我的acegi struts spring hibernate理解

配置文件网上一大堆,随下一个都问题不大,但结合自己的配置有几个点要注意:



1.这里控制文件访问权限:
<bean id="filterInvocationInterceptor"
  class="org.acegisecurity.intercept.web.FilterSecurityInterceptor">
<property name="authenticationManager"
  ref="authenticationManager"/>
<property name="accessDecisionManager">
   <ref local="accessDecisionManager"/>
</property>
<!-- property name="objectDefinitionSource"
  ref="filterDefinitionSource"/-->
  <!--
         filterInvocationInterceptor在执行转向url前检查objectDefinitionSource中设定的用户权限信息
         过程：
         首先，objectDefinitionSource中定义了访问URL需要的属性信息(这里的属性信息仅仅是标志，告诉accessDecisionManager要用哪些voter来投票)
         然后，authenticationManager掉用自己的provider来对用户的认证信息进行校验。
         最后，有投票者根据用户持有认证和访问url需要的属性，调用自己的voter来投票，决定是否允许访问。
     -->
<property name="objectDefinitionSource">
    <value>
    CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON
    PATTERN_TYPE_APACHE_ANT
    /admin/**=ROLE_ADMIN,ROLE_USER
    /users/**=ROLE_USER,ROLE_ADMINISTRATOR
    /web-inf/users/**=ROLE_ADMINISTRATOR   </value>
   
</property>
</bean>
其中ROLE_ADMIN,ROLE_USER是你数据库表里存的角色名,随便你改吧.
2.此处可以把sql语句写在这,也可以自己写UserDetailsService 实现.
目的是返回这个user给它
org.acegisecurity.userdetails.User(username, user.getPassword(),
           true, true, true, true, this.grantedAuthArray);

如是:
<bean id="daoAuthenticationProvider"
  class="org.acegisecurity.providers.dao.DaoAuthenticationProvider">
  <!-- 此处可以自己写DAO实现userDetailsService -->
<property name="userDetailsService" ref="userDetailsService"/>
<property name="userCache" ref="userCache"/>
<!-- <property name="passwordEncoder" ref="passwordEncoder"/>   -->
</bean>
<bean id="userDetailsService"
class="com.lottery.service.AcegiUserDeitailsService">
<property name="dbManager" ref="dbManager" />
</bean>
如我的:
public class AcegiUserDeitailsService implements UserDetailsService {
private final Log LOG = LogFactory.getLog(AcegiUserDeitailsService.class);
/* 依赖注入 */
private DBManager dbManager;

/* 用户所有的权限 */
//private final List<GrantedAuthority> grantedAuthList = new ArrayList<GrantedAuthority>(6);
private GrantedAuthority[] grantedAuthArray;

public UserDetails loadUserByUsername(String username)
    throws UsernameNotFoundException, DataAccessException {
   if(LOG.isDebugEnabled()) {
    LOG.debug("Loading UserDetails of userName: " + username);
   }
   /* 取得用户信息 */
   List<LotteryUsers> userList = findAllByUsername(username);
   LotteryUsers user = null;
   if(userList!=null&&!userList.isEmpty()){
      user = (LotteryUsers)userList.get(0);
   }
   if(user == null) {
    LOG.warn("UserDetails load failed: No such UserRole with userName: " + username);
            throw new UsernameNotFoundException("User name is not found.");
   }
   /* 取得所有用户权限 */
   List<String> userRoleList = findGroupNameByUsername(username);
   if(userRoleList == null || userRoleList.size() == 0) {
    LOG.warn("UserRole load failed: No such UserRole with userName: " + username);
            throw new UsernameNotFoundException("UserRole is not found.");
   }
   /* 取得用户的所有角色 */
   int size = userRoleList.size();
   grantedAuthArray = new GrantedAuthority[size];
   int j = 0;
   for(int i = 0; i < size; i++) {
    String userRole = userRoleList.get(i);
    if(userRole != null) {
     this.grantedAuthArray[j++] = new GrantedAuthorityImpl(userRole.toUpperCase());
    }
   }
   LOG.info("UserName: " + username + " loaded successfully.");
        return new org.acegisecurity.userdetails.User(username, user.getPassword(),
           true, true, true, true, this.grantedAuthArray);
}

//按用户名查找user
public List<LotteryUsers> findAllByUsername(String username) {
List<LotteryUsers> list = new ArrayList<LotteryUsers>();
LotteryUsers user = new LotteryUsers();
String sql = "SELECT * FROM "+Constants.DATABASEPRE_KEY+"users u WHERE u.username='"+username+"' and u.enable=1";
ResultSet rs = dbManager.execute(sql);
try {
while(rs.next()){
user.setUsername(rs.getString("username"));
user.setPassword(rs.getString("password"));
user.setEnable(rs.getShort("enabled"));
list.add(user);
}
} catch (SQLException e) {
// TODO Auto-generated catch block
System.out.println("class LotteryUsersDAOImpl's method findAllByUsername() error");
e.printStackTrace();
}finally{
try {
rs.close();
dbManager.close();
} catch (SQLException e) {
            System.out.println(" class lotteryUsersDAOImpl's method findAllByUsername() close dbManager accoure error");
e.printStackTrace();
}

}
return list;
}

public List<String> findGroupNameByUsername(String username) {
List<String> list = new ArrayList<String>();
String sql = "SELECT g.name name FROM "+Constants.DATABASEPRE_KEY+"users u,"+Constants.DATABASEPRE_KEY+"groups g"+
" WHERE g.id=u.group_id and u.username='"+username+"' and u.enable=1";
ResultSet rs = dbManager.execute(sql);
try {
while(rs.next()){
list.add(rs.getString("name"));
}
} catch (SQLException e) {
System.out.println(this.getClass().getName()+"dbManager execute error");
e.printStackTrace();
}finally{
try {
rs.close();
dbManager.close();
} catch (SQLException e) {
            System.out.println(" class lotteryUsersDAOImpl's method findGroupNameByUsername() close dbManager accoure error");
e.printStackTrace();
}
}
return list;
}

public DBManager getDbManager() {
return dbManager;
}

public void setDbManager(DBManager dbManager) {
this.dbManager = dbManager;
}
}
也可以:
<bean id="jdbcDaoImpl" class="org.acegisecurity.userdetails.jdbc.JdbcDaoImpl">
  <property name="dataSource" ref="dataSource"/>     
  <property name="usersByUsernameQuery">          
   <value>select username, password, enabled from user where username = ? and enabled = 1</value>      
  </property>
  <property name="authoritiesByUsernameQuery">          
   <value>
    select u.username, a.authority
    from user u, authorities a, user_auth ua
    where u.id=ua.user_id and a.id=ua.auth_id and u.username=?
   </value>      
  </property>
</bean>



3.类,方法的权限控制(两种):
<bean id="methodSecurityInterceptor" class="org.acegisecurity.intercept.method.aopalliance.MethodSecurityInterceptor">
   <property name="validateConfigAttributes" value="false" />
   <property name="authenticationManager" ref="authenticationManager" />
   <property name="accessDecisionManager" ref="accessDecisionManager" />
   <property name="objectDefinitionSource">
         <bean class="org.acegisecurity.intercept.method.MethodDefinitionAttributes">
             <property name="attributes">
               <!--  利用1.5Annotation的設定方式 -->
               <bean class="org.acegisecurity.annotation.SecurityAnnotationAttributes" />
             </property>
           </bean>
  </property>
</bean> 
<!-- 利用Spring的自动代理功能实现AOP代理 -->
<bean id="autoProxyCreator" class="org.springframework.aop.framework.autoproxy.BeanNameAutoProxyCreator">
  <property name="interceptorNames">
       <list>
      <value>methodSecurityInterceptor</value>
       </list>
  </property>
  <property name="beanNames">
       <list>
     <!--  需要保护的方法,在方法中用注释@Transactional(readOnly=true)
          @Secured({"ROLE_MANAGER"})
       -->
     <value>lotteryOddsImpl</value>
     <value>lotteryUsersDAOImpl</value>
     </list>
   </property>
   <!--property name="proxyTargetClass" value="true"/-->
</bean>
然后在相应的接口方法中用注释:
          @Secured({"ROLE_ADMIN"})
public void update(Users Users);

也可以:
<!-- 过滤拦截器 -->
<bean id="filterInvocationInterceptor" class="org.acegisecurity.intercept.web.FilterSecurityInterceptor">
      <property name="authenticationManager"><ref bean="authenticationManager"/></property>
      <property name="accessDecisionManager"><ref local="httpRequestAccessDecisionManager"/></property>
      <property name="objectDefinitionSource">
         <value>
       PATTERN_TYPE_APACHE_ANT
     
       <!-- 所有用户的权限 -->
       /searchUser.do=AUTH_USER,AUTH_ROOT,AUTH_RELEASER,AUTH_AUDITOR
    /updateInformation.do=AUTH_USER,AUTH_ROOT,AUTH_RELEASER,AUTH_AUDITOR
     
       <!-- 普通用户的权限 -->
    /preOrderAd.do=AUTH_USER
    /orderAd.do=AUTH_USER
    /myAdList.do=AUTH_USER
    /findReOrderAd.do=AUTH_USER
    /ReOrder.do=AUTH_USER
   
    <!--==== 超级管理员的权限 ====-->
   
    <!-- 审核员的权限 -->
    /noaudit.do=AUTH_AUDITOR,AUTH_ROOT
    /allAuditAdNoPass.do=AUTH_AUDITOR,AUTH_ROOT
    /auditedAd.do=AUTH_AUDITOR
    /audited.do=AUTH_AUDITOR,AUTH_ROOT
    /notify.do=AUTH_AUDITOR,AUTH_ROOT
    /editAuditedEmail.do=AUTH_AUDITOR,AUTH_ROOT
   
    <!-- 发布员的权限 -->
    /unpaymentOrderList.do=AUTH_RELEASER,AUTH_ROOT
    /paymentOrderList.do=AUTH_RELEASER,AUTH_ROOT  
   
    <!-- 超级管理员的权限 -->
    /manageAdpos.do=AUTH_ROOT
    /manageUser.do=AUTH_ROOT
    /addNewAdpos.do=AUTH_ROOT


         </value>
      </property>
    </bean>