SpringSecurity初体验

        刚刚接触SpringSecurity，根据网上的教程自己试了一下，记录下来以供日后查看。

参考文档

这里主要的参考文档是Spring Security的自带的Reference。网络上有一个它的中文翻译，地址如下：
[url]http://www.family168.com/tutorial/springsecurity/html/springsecurity.html
[/url]

Spring Security基本配置
1. 在web.xml文件中加入Filter声明

<!-- Spring security Filter -->
<filter>
  <filter-name>springSecurityFilterChain</filter-name>
  <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>

<filter-mapping>
  <filter-name>springSecurityFilterChain</filter-name>
  <url-pattern>/*</url-pattern>
</filter-mapping>

注意，springSecurityFilterChain这个名称是由命名空间默认创建的用于处理web安全的一个内部的bean的id。所以你在你的Spring配置文件中，不应该再使用这个id作为你的bean。

2. 使用最小的<http>配置

<http auto-config='true'>  
    <intercept-url pattern="/**" access="ROLE_USER" />  
</http>

3. 配置UserDetailsService来指定用户和权限

<authentication-provider>  
    <user-service>  
      <user name="downpour" password="downpour" authorities="ROLE_USER, ROLE_ADMIN" />  
      <user name="robbin" password="robbin" authorities="ROLE_USER" />  
      <user name="QuakeWang" password="QuakeWang" authorities="ROLE_ADMIN" />  
    </user-service>  
</authentication-provider>

security的XML头为

<beans:beans xmlns="http://www.springframework.org/schema/security"
    xmlns:beans="http://www.springframework.org/schema/beans"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.5.xsd
                        http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-2.0.4.xsd">

如此一番折腾之后，启动服务器，输入地址，系统会自动转向到SS自已的登陆界面，需要当前用户输入用户名、密码进行登陆验证。

接下来通过一个实例来加深理解
创建用户表：

CREATE TABLE [dbo].[USERS](
	[ID] [numeric](18, 0) PRIMARY KEY IDENTITY(1,1) NOT NULL,
	[NAME] [varchar](255) NULL,
	[PASSWORD] [varchar](255) NULL,
	[DISABLED] [varchar](255) NULL)

创建权限表：

CREATE TABLE [dbo].[ROLE](
	[ID] [numeric](18, 0) PRIMARY KEY IDENTITY(1,1) NOT NULL,
	[NAME] [varchar](255) NULL,
	[DESCRIPTION] [varchar](255) NULL)

创建用户权限关系表：

CREATE TABLE [dbo].[USER_ROLE](
	[USER_ID] [numeric](18, 0) NOT NULL,
	[ROLE_ID] [numeric](18, 0) NOT NULL);
ALTER TABLE [dbo].[USER_ROLE]  WITH CHECK ADD FOREIGN KEY([ROLE_ID])
REFERENCES [dbo].[ROLE] ([ID]);
ALTER TABLE [dbo].[USER_ROLE]  WITH CHECK ADD FOREIGN KEY([USER_ID])
REFERENCES [dbo].[USERS] ([ID]);

建立表相对应的bean
其中Users表需要进行修改一下

/**
 * 
 */
package admin.model;

import java.util.ArrayList;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
import java.util.Set;

import javax.persistence.Entity;
import javax.persistence.FetchType;
import javax.persistence.GeneratedValue;
import javax.persistence.Id;
import javax.persistence.JoinColumn;
import javax.persistence.JoinTable;
import javax.persistence.ManyToMany;
import javax.persistence.Transient;

import org.apache.commons.lang.StringUtils;
import org.hibernate.annotations.Cache;
import org.hibernate.annotations.CacheConcurrencyStrategy;
import org.hibernate.annotations.Proxy;
import org.springframework.security.GrantedAuthority;
import org.springframework.security.GrantedAuthorityImpl;
import org.springframework.security.userdetails.UserDetails;

/**
 * @author Downpour
 *
 */
@Entity
@Proxy(lazy = false)
@Cache(usage = CacheConcurrencyStrategy.READ_WRITE)
public class Users implements UserDetails {
	
	private static final long serialVersionUID = 8026813053768023527L;

    @Id
	@GeneratedValue
	private Integer id;
	
	private String name;
	
	private String password;
	
	private boolean disabled;
	
	@ManyToMany(targetEntity = Role.class, fetch = FetchType.EAGER)
    @JoinTable(name = "user_role", joinColumns = @JoinColumn(name = "user_id"), inverseJoinColumns = @JoinColumn(name = "role_id"))
    @Cache(usage = CacheConcurrencyStrategy.READ_WRITE)
	private Set<Role> roles;
	
	@Transient
	private Map<String, List<Resource>> roleResources;
	
	/**
	 * The default constructor
	 */
	public Users() {
		
	}

	/* (non-Javadoc)
	 * @see org.springframework.security.userdetails.UserDetails#getAuthorities()
	 */
	public GrantedAuthority[] getAuthorities() {
		List<GrantedAuthority> grantedAuthorities = new ArrayList<GrantedAuthority>(roles.size());
    	for(Role role : roles) {
    		grantedAuthorities.add(new GrantedAuthorityImpl(role.getName()));
    	}
        return grantedAuthorities.toArray(new GrantedAuthority[roles.size()]);
	}
	
	/**
	 * Returns the authorites string
	 * 
	 * eg. 
	 *    downpour --- ROLE_ADMIN,ROLE_USER
	 *    robbin --- ROLE_ADMIN
	 * 
	 * @return
	 */
	public String getAuthoritiesString() {
	    List<String> authorities = new ArrayList<String>();
	    for(GrantedAuthority authority : this.getAuthorities()) {
	        authorities.add(authority.getAuthority());
	    }
	    return StringUtils.join(authorities, ",");
	}

	/* (non-Javadoc)
	 * @see org.springframework.security.userdetails.UserDetails#getPassword()
	 */
	public String getPassword() {
		return password;
	}

	/* (non-Javadoc)
	 * @see org.springframework.security.userdetails.UserDetails#getUsername()
	 */
	public String getUsername() {
		return name;
	}

	/* (non-Javadoc)
	 * @see org.springframework.security.userdetails.UserDetails#isAccountNonExpired()
	 */
	public boolean isAccountNonExpired() {
		return true;
	}

	/* (non-Javadoc)
	 * @see org.springframework.security.userdetails.UserDetails#isAccountNonLocked()
	 */
	public boolean isAccountNonLocked() {
		return true;
	}

	/* (non-Javadoc)
	 * @see org.springframework.security.userdetails.UserDetails#isCredentialsNonExpired()
	 */
	public boolean isCredentialsNonExpired() {
		return true;
	}

	/* (non-Javadoc)
	 * @see org.springframework.security.userdetails.UserDetails#isEnabled()
	 */
	public boolean isEnabled() {
		return !disabled;
	}

	/**
	 * @return the id
	 */
	public Integer getId() {
		return id;
	}

	/**
	 * @return the name
	 */
	public String getName() {
		return name;
	}

	/**
	 * @return the disabled
	 */
	public boolean isDisabled() {
		return disabled;
	}

	/**
	 * @return the roles
	 */
	public Set<Role> getRoles() {
		return roles;
	}

	/**
	 * @return the roleResources
	 */
	public Map<String, List<Resource>> getRoleResources() {
		// init roleResources for the first time
		if(this.roleResources == null) {
			
			this.roleResources = new HashMap<String, List<Resource>>();
			
			for(Role role : this.roles) {
				String roleName = role.getName();
				Set<Resource> resources = role.getResources();
				for(Resource resource : resources) {
					String key = roleName + "_" + resource.getType();
					if(!this.roleResources.containsKey(key)) {
						this.roleResources.put(key, new ArrayList<Resource>());
					}
					this.roleResources.get(key).add(resource);					
				}
			}
			
		}
		return this.roleResources;
	}

	/**
	 * @param id the id to set
	 */
	public void setId(Integer id) {
		this.id = id;
	}

	/**
	 * @param name the name to set
	 */
	public void setName(String name) {
		this.name = name;
	}

	/**
	 * @param password the password to set
	 */
	public void setPassword(String password) {
		this.password = password;
	}

	/**
	 * @param disabled the disabled to set
	 */
	public void setDisabled(boolean disabled) {
		this.disabled = disabled;
	}

	/**
	 * @param roles the roles to set
	 */
	public void setRoles(Set<Role> roles) {
		this.roles = roles;
	}
	
}

就是继承了UserDetails接口，UserDetails接口就是SS用来进行用户验证用的接口，这个接口的方法都很好实现，只有getAuthorities需要处理一下，用来返回用户的所有权限。

有了用户信息的实体存在了，当然还需要操作这些信息的实体，SS提供了另外一个接口UserDetailsService，这个接口只有一个方法loadUserByUsername(String s)，用于根据用户名获取用户信息，我们编写一个SecurityManager类实现之

/**
 * 
 */
package admin.impl;

import java.util.List;

import org.hibernate.SessionFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.dao.DataAccessException;
import org.springframework.orm.hibernate3.support.HibernateDaoSupport;
import org.springframework.security.userdetails.UserDetails;
import org.springframework.security.userdetails.UserDetailsService;
import org.springframework.security.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Service;

import admin.interfaces.SecurityManager;
import admin.model.Users;

/**
 * @author 
 */
@Service("securityManager")
public class SecurityManagerImpl extends HibernateDaoSupport implements UserDetailsService, SecurityManager {
    
    /**
     * Init sessionFactory here because the annotation of Spring 2.5 can not support override inject
     *  
     * @param sessionFactory
     */
    @Autowired
    public void init(SessionFactory sessionFactory) {
        super.setSessionFactory(sessionFactory);
    }
    
    /* (non-Javadoc)
     * @see org.springframework.security.userdetails.UserDetailsService#loadUserByUsername(java.lang.String)
     */
    public UserDetails loadUserByUsername(String userName) throws UsernameNotFoundException, DataAccessException {
        List<Users> users = getHibernateTemplate().find("FROM Users user WHERE user.name = ? AND user.disabled = false", userName);
        if(users.isEmpty()) {
            throw new UsernameNotFoundException("User " + userName + " has no GrantedAuthority");
        }
        return users.get(0);
    }   
}

调整security.xml为

<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security"
    xmlns:beans="http://www.springframework.org/schema/beans"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.5.xsd
                        http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-2.0.4.xsd">
	
	<http access-denied-page="/403.jsp">  
		<intercept-url pattern="/login.jsp*" filters="none"/>
    	<intercept-url pattern="/**" access="ROLE_USER" />
    	<form-login login-page="/login.jsp" default-target-url="/admin/hello.jsp" always-use-default-target="true" authentication-failure-url="/login.jsp?error=true"/>
	    <logout logout-success-url="/login.jsp"/>  
	</http> 
	
	<authentication-manager alias="authenticationManager"/>
	
	<authentication-provider user-service-ref="securityManager">
		<password-encoder hash="md5"/>
	</authentication-provider>
</beans:beans> 

看得出来就是把authentication-provider的策略从XML里直接写死，改成了使用数据库来进行管理，而中间的操作类就是自定义的实现了UserDetailsService接口的securityManager类。一切似乎明朗起来。