spring-security学习

一、简介

二、详解

三、部分标签

四、参考

 

*************************************

 

一、简介

二、详解

 1、最简单的认证授权方式 

 2、连接数据库认证授权方式

   引入的spring-security包

   

 

   A、项目源码中主要配置：spring-security.xml

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans" xmlns:s="http://www.springframework.org/schema/security"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.5.xsd
                        http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-2.0.4.xsd"
	default-autowire="byType" default-lazy-init="true">

	<description>SpringSecurity安全配置</description>

	<!-- http安全配置 -->
	
	<!-- access-decision-manager-ref="accessDecisionManager"-->
	<s:http auto-config="true">
		<s:intercept-url pattern="/pages/league/igo/index/login.jsp" filters="none"/> 
		<s:intercept-url pattern="/login.jsp" filters="none"/> 
		<s:intercept-url pattern="/commons/**" filters="none"/> 
		<s:intercept-url pattern="/images/**" filters="none"/> 
		<s:intercept-url pattern="/css/**" filters="none"/> 
		<s:intercept-url pattern="/js/**" filters="none"/>
		
		<s:intercept-url pattern="/**" access="ROLE_USER"/>
		<s:intercept-url pattern="/search/index" access="ROLE_SUPERVISOR"/> 
		 
		<s:form-login login-page="/pages/league/igo/index/login.jsp" default-target-url="/user/login"
			authentication-failure-url="/pages/league/igo/index/login.jsp?error=1" />
			
		<s:logout logout-success-url="/pages/league/igo/index/login.jsp" />
		<s:remember-me key="e37f4b31-0c45-11dd-bd0b-0800200c9a66" />
		<s:concurrent-session-control max-sessions="1"
			exception-if-maximum-exceeded="false" expired-url="/pages/league/igo/index/login.jsp?error=3" />
	</s:http>

	<!-- 认证配置 -->
	<s:authentication-provider user-service-ref="userDetailsService">
		<!-- 可设置hash使用sha1或md5散列密码后再存入数据库 <s:password-encoder hash="plaintext" /> -->
		<!-- <s:password-encoder hash="sha" /> -->
		<s:password-encoder hash="md5" />
	</s:authentication-provider>
	

	<!-- 项目实现的用户查询服务 -->
	<bean id="userDetailsService" class="com.base.platform.framework.security.UserDetailsServiceImpl" />

</beans>

  B、认证和授权配置 UserDetailsServiceImpl.java

 

 

import java.util.HashSet;
import java.util.List;
import java.util.Set;

import org.springframework.dao.DataAccessException;
import org.springframework.security.GrantedAuthority;
import org.springframework.security.GrantedAuthorityImpl;
import org.springframework.security.userdetails.UserDetails;
import org.springframework.security.userdetails.UserDetailsService;
import org.springframework.security.userdetails.UsernameNotFoundException;

import com.base.platform.framework.web.utils.SpringContextUtils;
import com.league.myrecord.model.MyRecordBo;
import com.league.myrecord.service.MyRecordServiceFacade;

/**
 * 实现SpringSecurity的UserDetailsService接口,实现获取用户Detail信息的回调函数.
 * 
 */
public class UserDetailsServiceImpl implements UserDetailsService {
	
//	@Autowired
//	private MyRecordServiceFacade myRecordService;

	/**
	 * 获取用户Details信息的回调函数.
	 */
	public UserDetails loadUserByUsername(String userName)
			throws UsernameNotFoundException, DataAccessException {
		MyRecordBo userBo = null;
		try {
			MyRecordServiceFacade myRecordService = SpringContextUtils.getBean("myRecordService");
			List loginNameList = myRecordService.findBy("loginName", userName);
			if(loginNameList!=null &&loginNameList.size()>0){
				userBo= (MyRecordBo) loginNameList.get(0);
			}
			if (userBo == null)
				throw new UsernameNotFoundException("用户" + userName + " 不存在");
			
//			GrantedAuthority[] grantedAuths = obtainGrantedAuthorities(userBo);
			GrantedAuthority[] grantedAuths = null; 
				
			// -- mini-web示例中无以下属性, 暂时全部设为true.
			boolean enabled = true;
			boolean accountNonExpired = true;
			boolean credentialsNonExpired = true;
			boolean accountNonLocked = true;
			
			grantedAuths = obtainGrantedAuthorities(userBo);
			if(userBo.getLoginName().equals("ztt")) {
			}
			
			org.springframework.security.userdetails.User userdetail = new org.springframework.security.userdetails.User(
					userBo.getLoginName(), userBo.getShaPassword(), enabled,
					accountNonExpired, credentialsNonExpired, accountNonLocked,
					grantedAuths);
			return userdetail;
		} catch (Exception e) {
			throw new UsernameNotFoundException("用户" + userName + " 不存在");
		}
	}

	/**
	 * 获得用户所有角色的权限集合.
	 */
	private GrantedAuthority[] obtainGrantedAuthorities(MyRecordBo userBo) {
		Set<GrantedAuthority> authSet = new HashSet<GrantedAuthority>();
		
		GrantedAuthority auth = new GrantedAuthorityImpl("ROLE_USER"); 
		GrantedAuthority auth1 = new GrantedAuthorityImpl("ROLE_SUPERVISOR");

		String loginName = userBo.getLoginName();
		
		
		if(loginName.equals("xiaoming")) {
		    authSet.add(auth1);
		} else {
		    authSet.add(auth);
		}
		
		return authSet.toArray(new GrantedAuthority[authSet.size()]);
	}
}

 

三、部分标签

 

这个标签表达的web资源访问控制， 也是权限访问核心控制单元。 以下是几个示例：

 

 

<http pattern="/static/**" security="none"/>

 

 表示资源 /static/** 不需要进行访问控制， 任何用户都可以访问该资源。

 其中 security 是表达该资源是否受安全控制的意思， 如果是security="noe", 表示该资源并不受控， 而如果为true, 则表示该资源受控， 需要探幽定的权限才可以进入。

 

 

 

<http use-expressions="true"> <intercept-url pattern="/**" access="isAuthenticated()" /></http>

 

 

必须登录过了才可以访问网站的所有资源。

 

全站可以有多个http配置， 如果上述两个配置在一块， 如下：

 

<http pattern="/static/**" security="none"/><http use-expressions="true"> <intercept-url pattern="/**" access="isAuthenticated()" /></http>

 

上述配置表达的意思是本站所有资源都必须登录过才可以访问， 除了 /static/** 

 

 

 

<http use-expressions="true"> <intercept-url pattern="/**" access="isAuthenticated()" /> <form-login login-page="/login.htm" login-processing-url="/login-processing.htm"/> </http>

 

 

 

form-login表达的是登录表单处理方案，login-page 属性表示 登录页面，  login-processing-url 表示提交登录表单时的处理页面。

 

 

 

<http use-expressions="true"> <intercept-url pattern="/**" access="isAuthenticated()" /> <logout logout-success-url="/loggedout.jsp" delete-cookies="JSESSIONID"/> </http>

 

 

logout 这个标签表示登出操作，  logout-success-url表示登出成功后的显示页面，  delete-cookies表示登出时需要删除的cookies 

 

 

 

 

<http use-expressions="true"> <remember-me /> </http>

 

remember-me表示密码会被记住， 打开登录界面时， 用户名或密码会显示在登录表单上， 点击登录会直接提交用户名和密码。

 

四、参考

 

 

Spring Security3十五日研究

http://www.blogjava.net/SpartaYew/archive/2011/05/19/SpingSecurity3.html

spring security 3 自定义认证，授权示例

http://chen-rojer-gmail-com.iteye.com/blog/1037973

SpringSecurity 配置（登陆验证，session失效等等）

http://blog.csdn.net/lzsf1984/article/details/8331166

Google code中springside 涉及安全部分的源码注释

http://code.google.com/p/springside/source/browse/springside3/trunk/modules/core/src/main/java/org/springside/modules/security/springsecurity/ResourceDetailsService.java?r=811

spring security3.0的ACL使用例子

http://lhx1026.iteye.com/blog/819854

 

Official documents:

51CTO下载-Spring Security 2.0.x中文参考文档.pdf

springsecurity.pdf (2.x,3.x)