SpringSecurity3.X--前台与后台登录认证（转载）

kong0itey

浏览: 306015 次

最近访客更多访客>>

waylon33

ybfjavaeye

haoningabc

lg13583505049

博主相关

博客

微博

相册

留言

关于我

文章分类

社区版块

存档分类

博客分类：

spring security

security jsp java mvc

不过一般我们在管理系统时都会分前台与后台，也就是说，前台与后台的登录入口与注销地址都是不一样的，那么该如何使用SpringSecurity实现呢，参考了一些网络上的例子，将之前的小应用做了如下修改：

applicationContext-security.xml

Xml代码

<? xml version = "1.0" encoding = "UTF-8" ?>
< beans:beans xmlns = "http://www.springframework.org/schema/security"
xmlns:xsi = "http://www.w3.org/2001/XMLSchema-instance" xmlns:p = "http://www.springframework.org/schema/p"
xmlns:aop = "http://www.springframework.org/schema/aop" xmlns:context = "http://www.springframework.org/schema/context"
xmlns:jee = "http://www.springframework.org/schema/jee" xmlns:tx = "http://www.springframework.org/schema/tx"
xmlns:util = "http://www.springframework.org/schema/util" xmlns:mvc = "http://www.springframework.org/schema/mvc"
xmlns:tool = "http://www.springframework.org/schema/tool" xmlns:beans = "http://www.springframework.org/schema/beans"
xsi:schemaLocation ="
http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop-3.0.xsd
http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.0.xsd
http://www.springframework.org/schema/jee http://www.springframework.org/schema/jee/spring-jee-3.0.xsd
http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx-3.0.xsd
http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util-3.0.xsd
http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc-3.0.xsd
http://www.springframework.org/schema/tool http://www.springframework.org/schema/tool/spring-tool-3.0.xsd
http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.1.xsd"
default-lazy-init = "true" >
< http security = "none" pattern = "/**/login.do" />
<!-- 因为要使用自己的权限验证规则，所以这里要配置access-decision-manager-ref
实际上，我只是在accessDecisionManager中增加了一个投票器，其它的属性都比较简单，不多说了 -->
< http entry-point-ref = "loginUrlEntryPoint" access-decision-manager-ref = "accessDecisionManager" access-denied-page = "/notaccess.jsp" >
< intercept-url pattern = "/demo.do*" access = "IS_AUTHENTICATED_REMEMBERED" />
< intercept-url pattern = "/admin/**/*.do*" access = "AD_HODLE" />
< intercept-url pattern = "/**/*.do*" access = "HODLE" />
< session-management >
< concurrency-control max-sessions = "1" />
</ session-management >
< custom-filter before = "FORM_LOGIN_FILTER" ref = "loginFilter" />
< custom-filter position = "FORM_LOGIN_FILTER" ref = "adminLoginFilter" />
< custom-filter before = "LOGOUT_FILTER" ref = "logoutFilter" />
< custom-filter position = "LOGOUT_FILTER" ref = "adminLogoutFilter" />
</ http >
< beans:bean id = "loginUrlEntryPoint" class = "com.piaoyi.common.security.LoginUrlEntryPoint" />
< beans:bean id = "loginFilter"
class = "org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter" >
< beans:property name = "authenticationManager" ref = "authenticationManager" />
< beans:property name = "authenticationFailureHandler" ref = "failureHandler" />
< beans:property name = "authenticationSuccessHandler" ref = "successHandler" />
< beans:property name = "filterProcessesUrl" value = "/j_spring_security_check" />
</ beans:bean >
< beans:bean id = "failureHandler"
class = "org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler" >
< beans:property name = "defaultFailureUrl" value = "/login.do?login_error=1" />
</ beans:bean >
< beans:bean id = "successHandler"
class = "org.springframework.security.web.authentication.SimpleUrlAuthenticationSuccessHandler" >
< beans:property name = "alwaysUseDefaultTargetUrl" value = "true" />
< beans:property name = "defaultTargetUrl" value = "/demo.do" />
</ beans:bean >
< beans:bean id = "adminLoginFilter"
class = "org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter" >
< beans:property name = "authenticationManager" ref = "authenticationManager" />
< beans:property name = "authenticationFailureHandler" ref = "adminFailureHandler" />
< beans:property name = "authenticationSuccessHandler" ref = "adminSuccessHandler" />
< beans:property name = "filterProcessesUrl" value = "/j_spring_security_check" />
</ beans:bean >
< beans:bean id = "adminFailureHandler"
class = "org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler" >
< beans:property name = "defaultFailureUrl" value = "/admin/login.do?login_error=1" />
</ beans:bean >
< beans:bean id = "adminSuccessHandler"
class = "org.springframework.security.web.authentication.SimpleUrlAuthenticationSuccessHandler" >
< beans:property name = "alwaysUseDefaultTargetUrl" value = "true" />
< beans:property name = "defaultTargetUrl" value = "/admin/frame.do" />
</ beans:bean >
< beans:bean id = "logoutFilter" class = "org.springframework.security.web.authentication.logout.LogoutFilter" >
< beans:constructor-arg value = "/login.do" />
< beans:constructor-arg >
< beans:list >
< beans:bean class = "org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler" />
</ beans:list >
</ beans:constructor-arg >
< beans:property name = "filterProcessesUrl" value = "/j_spring_security_logout" />
</ beans:bean >
< beans:bean id = "adminLogoutFilter" class = "org.springframework.security.web.authentication.logout.LogoutFilter" >
< beans:constructor-arg value = "/admin/login.do" />
< beans:constructor-arg >
< beans:list >
< beans:bean class = "org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler" />
</ beans:list >
</ beans:constructor-arg >
< beans:property name = "filterProcessesUrl" value = "/admin/j_spring_security_logout" />
</ beans:bean >
< beans:bean id = "loggerListener"
class = "org.springframework.security.authentication.event.LoggerListener" />
< authentication-manager alias = "authenticationManager" >
< authentication-provider user-service-ref = "userService" >
< password-encoder hash = "md5" />
</ authentication-provider >
</ authentication-manager >
< beans:bean id = "userService" class = "com.piaoyi.common.security.UserService" />
< beans:bean id = "accessDecisionManager"
class = "org.springframework.security.access.vote.AffirmativeBased" >
< beans:property name = "decisionVoters" >
< beans:list >
< beans:bean class = "org.springframework.security.access.vote.RoleVoter" />
< beans:bean
class = "org.springframework.security.access.vote.AuthenticatedVoter" />
< beans:bean class = "com.piaoyi.common.security.DynamicRoleVoter" />
</ beans:list >
</ beans:property >
</ beans:bean >
</ beans:beans >

说明：

1.为了实现不同的登录验证，这里显示声明了登录过滤器与注销过滤器，并指定相应过滤器的位置。

2.因为我们自己来指定了登录过滤器与注销过滤器，所以就不能在<http>中设置auto-config="true"

3.为了区分开不同的登录页面，就需要在<http>中配置认证切入点“entry-point-ref”，认证切入点的作用是当请求被拦截时该如何处理，这里处理为跳转到各自的登录页面

4.这里理想化的将前台用户与后台用户都使用同一个userService进行管理，即表示都存储在同一张用户表中，对于前后台用户不在同一张表中的处理，笔者也在研究中。

LoginUrlEntryPoint.java

Java代码

public class LoginUrlEntryPoint implements AuthenticationEntryPoint {
public void commence(HttpServletRequest request, HttpServletResponse response,
AuthenticationException authException) throws IOException, ServletException {
String targetUrl = null ;
String url = request.getRequestURI();
if (url.indexOf( "admin" ) != - 1 ){
//未登录而访问后台受控资源时，跳转到后台登录页面
targetUrl = "/admin/login.do" ;
}else {
//未登录而访问前台受控资源时，跳转到前台登录页面
targetUrl = "/login.do" ;
}
targetUrl = request.getContextPath() + targetUrl;
response.sendRedirect(targetUrl);
}
}

分享到：

《Spring Security3》第六章第七部分翻译（ ... | SpringSecurity3.X--remember-me（转载）

2011-12-23 06:33
浏览 3460
评论(0)
分类:企业架构
查看更多

发表评论

您还没有登录,请您登录后再发表评论

最近访客更多访客>>

博主相关

文章分类

社区版块

存档分类

最新评论