spring security 3.0 的 用户详细信息的 session 扩展 (基于rapid framework)

applicationContext-security.xml:

 

<? xml version="1.0" encoding="UTF-8" ?>
< beans  xmlns ="http://www.springframework.org/schema/beans"  xmlns:s ="http://www.springframework.org/schema/security"
    xmlns:xsi ="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation ="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.5.xsd
                        http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-2.0.4.xsd"
    default-autowire ="byType"  default-lazy-init ="true" >

     < description > 使用SpringSecurity的安全配置文件 </ description >

     <!--  http安全配置  -->
     < s:http  auto-config ="true"  access-decision-manager-ref ="accessDecisionManager" >
         < s:form-login  login-page ="/pages/Login/login.do"   />
         < s:logout  logout-success-url ="/"   />
         < s:remember-me  key ="ssss"   />
     </ s:http >
    <!-- 自定义成功和失败处理器,AppSessionSuccessHandler中设置了session -->
     < bean  id ="appSessionProcessingFilter"  class ="org.springframework.security.web.authentication.UsernamePasswordAuthenticationProcessingFilter" >  
         < s:custom-filter  before ="AUTHENTICATION_PROCESSING_FILTER"   />
         < property  name ="authenticationFailureHandler" >  
             < bean  class ="org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler" >  
                 < property  name ="defaultFailureUrl"  value ="/pages/Login/login.do?error=true" />  
             </ bean >  
         </ property >  
         < property  name ="authenticationSuccessHandler" >  
             < bean  class ="javacommon.base.AppSessionSuccessHandler" >  
                 < property  name ="defaultTargetUrl"  value ="/" />  
             </ bean >  
         </ property >
     </ bean >    

     <!--  认证配置  -->
     < s:authentication-provider  user-service-ref ="userDetailsService" >
         <!--  可设置hash使用sha1或md5散列密码后再存入数据库  -->
         < s:password-encoder  hash ="plaintext"   />
     </ s:authentication-provider >

     <!--  项目实现的用户查询服务  -->
     < bean  id ="userDetailsService"  class ="com.awd.service.UserDetailServiceImpl"   />

     <!--  重新定义的FilterSecurityInterceptor,使用databaseDefinitionSource提供的url-授权关系定义  -->
     < bean  id ="filterSecurityInterceptor"  class ="org.springframework.security.web.access.intercept.FilterSecurityInterceptor" >
         < s:custom-filter  before ="FILTER_SECURITY_INTERCEPTOR"   />
         < property  name ="accessDecisionManager"  ref ="accessDecisionManager"   />
         < property  name ="objectDefinitionSource"  ref ="databaseDefinitionSource"   />
     </ bean >

     <!--  DefinitionSource工厂,使用resourceDetailService提供的URL-授权关系.  -->
     < bean  id ="databaseDefinitionSource"  class ="javacommon.base.DefinitionSourceFactoryBean" >
         < property  name ="resourceDetailService"  ref ="resourceDetailService"   />
     </ bean >
    
     <!--  项目实现的URL-授权查询服务  -->
     < bean  id ="resourceDetailService"  class ="com.awd.service.ResourceDetailServiceImpl"   />

     <!--  授权判断配置, 将授权名称的默认前缀由ROLE_改为A_.  -->
     < bean  id ="accessDecisionManager"  class ="org.springframework.security.access.vote.AffirmativeBased" >
         < property  name ="decisionVoters" >
             < list >
                 < bean  class ="org.springframework.security.access.vote.RoleVoter" >
                     < property  name ="rolePrefix"  value ="A_"   />
                 </ bean >
                 < bean  class ="org.springframework.security.access.vote.AuthenticatedVoter"   />
             </ list >
         </ property >
     </ bean >
</ beans >

 

 

AppSessionSuccessHandler:

 

package javacommon.base;

import java.io.IOException;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler;
import org.springframework.security.web.savedrequest.SavedRequest;
import org.springframework.security.web.util.RedirectUtils;
import org.springframework.transaction.annotation.Transactional;
import org.springframework.util.StringUtils;

import com.awd.dao.UsersDao;
import com.awd.model.Users;

@Transactional(readOnly = true)
public class AppSessionSuccessHandler extends
        SavedRequestAwareAuthenticationSuccessHandler {

    @Autowired
    private UsersDao usersDao;

    public void onAuthenticationSuccess(HttpServletRequest request,
            HttpServletResponse response, Authentication authentication)
            throws ServletException, IOException {

        SavedRequest savedRequest = getSavedRequest(request);

        if (savedRequest == null) {
            super.onAuthenticationSuccess(request, response, authentication);

            return;
        }

        if (isAlwaysUseDefaultTargetUrl()
                || StringUtils.hasText(request
                        .getParameter(getTargetUrlParameter()))) {
            removeSavedRequest(request);
            super.onAuthenticationSuccess(request, response, authentication);

            return;
        }

        // 参考Lingo 的Spring security 3.0文档 附录 C. Spring Security-3.0.0.M1

        HttpSession session = request.getSession();
        UserDetails userDetails = (UserDetails) authentication.getPrincipal();
        Users currentUser = usersDao.findByUnique("loginname", userDetails.getUsername().toString());
        session.setAttribute("currentUser", currentUser);

        // Use the SavedRequest URL
        String targetUrl = savedRequest.getFullRequestUrl();
        logger.debug("Redirecting to SavedRequest Url: " + targetUrl);
        RedirectUtils.sendRedirect(request, response, targetUrl,
                isUseRelativeContext());

    }

    private SavedRequest getSavedRequest(HttpServletRequest request) {
        HttpSession session = request.getSession(false);

        if (session != null) {
            return (SavedRequest) session
                    .getAttribute(SavedRequest.SPRING_SECURITY_SAVED_REQUEST_KEY);
        }

        return null;
    }

    private void removeSavedRequest(HttpServletRequest request) {
        HttpSession session = request.getSession(false);

        if (session != null) {
            logger.debug("Removing SavedRequest from session if present");
            session
                    .removeAttribute(SavedRequest.SPRING_SECURITY_SAVED_REQUEST_KEY);
        }
    }
}

 

 

 

UserDetailServiceImpl.java

 

package  com.awd.service;

import  java.util.HashSet;
import  java.util.Set;

import  org.springframework.beans.factory.annotation.Autowired;
import  org.springframework.dao.DataAccessException;
import  org.springframework.security.core.GrantedAuthority;
import  org.springframework.security.core.authority.GrantedAuthorityImpl;
import  org.springframework.security.core.userdetails.UserDetails;
import  org.springframework.security.core.userdetails.UserDetailsService;
import  org.springframework.security.core.userdetails.UsernameNotFoundException;
import  org.springframework.transaction.annotation.Transactional;

import  com.awd.dao.UsersDao;
import  com.awd.model.Authorities;
import  com.awd.model.Roles;
import  com.awd.model.Users;


/**
 * 实现SpringSecurity的UserDetailsService接口,实现获取用户Detail信息的回调函�数.
 * 
 *  @author  calvin  edit by meetrice
  */
@Transactional(readOnly  =   true )
public   class  UserDetailServiceImpl  implements  UserDetailsService {
    
    
    @Autowired
     private  UsersDao usersDao;

     /**
     * 获取用户Detail信息的回调函�数.
      */
     public  UserDetails loadUserByUsername(String userName)  throws  UsernameNotFoundException, DataAccessException {

        Users users  =  usersDao.findByUnique( " loginname " , userName);
         if  (users  ==   null )
             throw   new  UsernameNotFoundException( " 用户 "   +  userName  +   "  不存在 " );

        GrantedAuthority[] grantedAuths  =  obtainGrantedAuthorities(users);
         //  无以下属性,暂时全部设为true.
         boolean  enabled  =   true ;
         boolean  accountNonExpired  =   true ;
         boolean  credentialsNonExpired  =   true ;
         boolean  accountNonLocked  =   true ;

        org.springframework.security.core.userdetails.User userdetail  =   new  org.springframework.security.core.userdetails.User(
                users.getLoginname(), users.getPassword(), enabled, accountNonExpired, credentialsNonExpired,
                accountNonLocked, grantedAuths);

         return  userdetail;
    }

     /**
     * 获得用户所有角色的权限.
      */
     private  GrantedAuthority[] obtainGrantedAuthorities(Users user) {
        Set < GrantedAuthority >  authSet  =   new  HashSet < GrantedAuthority > ();
         for  (Roles role : user.getRoles()) {
             for  (Authorities authority : role.getAuthorities()) {
                authSet.add( new  GrantedAuthorityImpl(authority.getName()));
            }
        }
         return  authSet.toArray( new  GrantedAuthority[authSet.size()]);
    }
}