spring-security3 进级篇I

snoopy7713

浏览: 1152458 次
性别:
来自: 火星郊区

最近访客更多访客>>

青木落扬

jccz_zys

msn877763580

yushi103

博主相关

博客

微博

相册

留言

关于我

博客专栏

: OSGi
浏览量：0

文章分类

社区版块

存档分类

博客分类：

spring--security

security spring 框架

在上一篇入门中，简单介绍了spring security3的用法，但现实中，登录页面都是用户自己定义的，而不是spring security3生产的，这个时候，我们可以自定义用户登录页面。通过分析spring security3生成的登录页面，我们可以看到，它是一个表单，表单的action，userName 和 password的name分别为 j_spring_security_check, j_username，j_password。

（1）针对这个情况，我们自定义登录页面login.jsp，内容如下：

Html代码

< %@ page language = "java" contentType = "text/html; charset=UTF-8"
pageEncoding = "UTF-8" % >
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
< html >
< head >
< meta http-equiv = "Content-Type" content = "text/html; charset=UTF-8" >
< title > login interface </ title >
</ head >
< body >
< h3 > user login </ h3 >
${sessionScope.SPRING_SECURITY_LAST_EXCEPTION.message}
< form action = "${pageContext.request.contextPath}/j_spring_security_check" method = "post" >
userName:< input type = "text" name = "j_username" /> < br />
password:< input type = "password" name = "j_password" /> < br />
< input type = "submit" value = "登录" >
</ form >
</ body >
</ html >

其中，${sessionScope.SPRING_SECURITY_LAST_EXCEPTION.message}为spring security框架自带的信息，通过配置国际化文件，实现信息的提示，展开spring security core 可以看到国际化的文件，用户可以修改其内容满足自己项目的需要，也可自定义自己的国际化文件，将spring security core 中的key-value中的value进行修改，如果采用spring自带的国际化文件，请在配置文件中写入如下的配置信息：

Xml代码

<? xml version = "1.0" encoding = "UTF-8" ?>
< beans xmlns = "http://www.springframework.org/schema/beans"
xmlns:xsi = "http://www.w3.org/2001/XMLSchema-instance" xmlns:aop = "http://www.springframework.org/schema/aop"
xmlns:tx = "http://www.springframework.org/schema/tx" xmlns:context = "http://www.springframework.org/schema/context"
xmlns:jee = "http://www.springframework.org/schema/jee"
xsi:schemaLocation ="
http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx.xsd
http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop.xsd
http://www.springframework.org/schema/jee http://www.springframework.org/schema/jee/spring-jee.xsd">
< bean id = "messageSource" class = "org.springframework.context.support.ResourceBundleMessageSource" >
< property name = "basename" value = "org.springframework.security.messages" />
</ bean >
</ beans >

（2）修改spring-security配置文件满足自定义方式

Java代码

<?xml version= "1.0" encoding= "UTF-8" ?>
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:security="http://www.springframework.org/schema/security"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
http://www.springframework.org/schema/security
http://www.springframework.org/schema/security/spring-security-3.1.xsd">
<security:http pattern="/login.jsp*" security= "none" />
<security:http auto-config="true" >
<security:form-login login-page="/login.jsp" />
<security:intercept-url pattern="/**" access= "ROLE_USER" />
</security:http>
<security:authentication-manager>
<security:authentication-provider>
<security:user-service>
<security:user name="user" password= "opal" authorities= "ROLE_USER" />
</security:user-service>
</security:authentication-provider>
</security:authentication-manager>
</beans>

（3）运行该程序，系统自动跳到用户自定义的界面，输错代码，点击登录，错误信息提示如下：

（4）用户可以对密码进行加密，例如采用MD5的方式，假设用户密码为opal，其加密后为

22b5c9accc6e1ba628cedc63a72d57f8

此时，配置文件中的配置修改如下：

Xml代码

<? xml version = "1.0" encoding = "UTF-8" ?>
< beans xmlns = "http://www.springframework.org/schema/beans"
xmlns:security = "http://www.springframework.org/schema/security"
xmlns:xsi = "http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation ="http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
http://www.springframework.org/schema/security
http://www.springframework.org/schema/security/spring-security-3.1.xsd">
< security:http pattern = "/login.jsp*" security = "none" />
< security:http auto-config = "true" >
< security:form-login login-page = "/login.jsp" />
< security:intercept-url pattern = "/**" access = "ROLE_USER" />
</ security:http >
< security:authentication-manager >
< security:authentication-provider >
< security:password-encoder hash = "md5" />
< security:user-service >
< security:user name = "user" password = "22b5c9accc6e1ba628cedc63a72d57f8" authorities = "ROLE_USER" />
</ security:user-service >
</ security:authentication-provider >
</ security:authentication-manager >
</ beans >

分享到：

spring security3进级篇II | spring-security3 入门篇

2012-11-28 13:05
浏览 2001
评论(0)
分类:行业应用
查看更多

发表评论

您还没有登录,请您登录后再发表评论