Spring security3.x 自定义验证Filter
原创文章，欢迎转载！转载时务必保留：作者:jmppok ;出处http://blog.csdn.net/jmppok/article/details/44833545
1.applicationContext-secrity.xml配置
一个自定义的filter，必须包含authenticationManager,accessDecisionManager,securityMetadataSource三个属性，同时authenticationManager中需要包含一个用户验证服务UserDetailServie。
2.Filter---------------------MyFilterSecurityInterceptor
/**
* 类 MyFilterSecurityInterceptor 的实现描述：TODO 类实现描述
*
* @author ligh4 2015年3月31日下午4:58:57
*/
public class MyFilterSecurityInterceptor extends AbstractSecurityInterceptor implements Filter {
private FilterInvocationSecurityMetadataSource securityMetadataSource;
/**
* @author ligh4 2015年3月31日下午5:03:16
*/
@Override
public void destroy() {
// TODO Auto-generated method stub
}
/**
* @author ligh4 2015年3月31日下午5:03:16
*/
@Override
public void doFilter(ServletRequest arg0, ServletResponse arg1, FilterChain arg2)
throws IOException, ServletException {
FilterInvocation fi = new FilterInvocation(arg0, arg1, arg2);
invoke(fi);
}
public void invoke(FilterInvocation fi) throws IOException, ServletException {
InterceptorStatusToken token = super.beforeInvocation(fi);
try {
fi.getChain().doFilter(fi.getRequest(), fi.getResponse());
} finally {
super.afterInvocation(token, null);
}
}
public FilterInvocationSecurityMetadataSource getSecurityMetadataSource() {
return this.securityMetadataSource;
}
public void setSecurityMetadataSource(FilterInvocationSecurityMetadataSource newSource) {
this.securityMetadataSource = newSource;
}
/**
* @author ligh4 2015年3月31日下午5:03:16
*/
@Override
public void init(FilterConfig arg0) throws ServletException {
// TODO Auto-generated method stub
}
/**
* @author ligh4 2015年3月31日下午5:03:16
*/
@Override
public Class getSecureObjectClass() {
return FilterInvocation.class;
}
/**
* @author ligh4 2015年3月31日下午5:03:16
*/
@Override
public SecurityMetadataSource obtainSecurityMetadataSource() {
return this.securityMetadataSource;
}
}3.用户验证 服务 ---------- MyUserDetialService
/**
* 类 MyUserDetailService 的实现描述：TODO 类实现描述
*
* @author ligh4 2015年3月31日下午5:08:27
*/
@SuppressWarnings("deprecation")
public class MyUserDetailService implements UserDetailsService {
/**
* @author ligh4 2015年3月31日下午5:10:54
*/
@Override
public UserDetails loadUserByUsername(String arg0) throws UsernameNotFoundException {
if (arg0.equals("admin")) {
Collection auths = new ArrayList();
GrantedAuthorityImpl auth2 = new GrantedAuthorityImpl("ROLE_USER");
auths.add(auth2);
// User(String username, String password, boolean enabled, boolean accountNonExpired,
// boolean credentialsNonExpired, boolean accountNonLocked, Collection authorities) {
User user = new User(arg0, "admin", true, true, true, true, auths);
return user;
} else {
throw new UsernameNotFoundException(arg0);
}
}
} 4. 资源及权限定义 --------------- MyInvocationSecurityMetadataSource
/**
* 类 MyInvocationSecurityMetadataSource 的实现描述：TODO 类实现描述
*
* @author ligh4 2015年3月31日下午5:01:54
*/
public class MyInvocationSecurityMetadataSource implements FilterInvocationSecurityMetadataSource {
Collection role_user = new ArrayList();
Collection role_anonymous = new ArrayList();
public MyInvocationSecurityMetadataSource() {
role_user.add(new SecurityConfig("ROLE_USER"));
role_anonymous.add(new SecurityConfig("IS_AUTHENTICATED_ANONYMOUSLY"));
role_anonymous.add(new SecurityConfig("ROLE_ANONYMOUS"));
role_anonymous.add(new SecurityConfig("ROLE_USER"));
}
/**
* @author ligh4 2015年3月31日下午5:17:14
*/
@Override
public Collection getAttributes(Object arg0) throws IllegalArgumentException {
// guess object is a URL.
String url = ((FilterInvocation) arg0).getRequestUrl();
if (url.startsWith("/V1") || url.startsWith("/index**")) {
return role_user;
} else {
return role_anonymous;
}
}
/**
* @author ligh4 2015年3月31日下午5:17:14
*/
@Override
public boolean supports(Class arg0) {
// TODO Auto-generated method stub
return true;
}
/**
* @author ligh4 2015年3月31日下午5:17:14
*/
@Override
public Collection getAllConfigAttributes() {
// TODO Auto-generated method stub
return null;
}
} 5. 访问决策 ------------------------- MyAccessDecisionManager
/**
* 类 MyAccessDecisionManager 的实现描述：TODO 类实现描述
*
* @author ligh4 2015年3月31日下午5:01:04
*/
public class MyAccessDecisionManager implements AccessDecisionManager {
/**
* @author ligh4 2015年3月31日下午5:28:21
*/
@Override
public void decide(Authentication arg0, Object arg1, Collection arg2)
throws AccessDeniedException {
if (arg2 == null) {
return;
}
LogHelper.debug(this, arg1.toString()); //object is a URL.
Iterator ite = arg2.iterator();
while (ite.hasNext()) {
ConfigAttribute ca = ite.next();
String needRole = ((SecurityConfig) ca).getAttribute();
for (GrantedAuthority ga : arg0.getAuthorities()) {
if (needRole.equals(ga.getAuthority())) { //ga is user's role.
return;
}
}
}
LogHelper.warn(this, "No right of url:" + arg1.toString());
throw new AccessDeniedException("no right");
}
/**
* @author ligh4 2015年3月31日下午5:28:21
*/
@Override
public boolean supports(ConfigAttribute arg0) {
// TODO Auto-generated method stub
return true;
}
/**
* @author ligh4 2015年3月31日下午5:28:21
*/
@Override
public boolean supports(Class arg0) {
// TODO Auto-generated method stub
return true;
}
} 6. 拒绝访问的处理 ------------- MyAuthenticationFailureHandler
/**
* 类 MyAuthenticationFailureHandler 的实现描述：TODO 类实现描述
*
* @author ligh4 2015年3月31日下午4:04:40
*/
public class MyAuthenticationFailureHandler implements AccessDeniedHandler {
/**
* @author ligh4 2015年3月31日下午4:15:59
*/
@Override
public void handle(HttpServletRequest arg0, HttpServletResponse arg1, AccessDeniedException arg2)
throws IOException, ServletException {
LogHelper.debug(this, "handler AccessDeniedException...");
HttpServletRequest httpRequest = arg0;
// is ajax request?
if ("XMLHttpRequest".equals(httpRequest.getHeader("X-Requested-With"))) {
String msg = "{\"success\" : false, \"message\" : \"authentication-failure\"}";
arg1.setContentType("json");
OutputStream outputStream = arg1.getOutputStream();
outputStream.write(msg.getBytes());
outputStream.flush();
}
}
}注意只有拒绝访问才会执行.如果是未登陆或Session超时，会跳转到登陆页面。参考我的另一篇博客。