  
#           order by priority  
#         "/>  
#     </beans:bean>  
#   
#     <beans:bean id="dataSource" class="org.springframework.jdbc.datasource.DriverManagerDataSource">  
#         <beans:property name="driverClassName" value="org.hsqldb.jdbcDriver"/>  
#         <beans:property name="url" value="jdbc:hsqldb:res:/hsqldb/test"/>  
#         <beans:property name="username" value="sa"/>  
#         <beans:property name="password" value=""/>  
#     </beans:bean>  
# </beans:beans>  
#   
#   
#  4、允许动态增加某个用户权限。  
#  目前存在的问题是，系统会在初始化时一次将所有资源加载到内存中，即使在数据库中修改了资源信息，系统也不会再次去从数据库中读取资源信息。这就造成了每次修改完数据库后，都需要重启系统才能时资源配置生效。  
#   
# 解决方案是，如果数据库中的资源出现的变化，需要刷新内存中已加载的资源信息时，使用下面代码：  
#   
# <%@page import="org.springframework.context.ApplicationContext"%>  
# <%@page import="org.springframework.web.context.support.WebApplicationContextUtils"%>  
# <%@page import="org.springframework.beans.factory.FactoryBean"%>  
# <%@page import="org.springframework.security.intercept.web.FilterSecurityInterceptor"%>  
# <%@page import="org.springframework.security.intercept.web.FilterInvocationDefinitionSource"%>  
# <%  
#     ApplicationContext ctx =  WebApplicationContextUtils.getWebApplicationContext(application);  
#     FactoryBean factoryBean = (FactoryBean) ctx.getBean("&filterInvocationDefinitionSource");  
#     FilterInvocationDefinitionSource fids = (FilterInvocationDefinitionSource) factoryBean.getObject();  
#     FilterSecurityInterceptor filter = (FilterSecurityInterceptor) ctx.getBean("filterSecurityInterceptor");  
#     filter.setObjectDefinitionSource(fids);  
# %>  
# <jsp:forward page="/"/>