一、简介
二、详解
三、部分标签
四、参考
*************************************
一、简介
二、详解
1、最简单的认证授权方式
2、连接数据库认证授权方式
引入的spring-security包
A、项目源码中主要配置：spring-security.xml
<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans" xmlns:s="http://www.springframework.org/schema/security"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.5.xsd
http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-2.0.4.xsd"
default-autowire="byType" default-lazy-init="true">
<description>SpringSecurity安全配置</description>
<!-- http安全配置 -->
<!-- access-decision-manager-ref="accessDecisionManager"-->
<s:http auto-config="true">
<s:intercept-url pattern="/pages/league/igo/index/login.jsp" filters="none"/>
<s:intercept-url pattern="/login.jsp" filters="none"/>
<s:intercept-url pattern="/commons/**" filters="none"/>
<s:intercept-url pattern="/images/**" filters="none"/>
<s:intercept-url pattern="/css/**" filters="none"/>
<s:intercept-url pattern="/js/**" filters="none"/>
<s:intercept-url pattern="/**" access="ROLE_USER"/>
<s:intercept-url pattern="/search/index" access="ROLE_SUPERVISOR"/>
<s:form-login login-page="/pages/league/igo/index/login.jsp" default-target-url="/user/login"
authentication-failure-url="/pages/league/igo/index/login.jsp?error=1" />
<s:logout logout-success-url="/pages/league/igo/index/login.jsp" />
<s:remember-me key="e37f4b31-0c45-11dd-bd0b-0800200c9a66" />
<s:concurrent-session-control max-sessions="1"
exception-if-maximum-exceeded="false" expired-url="/pages/league/igo/index/login.jsp?error=3" />
</s:http>
<!-- 认证配置 -->
<s:authentication-provider user-service-ref="userDetailsService">
<!-- 可设置hash使用sha1或md5散列密码后再存入数据库 <s:password-encoder hash="plaintext" /> -->
<!-- <s:password-encoder hash="sha" /> -->
<s:password-encoder hash="md5" />
</s:authentication-provider>
<!-- 项目实现的用户查询服务 -->
<bean id="userDetailsService" class="com.base.platform.framework.security.UserDetailsServiceImpl" />
</beans>
B、认证和授权配置 UserDetailsServiceImpl.java
import java.util.HashSet;
import java.util.List;
import java.util.Set;
import org.springframework.dao.DataAccessException;
import org.springframework.security.GrantedAuthority;
import org.springframework.security.GrantedAuthorityImpl;
import org.springframework.security.userdetails.UserDetails;
import org.springframework.security.userdetails.UserDetailsService;
import org.springframework.security.userdetails.UsernameNotFoundException;
import com.base.platform.framework.web.utils.SpringContextUtils;
import com.league.myrecord.model.MyRecordBo;
import com.league.myrecord.service.MyRecordServiceFacade;
/**
* 实现SpringSecurity的UserDetailsService接口,实现获取用户Detail信息的回调函数.
*
*/
public class UserDetailsServiceImpl implements UserDetailsService {
// @Autowired
// private MyRecordServiceFacade myRecordService;
/**
* 获取用户Details信息的回调函数.
*/
public UserDetails loadUserByUsername(String userName)
throws UsernameNotFoundException, DataAccessException {
MyRecordBo userBo = null;
try {
MyRecordServiceFacade myRecordService = SpringContextUtils.getBean("myRecordService");
List loginNameList = myRecordService.findBy("loginName", userName);
if(loginNameList!=null &&loginNameList.size()>0){
userBo= (MyRecordBo) loginNameList.get(0);
}
if (userBo == null)
throw new UsernameNotFoundException("用户" + userName + " 不存在");
// GrantedAuthority[] grantedAuths = obtainGrantedAuthorities(userBo);
GrantedAuthority[] grantedAuths = null;
// -- mini-web示例中无以下属性, 暂时全部设为true.
boolean enabled = true;
boolean accountNonExpired = true;
boolean credentialsNonExpired = true;
boolean accountNonLocked = true;
grantedAuths = obtainGrantedAuthorities(userBo);
if(userBo.getLoginName().equals("ztt")) {
}
org.springframework.security.userdetails.User userdetail = new org.springframework.security.userdetails.User(
userBo.getLoginName(), userBo.getShaPassword(), enabled,
accountNonExpired, credentialsNonExpired, accountNonLocked,
grantedAuths);
return userdetail;
} catch (Exception e) {
throw new UsernameNotFoundException("用户" + userName + " 不存在");
}
}
/**
* 获得用户所有角色的权限集合.
*/
private GrantedAuthority[] obtainGrantedAuthorities(MyRecordBo userBo) {
Set<GrantedAuthority> authSet = new HashSet<GrantedAuthority>();
GrantedAuthority auth = new GrantedAuthorityImpl("ROLE_USER");
GrantedAuthority auth1 = new GrantedAuthorityImpl("ROLE_SUPERVISOR");
String loginName = userBo.getLoginName();
if(loginName.equals("xiaoming")) {
authSet.add(auth1);
} else {
authSet.add(auth);
}
return authSet.toArray(new GrantedAuthority[authSet.size()]);
}
}
三、部分标签
这个标签表达的web资源访问控制， 也是权限访问核心控制单元。 以下是几个示例：
<http pattern="/static/**" security="none"/>
表示资源 /static/** 不需要进行访问控制， 任何用户都可以访问该资源。
其中 security 是表达该资源是否受安全控制的意思， 如果是security="noe", 表示该资源并不受控， 而如果为true, 则表示该资源受控， 需要探幽定的权限才可以进入。
<http use-expressions="true"> <intercept-url pattern="/**" access="isAuthenticated()" /></http>
必须登录过了才可以访问网站的所有资源。
全站可以有多个http配置， 如果上述两个配置在一块， 如下：
<http pattern="/static/**" security="none"/><http use-expressions="true"> <intercept-url pattern="/**" access="isAuthenticated()" /></http>
上述配置表达的意思是本站所有资源都必须登录过才可以访问， 除了 /static/**
<http use-expressions="true"> <intercept-url pattern="/**" access="isAuthenticated()" /> <form-login login-page="/login.htm" login-processing-url="/login-processing.htm"/> </http>
form-login表达的是登录表单处理方案，login-page 属性表示 登录页面， login-processing-url 表示提交登录表单时的处理页面。
<http use-expressions="true"> <intercept-url pattern="/**" access="isAuthenticated()" /> <logout logout-success-url="/loggedout.jsp" delete-cookies="JSESSIONID"/> </http>
logout 这个标签表示登出操作， logout-success-url表示登出成功后的显示页面， delete-cookies表示登出时需要删除的cookies
<http use-expressions="true"> <remember-me /> </http>
remember-me表示密码会被记住， 打开登录界面时， 用户名或密码会显示在登录表单上， 点击登录会直接提交用户名和密码。
四、参考
Spring Security3十五日研究
http://www.blogjava.net/SpartaYew/archive/2011/05/19/SpingSecurity3.html
spring security 3 自定义认证，授权示例
http://chen-rojer-gmail-com.iteye.com/blog/1037973
SpringSecurity 配置（登陆验证，session失效等等）
http://blog.csdn.net/lzsf1984/article/details/8331166
Google code中springside 涉及安全部分的源码注释
spring security3.0的ACL使用例子
http://lhx1026.iteye.com/blog/819854
Official documents:
51CTO下载-Spring Security 2.0.x中文参考文档.pdf
springsecurity.pdf (2.x,3.x)