权限控制的菜单控制以及filter过滤url进行url过滤

1.关于菜单权限:

给用户附角色,给角色附权限,给权限附菜单.

2.通过filter过滤Url

    
    urlSecurityFilter
    com.suning.fbi.ficsoss.filter.UaaSecurityFilter
    
        system
        UAA-WEB
    

    
        urlSecurityFilter
        *.htm
        *.ajax
        *.do
    

注释:

:这些过滤的条件要经过这个过滤器

3.关于条件过滤的一些想法

package com.suning.fbi.ficsoss.filter;

import com.suning.fbi.ficsoss.controller.BaseController;
import com.suning.fbi.ficsoss.utils.ScmConfigUtils;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.web.context.support.WebApplicationContextUtils;
import org.springframework.web.context.support.XmlWebApplicationContext;

import javax.servlet.*;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.util.HashMap;
import java.util.Map;

/**
 * URL请求权限控制过滤类
 */
public class UaaSecurityFilter extends BaseController implements Filter {
    /**
     * The Uaatestbean.
     */
    AuthorizationRemoteService uaatestbean;
    /**
     * The Logger.
     */
    Logger logger = LoggerFactory.getLogger(this.getClass());
    /**
     * The Ignore array.
     */
    String[] ignoreArray = {"/ficsoss/index.htm","/ficsoss/login/getMenuList.ajax","/ficsoss/login/logOff.ajax","/ficsoss/pro-repo/init.htm"};

    public void init(FilterConfig config) throws ServletException {
        ScmConfigUtils util= new ScmConfigUtils();
        //获取忽略数组

        //ignoreArray=util.uaaGetScm().split(";");
      // ignoreArray[0] = "/ficsoss/index.htm";

    }

    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException,
            ServletException {
//1.拿到用户的userId        
HttpServletRequest req = (HttpServletRequest) request;
        String userId = this.getFibaAuthUser(req).getFibaUserId();

        Map resourceMap = new HashMap();
        //请求路径
        String urlstr = req.getRequestURI();
       //把requestUrl放进了Map里面
        resourceMap.put("resource", urlstr);
        System.out.println("进入过滤器了");
//判断是否要忽略
        boolean ignore = canIgnore(urlstr);
        logger.info("访问UAA的URL为：" + urlstr);
        if (ignore) {
//可忽略的话就放行
            chain.doFilter(request, response);
        } else {
            //filter初始化时，注解的bean还没初始化，没法注入。只能这样去获取。
            ServletContext sc = req.getSession().getServletContext();
            XmlWebApplicationContext cxt = (XmlWebApplicationContext) WebApplicationContextUtils
                    .getWebApplicationContext(sc);
            if (cxt != null && cxt.getBean("uaatestbean") != null && uaatestbean == null) {
                uaatestbean = (AuthorizationRemoteService) cxt.getBean("uaatestbean");
            }
            Boolean permission = null;
            try {
                permission = uaatestbean.hasPermission(userId, "FICSOSS", "REQUEST_URL", resourceMap);
                if (permission) {
                    chain.doFilter(request, response);
                } else {
                    logger.info("访问UAA无权限的URL地址为: " + urlstr);
                    HttpServletResponse resp = (HttpServletResponse) response;
                    req.setAttribute("urlstr", urlstr);
                    //页面跳转到error.
                    RequestDispatcher dispatcher = req.getRequestDispatcher("/error.htm");
                    dispatcher.forward(req, resp);
                }
            } catch (Exception e) {
                logger.error("调用UAA系统失败: ", e);
                e.printStackTrace();
            }
        }

    }
//
    private boolean canIgnore(String urlstr) {

        boolean flag = false;
        //遍历忽略数组
        for (int i = 0; i < ignoreArray.length; i++) {
            //如果忽略数组是空
            if (ignoreArray[i] == null || "".equals(ignoreArray[i]))
                continue;
            //如果url匹配忽略数组
            if (urlstr.matches(ignoreArray[i])) {
                flag = true;
                break;
            }
        }
        return flag;
    }

    public void destroy() {
    }

}