spring security 登录、权限管理配置

登录流程

1）容器启动(MySecurityMetadataSource：loadResourceDefine加载系统资源与权限列表)
 2）用户发出请求
 3）过滤器拦截(MySecurityFilter:doFilter)
 4）取得请求资源所需权限(MySecurityMetadataSource:getAttributes)
 5）匹配用户拥有权限和请求权限(MyAccessDecisionManager:decide)，如果用户没有相应的权限，

     执行第6步，否则执行第7步。
 6）登录
 7）验证并授权(MyUserDetailServiceImpl:loadUserByUsername)

1、web.xml中加入过滤器

    springSecurityFilterChain
    org.springframework.web.filter.DelegatingFilterProxy


    springSecurityFilterChain
    /*

2、新建spring-security.xml文件

3、MyUsernamePasswordAuthenticationFilter.java

package cn.com.abel.test.service.security;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.springframework.security.authentication.AuthenticationServiceException;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;

public class MyUsernamePasswordAuthenticationFilter extends UsernamePasswordAuthenticationFilter{

	@Override
	public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException {

		if (!request.getMethod().equals("POST")) {
			throw new AuthenticationServiceException("Authentication method not supported: " + request.getMethod());
		}

		String username = obtainUsername(request);
		String password = obtainPassword(request);

		if (username == null) {
			username = "";
		}

		if (password == null) {
			password = "";
		}

		username = username.trim();

		UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(username, password);

		// Allow subclasses to set the "details" property
		setDetails(request, authRequest);

//		//登录验证码，如需要开启把下面注释去掉则可
//		String authCode = StringUtils.defaultString(request.getParameter("authCode"));
//		if(!AdwImageCaptchaServlet.validateResponse(request, authCode)){
//			throw new AuthenticationServiceException("validCode.auth.fail");
//		}

		return this.getAuthenticationManager().authenticate(authRequest);
	}
}

4、MySecurityFilter.java

package cn.com.abel.test.service.security;

import java.io.IOException;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;

import org.springframework.security.access.SecurityMetadataSource;
import org.springframework.security.access.intercept.AbstractSecurityInterceptor;
import org.springframework.security.access.intercept.InterceptorStatusToken;
import org.springframework.security.web.FilterInvocation;
import org.springframework.security.web.access.intercept.FilterInvocationSecurityMetadataSource;

public class MySecurityFilter extends AbstractSecurityInterceptor implements Filter {
	//与applicationContext-security.xml里的myFilter的属性securityMetadataSource对应，
	//其他的两个组件，已经在AbstractSecurityInterceptor定义
	private FilterInvocationSecurityMetadataSource securityMetadataSource;

	@Override
	public SecurityMetadataSource obtainSecurityMetadataSource() {
		return this.securityMetadataSource;
	}

	public void doFilter(ServletRequest request, ServletResponse response,
			FilterChain chain) throws IOException, ServletException {
		FilterInvocation fi = new FilterInvocation(request, response, chain);
		invoke(fi);
	}
	
	private void invoke(FilterInvocation fi) throws IOException, ServletException {
		// object为FilterInvocation对象
		//1.获取请求资源的权限
		//执行Collection attributes = SecurityMetadataSource.getAttributes(object);
		//2.是否拥有权限
		//获取安全主体，可以强制转换为UserDetails的实例
		//1) UserDetails
		// Authentication authenticated = authenticateIfRequired();
		//this.accessDecisionManager.decide(authenticated, object, attributes);
		//用户拥有的权限
		//2) GrantedAuthority
		//Collection authenticated.getAuthorities()
		//System.out.println("用户发送请求！ ");
		InterceptorStatusToken token = null;
		
		token = super.beforeInvocation(fi);
		
		try {
			fi.getChain().doFilter(fi.getRequest(), fi.getResponse());
		} finally {
			super.afterInvocation(token, null);
		}
	}

	public FilterInvocationSecurityMetadataSource getSecurityMetadataSource() {
		return securityMetadataSource;
	}

	public void setSecurityMetadataSource(FilterInvocationSecurityMetadataSource securityMetadataSource) {
		this.securityMetadataSource = securityMetadataSource;
	}
	
	public void init(FilterConfig arg0) throws ServletException {
		// TODO Auto-generated method stub
	}
	
	public void destroy() {
		// TODO Auto-generated method stub
		
	}

	@Override
	public Class getSecureObjectClass() {
		//下面的MyAccessDecisionManager的supports方面必须放回true,否则会提醒类型错误
		return FilterInvocation.class;
	}
}

5、AdminUserDetailServiceImpl.java

package cn.com.abel.test.service.security;

import java.util.HashSet;
import java.util.List;
import java.util.Set;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;

import cn.com.abel.test.model.RoleModel;
import cn.com.abel.test.model.MemberModel;
import cn.com.abel.test.service.RoleService;
import cn.com.abel.test.service.MemberService;

public class AdminUserDetailServiceImpl implements UserDetailsService {
	@Autowired
	private MemberService memberService;
	@Autowired
	RoleService roleService;
 
	//登录验证
	public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
		
	 
		MemberModel member = memberService.getUserDetailsByUserName(username);
		
		if(member==null){
			throw new UsernameNotFoundException("member "+username +" not found.");
		}
		Set grantedAuths = obtionGrantedAuthorities(member);

                //封装成spring security的user
                User userdetail = new User(user.getUserName(), user.getPassword(),
                true, // 账号状态 0 表示停用 1表示启用
                true, true, true, grantedAuths // 用户的权限
                );
                return userdetail;
	}
	
	//取得用户的权限
	private Set obtionGrantedAuthorities(MemberModel member) {
		
		Set authSet = new HashSet();
		
		List roles = roleService.getRoleByUser(member);
		if(roles!=null){
			for(RoleModel role : roles) {
				authSet.add(new SimpleGrantedAuthority(role.getRoleCode().trim()));
			}
		}
 
		return authSet;
	}
	
}

6、MyAccessDecisionManager.java

package cn.com.abel.test.service.security;

import java.util.Collection;
import java.util.Iterator;

import org.springframework.security.access.AccessDecisionManager;
import org.springframework.security.access.AccessDeniedException;
import org.springframework.security.access.ConfigAttribute;
import org.springframework.security.authentication.InsufficientAuthenticationException;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.GrantedAuthority;

public class MyAccessDecisionManager implements AccessDecisionManager {
	
	public void decide(Authentication authentication, Object object, Collection configAttributes) throws AccessDeniedException, InsufficientAuthenticationException {
		if(configAttributes == null) {
			return;
		}
		//所请求的资源拥有的权限(一个资源对多个权限)
		Iterator iterator = configAttributes.iterator();
		while(iterator.hasNext()) {
			ConfigAttribute configAttribute = iterator.next();
			//访问所请求资源所需要的权限
			String needPermission = configAttribute.getAttribute();
			System.out.println("needPermission is " + needPermission);
			//用户所拥有的权限authentication
			for(GrantedAuthority ga : authentication.getAuthorities()) {
				if(needPermission.equals(ga.getAuthority())) {
					return;
				}
			}
		}
		//没有权限让我们去捕捉
		throw new AccessDeniedException(" 没有权限访问！");
	}

	public boolean supports(ConfigAttribute attribute) {
		// TODO Auto-generated method stub
		return true;
	}

	public boolean supports(Class clazz) {
		// TODO Auto-generated method stub
		return true;
	}
	
}

7、MySecurityMetadataSource.java

package cn.com.abel.test.service.security;

import java.util.ArrayList;
import java.util.Collection;
import java.util.HashSet;
import java.util.Iterator;
import java.util.List;
import java.util.Map;
import java.util.Map.Entry;
import java.util.TreeMap;
import java.util.concurrent.ConcurrentHashMap;

import javax.servlet.http.HttpServletRequest;

import org.apache.commons.lang.StringUtils;
import org.springframework.beans.factory.InitializingBean;
import org.springframework.security.access.ConfigAttribute;
import org.springframework.security.access.SecurityConfig;
import org.springframework.security.web.FilterInvocation;
import org.springframework.security.web.access.intercept.FilterInvocationSecurityMetadataSource;
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
import org.springframework.security.web.util.matcher.RequestMatcher;

import cn.com.abel.test.model.RoleModel;
import cn.com.abel.test.service.ResourceService;

public class MySecurityMetadataSource  implements FilterInvocationSecurityMetadataSource,InitializingBean {

	
	private static final String AUTH_NO_ROLE =" __AUTH_NO_ROLE__";
	
	private ResourceService resourceService;
	
	public MySecurityMetadataSource(ResourceService resourceService) {
		this.resourceService = resourceService;
	}

	private static Map> resourceMap = null;

	public Collection getAllConfigAttributes() {
		return null;
	}

	public boolean supports(Class clazz) {
		return true;
	}
	private void loadResourceDefine() {
		if(resourceMap == null) {
			resourceMap = new ConcurrentHashMap>();
		}else{
			resourceMap.clear();
		}
		
		Map> resourceRoleMap = resourceService.getAllResourceRole();
		
		for (Entry> entry : resourceRoleMap.entrySet()) {
			String url = entry.getKey();
			List values = entry.getValue();
			
			Collection configAttributes = new ArrayList();
			for(RoleModel secRoleModel : values){
				ConfigAttribute configAttribute = new SecurityConfig(StringUtils.defaultString(secRoleModel.getRoleCode(),AUTH_NO_ROLE));
				configAttributes.add(configAttribute);
			}
			resourceMap.put(url, configAttributes);
		}
	}
	public Collection getAttributes(Object object) throws IllegalArgumentException {
		
		HttpServletRequest request = ((FilterInvocation) object).getHttpRequest();  
 
		TreeMap> attrMap = new TreeMap>(resourceMap);
		
		Iterator ite = attrMap.keySet().iterator();  
		
		RequestMatcher urlMatcher = null;  

		Collection attrSet = new HashSet();
		//match all of /admin/**  a/b/**
		while (ite.hasNext()) {  
			
			String resURL = ite.next();  
			urlMatcher = new AntPathRequestMatcher(resURL);

			if (urlMatcher.matches(request)||StringUtils.equals(request.getRequestURI(),resURL)) {  
				attrSet.addAll(attrMap.get(resURL));  
			}  
		}  

		if(!attrSet.isEmpty()){
			return attrSet;
		}
		return null;
	}
 
	@Override
	public void afterPropertiesSet() throws Exception {
		loadResourceDefine() ;
	}
	
}

8、ResourceService.java

此类是为从数据库获取系统中的资源所属的角色，根据自己的数据表自行编写。

package cn.com.abel.test.service;

import java.util.ArrayList;
import java.util.HashMap;
import java.util.HashSet;
import java.util.List;
import java.util.Map;

import org.apache.commons.collections.CollectionUtils;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Service;

import cn.com.abel.test.mapper.ResourceModelMapper;
import cn.com.abel.test.mapper.RoleModelMapper;
import cn.com.abel.test.mapper.RoleResourcetModelMapper;
import cn.com.abel.test.model.ResourceModel;
import cn.com.abel.test.model.ResourceModelCriteria;
import cn.com.abel.test.model.RoleModel;
import cn.com.abel.test.model.RoleModelCriteria;
import cn.com.abel.test.model.RoleResourcetModel;
import cn.com.abel.test.model.RoleResourcetModelCriteria;

@Service
public class ResourceService {
	
	@Autowired
	ResourceModelMapper resourceModelMapper;
	
	@Autowired
	RoleModelMapper roleMapper;
	
	@Autowired
	RoleResourcetModelMapper  roleResMapper;
	
	/**
	 * 获取各个资源（url）对应的角色
	 * @return
	 */
	public Map> getAllResourceRole(){
		
		 Map> resultMap = new HashMap>();
		 
		ResourceModelCriteria secResourceModelExample = new ResourceModelCriteria();
		List resourceList = resourceModelMapper.selectByExample(secResourceModelExample);
		
		if(CollectionUtils.isNotEmpty(resourceList)){
			for(ResourceModel secResourceModel : resourceList){
				RoleModelCriteria roleCriteria = new RoleModelCriteria();
				roleCriteria.createCriteria().andIdIn(getRoleIdsByResourceId(secResourceModel.getId()));
				List roleList = roleMapper.selectByExample(roleCriteria);
				resultMap.put(secResourceModel.getValue(), roleList);
				
			}
		}
	 
		return resultMap;
	}
	
	public List getRoleIdsByResourceId(Integer resourceId){
		List roleIds = new ArrayList();
		
		RoleResourcetModelCriteria criteria = new RoleResourcetModelCriteria();
		criteria.createCriteria().andResourceIdEqualTo(resourceId);
		List list = roleResMapper.selectByExample(criteria);
		if(CollectionUtils.isNotEmpty(list)){
			for(RoleResourcetModel model : list){
				roleIds.add(model.getRoleId());
			}
		}
		
		HashSet h  =   new  HashSet(roleIds);     
		roleIds.clear();     
		roleIds.addAll(h);   
		return roleIds;
	}
}

最后附上数据表的SQL：

CREATE TABLE `auth_resource` (
	`id` INT(11) NOT NULL AUTO_INCREMENT,
	`name` VARCHAR(100) NULL DEFAULT NULL COMMENT '资源名称',
	`value` VARCHAR(100) NULL DEFAULT NULL COMMENT '资源值',
	`summary` VARCHAR(1000) NULL DEFAULT NULL COMMENT '资源描述',
	`updated_time` DATETIME NULL DEFAULT NULL,
	`updated_user` VARCHAR(100) NULL DEFAULT NULL,
	PRIMARY KEY (`id`)
)
COMMENT='资源访问表'
COLLATE='utf8_general_ci'
ENGINE=InnoDB;

CREATE TABLE `auth_role` (
	`id` INT(11) NOT NULL AUTO_INCREMENT,
	`role_name` VARCHAR(100) NULL DEFAULT NULL COMMENT '角色名称',
	`role_code` VARCHAR(100) NULL DEFAULT NULL COMMENT '角色代码',
	`updated_time` DATETIME NULL DEFAULT NULL,
	`updated_user` VARCHAR(100) NULL DEFAULT NULL,
	PRIMARY KEY (`id`)
)
COMMENT='角色表'
COLLATE='utf8_general_ci'
ENGINE=InnoDB;

CREATE TABLE `role_resource` (
	`id` INT(11) NOT NULL AUTO_INCREMENT,
	`role_id` INT(11) NOT NULL,
	`resource_id` INT(11) NOT NULL,
	PRIMARY KEY (`id`),
	UNIQUE INDEX `role_id_resource_id` (`role_id`, `resource_id`)
)
COMMENT='资源角色关联表'
COLLATE='utf8_general_ci'
ENGINE=InnoDB;

CREATE TABLE `member` (
	`id` INT(11) NOT NULL AUTO_INCREMENT,
	`user_name` VARCHAR(100) NULL DEFAULT NULL,
	`nick` VARCHAR(100) NULL DEFAULT NULL,
	`password` VARCHAR(100) NULL DEFAULT NULL,
	`sex` INT(11) NULL DEFAULT NULL,
	`birthday` DATE NULL DEFAULT NULL,
	`mobile` VARCHAR(50) NULL DEFAULT NULL,
	`email` VARCHAR(50) NULL DEFAULT NULL,
	`address` VARCHAR(512) NULL DEFAULT NULL,
	`regip` VARCHAR(100) NULL DEFAULT NULL,
	`created_time` DATETIME NULL DEFAULT NULL,
	PRIMARY KEY (`id`)
)
COMMENT='用户表'
COLLATE='utf8_general_ci'
ENGINE=InnoDB
AUTO_INCREMENT=2;

CREATE TABLE `member_role` (
	`id` INT(11) NOT NULL AUTO_INCREMENT,
	`member_id` INT(11) NOT NULL,
	`role_id` INT(11) NOT NULL,
	PRIMARY KEY (`id`),
	UNIQUE INDEX `member_id_role_id` (`member_id`, `role_id`)
)
COMMENT='用户角色关联表'
COLLATE='utf8_general_ci'
ENGINE=InnoDB;

完整代码下载（包含数据库）： http://download.csdn.net/download/rongku/9931455