SpringMVC + security模块 框架整合详解

 最近整理一个二手后台管理项目，整体大体可分为 ： Springmvc + mybatis + tiles + easyui + security 这几个模块，再用maven做管理。刚拿到手里面东西实在太多，所以老大让重新整一个，只挑出骨架。不可否认，架构整体规划得还是很好的，尤其是前端界面用tiles+easyui ，开发很高效！其实，之前虽然听说过security，但做过的项目都没用过security，所以也算是一个新手！整合过程还是很烧脑的。

    1、首先是springmvc部分，也是框架的最核心骨架部分。springmvc也是基于servlet框架完成的，所以我们都可以从web.xml入手，然后顺藤摸瓜，整理出整个架构。web.xml中主要部分是放置spring的各种配置：

         contextConfigLocation

         /WEB-INF/spring/appServlet/servlet-context.xml

和

 <servlet>
         <servlet-name>appServletservlet-name>
         <servlet-class>org.springframework.web.servlet.DispatcherServletservlet-class>
         <init-param>
             <param-name>contextConfigLocationparam-name>
             <param-value>/WEB-INF/spring/appServlet/servlet-context.xmlparam-value>
         init-param>
         <load-on-startup>1load-on-startup>
         <async-supported>trueasync-supported>
     servlet>

     <servlet-mapping>
         <servlet-name>appServletservlet-name>
         <url-pattern>/url-pattern>
     servlet-mapping>

这两部分指定了配置文件地址和web请求地址拦截规则。需要注意的是，然后配置文件里就是常用的注解、数据源、之类的，不一而足。

    2、然后是security，本文实现了自定义的用户信息登录认证，主要部分：spring的security主要注意几个地方：

       1）web.xml中配置security必须的过滤器，注意名字必须是springSecurityFilterChain,这是内置的过滤器；然后将过滤规则设置为/*，表示对所有请求都拦截。

       2)  关于security的配置文件必须在中加入，因为ContextLoaderListener在加载的时候就会去加载security相关的东西，而此时springmvc（servlet)模块还没有初始化。

      二者配置如下：

       

         contextConfigLocation

         /WEB-INF/spring/appServlet/servlet-context.xml






         class>org.springframework.web.context.ContextLoaderListenerclass>




         springSecurityFilterChain
         class>org.springframework.web.filter.DelegatingFilterProxyclass>


         springSecurityFilterChain
         /*

本文中security配置文件再servlet-context.xml中被引入，形如：

 import resource="spring-security.xml"/>

     3）spring-security.xml配置文件：

          现在来看这个xml文件：

          首先 标签部分声明了访问拦截规则，这是security的关键。在这部分，我们先声明了一些不需要验证的资源和访问路径；然后是地址拦截规则部分：该部分拦截路径是/**，**表示可以跨目录结构，因此此处拦截该站点所有请求（除之前声明security=“none”的以外），然后拦截规则access="isAuthenticated()"，这是SecurityExpressionRoot中的判断是否认证过的方法之一，跟hasRole()类似，官方描述是Returns true if the user is not anonymous ，也就是用户认证后返回true。

 "1.0" encoding="UTF-8"?>
 "http://www.springframework.org/schema/security"
     xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
     xmlns:security="http://www.springframework.org/schema/security"
     xsi:schemaLocation="http://www.springframework.org/schema/beans
                         http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
                         http://www.springframework.org/schema/security
                         http://www.springframework.org/schema/security/spring-security-3.2.xsd">


     "/js/**" security="none"/>
     "/images/**" security="none"/>
     "/mgmt/**" security="none"/>
     "/image_sys/**" security="none"/>
     "/style/**" security="none"/>
     "/view/login.jsp" security="none"/>
     "/view/login/forgotPassword.jsp" security="none"/>
     "/securityCodeImage.html" security="none"/>
     "/checkSecurityCode.html" security="none"/>
     "/admin/validateMobile.html" security="none"/>
     "/verifycode/sendVerifyCode.html" security="none"/>
     "/admin/resetPassword.html" security="none"/>


     "true" entry-point-ref="authenticationProcessingFilterEntryPoint" access-denied-page="/view/403.jsp">
         "/**" access="isAuthenticated()" />


         "loginFilter"  position="FORM_LOGIN_FILTER" />
         "/j_spring_security_logout" logout-success-url="/view/login.jsp" delete-cookies="JSESSIONID"/>



     "authenticationProcessingFilterEntryPoint" class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint">
         "loginFormUrl" value="/view/login.jsp">



   "loginFilter"
         class="com.security.AdminUsernamePasswordAuthenticationFilter">
         "filterProcessesUrl" value="/j_spring_security_check">
         "authenticationSuccessHandler" ref="myAuthenticationSuccessHandler">
         "authenticationFailureHandler" ref="myAuthenticationFailureHandler">
         "authenticationManager" ref="authenticationManager">



     "myAuthenticationFailureHandler"
         class="org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler">
         "defaultFailureUrl" value="/view/login.jsp?error=true" />


     "myAuthenticationSuccessHandler"
         class="org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler">
         "alwaysUseDefaultTargetUrl" value="true" />

         "defaultTargetUrl" value="/index/homepage" />



     "authenticationManager" erase-credentials="false">
         "authenticationProvider" />

     "authenticationProvider"
         class="com.security.AdminAuthenticationProvider">
         "userDetailsService" ref="userDetailsService" />

     "userDetailsService"
         class="com.security.AdminUserDetailsService">
         "adminService" ref="adminServiceImpl">

      然后声明了自定义的用户登录的拦截器loginFilter，用于在登录时实现security认证。spring的登录认证模块执行顺序为：

1、UsernamePasswordAuthenticationFilter的attemptAuthentication（）方法，此部分可以做用户名密码的判断，正确后继续执行；

2、接下来调用AuthenticationManager的authenticate（）方法（中途具体怎么调用此处不深究），一个Mannager对应了多个authenticationProvider，其实最终是通过调用provider的authenticate（）方法来进行认证的，只要provider的supports方法返回true即可声明该provider或可进行认证，最后将被manager调用。在authenticate（）方法中，调用UserDetails的loadUserByUserName()方法来加载登录用户信息，包括权限信息，最后封装成AbstractAuthenticationToken,这个对象就是security模块认证后的用户完整信息。

自定义认证主要类如下：

 /**
  * 用户登录验证步骤一：attemptAutentication（）
  */
 public class AdminUsernamePasswordAuthenticationFilter extends UsernamePasswordAuthenticationFilter {

     public static final String VALIDATE_CODE = "validateCode";
     public static final String USERNAME = "j_username";
     public static final String PASSWORD = "j_password";
     public static final String EMPLOYEENO = "j_employeeNo";

     @Resource
     private AdminService adminService;

     @Override
     public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response)
             throws AuthenticationException {
         if (!request.getMethod().equals("POST")) {
             throw new AuthenticationServiceException("Authentication method not supported: " + request.getMethod());
         }

         // 判断用户信息

         // UsernamePasswordAuthenticationToken实现 Authentication
         UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(
                 adminModel.getAdminId(), password);

         // 允许子类设置详细属性
         setDetails(request, authRequest);

         // 运行UserDetailsService的loadUserByUsername 再次封装Authentication
         return this.getAuthenticationManager().authenticate(authRequest);
     }
     @Override
     protected String obtainUsername(HttpServletRequest request) {
         Object obj = request.getParameter(USERNAME);
         return null == obj ? "" : obj.toString();
     }
     @Override
     protected String obtainPassword(HttpServletRequest request) {
         Object obj = request.getParameter(PASSWORD);
         return null == obj ? "" : obj.toString();
     }
 }

 /**
  * 用户登录验证步骤二：authenticate（）
  */
 public class AdminAuthenticationProvider implements AuthenticationProvider {
     protected Logger logger = LoggerFactory.getLogger(this.getClass());

     private UserDetailsService userDetailsService = null;

     public AdminAuthenticationProvider() {
         super();
     }
     /**
      * @param userDetailsService
      */
     public AdminAuthenticationProvider(UserDetailsService userDetailsService) {
         super();
         this.userDetailsService = userDetailsService;
     }

     public UserDetailsService getUserDetailsService() {
         return userDetailsService;
     }

     public void setUserDetailsService(UserDetailsService userDetailsService) {
         this.userDetailsService = userDetailsService;
     }

     /**
      * provider的authenticate()方法，用于登录验证
      */
     @SuppressWarnings("unchecked")
     public Authentication authenticate(Authentication authentication) throws AuthenticationException {

         // 1. Check username and password
         try {
             doLogin(authentication);
         } catch (Exception e) {
             if (e instanceof AuthenticationException) {
                 throw (AuthenticationException) e;
             }
             logger.error("failure to doLogin", e);
         }

         // 2. Get UserDetails
         UserDetails userDetails = null;
         try {
             userDetails = this.userDetailsService.loadUserByUsername(authentication.getName());
         } catch (Exception e) {
             if (e instanceof AuthenticationException) {
                 throw (AuthenticationException) e;
             }
             logger.error("failure to get user detail", e);
         }

     // 3. Check and get all of admin roles and contexts.
     Collection authorities = (Collection) userDetails.getAuthorities();
     if (authorities != null && !authorities.isEmpty()) {
         AdminAuthenticationToken token = new AdminAuthenticationToken(authentication.getName(),
                 authentication.getCredentials(), authorities);
         token.setDetails(userDetails);
         return token;
     }
     throw new BadCredentialsException("没有分配权限");
 }
 protected void doLogin(Authentication authentication) throws AuthenticationException {

 }
 @Override
 public boolean supports(Class authentication) {
     // TODO Auto-generated method stub
     return true;
 }

 /**用户详细信息获取
  */
 public class AdminUserDetailsService implements UserDetailsService {
     private Logger logger = LoggerFactory.getLogger(AdminUserDetailsService.class);
     private AdminService adminService;

     @Override
     public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {

         AdminUserDetails userDetails = new AdminUserDetails();
         userDetails.setAdminId(username);

         ///加载用户基本信息
         AdminModel adminModel = adminService.getAdminByAdminId(username);
         try {
             PropertyUtils.copyProperties(userDetails, adminModel);
         } catch (IllegalAccessException e) {
             logger.error("用户信息复制到userDetails出错",e);
         } catch (InvocationTargetException e) {
             logger.error("用户信息复制到userDetails出错",e);
         } catch (NoSuchMethodException e) {
             logger.error("用户信息复制到userDetails出错",e);
         }
         //加载权限信息
         List authorities = this.adminService.getAuthorityByUserId(username);
         if (authorities == null || authorities.size() == 0) {////如果为普通用户
             if (isCommonUserRequest()) {
           AdminRoleGrantedAuthority authority =
                 new AdminRoleGrantedAuthority(AdminRoleGrantedAuthority.ADMIN_ROLE_TYPE_COMMON_USER);
           userDetails.getAuthorities().add(authority);
             } else {
                 logger.warn("person authorities is empty, personId is [{}]", username);
             }
         }
         //加载用户权限
         userDetails.getAuthorities().addAll(authorities);

         ///这个就是权限系统最后的用户信息
         return userDetails;
     }

     private boolean isCommonUserRequest() {
         // TODO Auto-generated method stub
         return true;
     }

     public AdminService getAdminService() {
         return adminService;
     }

     public void setAdminService(AdminService adminService) {
         this.adminService = adminService;
     }

 }

 public class AdminAuthenticationToken extends AbstractAuthenticationToken {

   /**
    *
    */
   private static final long serialVersionUID = 5976309306377973996L;

   private final Object principal;
   private Object credentials;

   public AdminAuthenticationToken(Object principal, Object credentials) {
     super(null);
     this.principal = principal;
     this.credentials = credentials;
     setAuthenticated(false);
   }

 c AdminAuthenticationToken(Object principal, Object credentials, Collectionextends GrantedAuthority> authorities) {
     super(authorities);
     this.principal = principal;
     this.credentials = credentials;
     super.setAuthenticated(true); //注意，这里设置为true了！ must use super, as we override
   }

   public Object getCredentials() {
     return this.credentials;
   }

   public Object getPrincipal() {
     return this.principal;
   }

   public void setAuthenticated(boolean isAuthenticated) throws IllegalArgumentException {
     if (isAuthenticated) {
       throw new IllegalArgumentException("Cannot set this token to trusted - use constructor which takes a GrantedAuthority list instead");
     }
     super.setAuthenticated(false);
   }

   @Override
   public void eraseCredentials() {
     super.eraseCredentials();
     credentials = null;
   }
 }

到这里基本就完成了spring security的设置，

         4）最后就是jsp页面部分，页面主要是表单的action地址必须为：path+/j_spring_security_check,其中path是项目路径，然后登录的时候就可以使用security模块了！

         至于文章中可能涉及到的一些bean或者service，这里就不贴代码了，毕竟项目较为完善，涉及东西太多，另外每个项目业务逻辑也不一样。

         在整个框架整合过程中，遇到了很多奇怪的问题，很多是因为版本不一致引起的，建议用maven进行jar等依赖包的统一管理。

        下面是spring security3.2的reference 手册：http://docs.spring.io/spring-security/site/docs/3.2.9.RELEASE/reference/htmlsingle/