spring security3进级篇III

  在spring security3进级篇II中，虽然将用户和权限存入到数据库中，但在配置文件中仍然要对URL地址配置角色进行控制访问，如何将用户，角色，资源存放 到数据库中，进行统一管理，逐步实现RBAC的模型呢，这需要更复杂的实现，这一篇将实现将所有的信息存储到数据库中，但不涉及组，许可等表。

 

1、首先建立数据表

 CREATE   DATABASE  IF  NOT  EXISTS spring_securityiii;
 USE spring_securityiii;

 --
 -- Definition of table `pub_resources`
 --

 DROP   TABLE  IF EXISTS `pub_resources`;
 CREATE   TABLE  `pub_resources` (
   `id` bigint (20)  NOT   NULL  AUTO_INCREMENT,
   `resource_name` varchar (50)  NOT   NULL ,
   `resource_type` varchar (50)  NOT   NULL ,
   `resource_string` varchar (200)  NOT   NULL ,
   `resource_enabled` tinyint(1) NOT   NULL ,
   `resource_desc` varchar (200)  DEFAULT   NULL ,
   PRIMARY   KEY  (`id`),
   UNIQUE   KEY  `uk_pub_resource` (`resource_name`)
 ) ENGINE=InnoDB AUTO_INCREMENT=402 DEFAULT  CHARSET=utf8;

 --
 -- Dumping data for table `pub_resources`
 --

 /*!40000 ALTER   TABLE  `pub_resources` DISABLE KEYS */;
 INSERT   INTO  `pub_resources` (`id`,`resource_name`,`resource_type`,`resource_string`,`resource_enabled`,`resource_desc`)  VALUES
  (400,'index页面' , 'url' , '/index.*' ,1, 'index页面' ),
  (401,'admin页面' , 'url' , '/admin.*' ,1, 'admin页面' );
 /*!40000 ALTER   TABLE  `pub_resources` ENABLE KEYS */;


 --
 -- Definition of table `pub_roles`
 --

 DROP   TABLE  IF EXISTS `pub_roles`;
 CREATE   TABLE  `pub_roles` (
   `id` bigint (20)  NOT   NULL  AUTO_INCREMENT,
   `role_name` varchar (100)  NOT   NULL ,
   `role_enabled` tinyint(1) NOT   NULL ,
   `role_desc` varchar (200)  DEFAULT   NULL ,
   PRIMARY   KEY  (`id`),
   UNIQUE   KEY  `uk_pub_role` (`role_name`)
 ) ENGINE=InnoDB AUTO_INCREMENT=202 DEFAULT  CHARSET=utf8;

 --
 -- Dumping data for table `pub_roles`
 --

 /*!40000 ALTER   TABLE  `pub_roles` DISABLE KEYS */;
 INSERT   INTO  `pub_roles` (`id`,`role_name`,`role_enabled`,`role_desc`)  VALUES
  (200,'ROLE_ADMIN' ,1, '管理员角色' ),
  (201,'ROLE_USER' ,1, '普通用户角色' );
 /*!40000 ALTER   TABLE  `pub_roles` ENABLE KEYS */;


 --
 -- Definition of table `pub_roles_resources`
 --

 DROP   TABLE  IF EXISTS `pub_roles_resources`;
 CREATE   TABLE  `pub_roles_resources` (
   `id` bigint (20)  NOT   NULL  AUTO_INCREMENT,
   `role_id` bigint (20)  NOT   NULL ,
   `resource_id` bigint (20)  NOT   NULL ,
   PRIMARY   KEY  (`id`),
   KEY  `roles_resources_ibfk_1` (`role_id`),
   KEY  `roles_resources_ibfk_2` (`resource_id`),
   CONSTRAINT  `roles_resources_ibfk_1`  FOREIGN   KEY  (`role_id`)  REFERENCES  `pub_roles` (`id`),
   CONSTRAINT  `roles_resources_ibfk_2`  FOREIGN   KEY  (`resource_id`)  REFERENCES  `pub_resources` (`id`)
 ) ENGINE=InnoDB AUTO_INCREMENT=503 DEFAULT  CHARSET=utf8;

 --
 -- Dumping data for table `pub_roles_resources`
 --

 /*!40000 ALTER   TABLE  `pub_roles_resources` DISABLE KEYS */;
 INSERT   INTO  `pub_roles_resources` (`id`,`role_id`,`resource_id`)  VALUES
  (500,200,400),
  (501,200,401),
  (502,201,400);
 /*!40000 ALTER   TABLE  `pub_roles_resources` ENABLE KEYS */;


 --
 -- Definition of table `pub_users`
 --

 DROP   TABLE  IF EXISTS `pub_users`;
 CREATE   TABLE  `pub_users` (
   `id` bigint (20)  NOT   NULL  AUTO_INCREMENT,
   `user_account` varchar (50)  NOT   NULL ,
   `user_password` varchar (20)  NOT   NULL ,
   `user_enabled` tinyint(1) NOT   NULL ,
   `user_desc` varchar (200)  DEFAULT   NULL ,
   PRIMARY   KEY  (`id`),
   UNIQUE   KEY  `uk_pub_user` (`user_account`)
 ) ENGINE=InnoDB AUTO_INCREMENT=102 DEFAULT  CHARSET=utf8;

 --
 -- Dumping data for table `pub_users`
 --

 /*!40000 ALTER   TABLE  `pub_users` DISABLE KEYS */;
 INSERT   INTO  `pub_users` (`id`,`user_account`,`user_password`,`user_enabled`,`user_desc`)  VALUES
  (100,'admin' , 'admin' ,1, '管理员' ),
  (101,'user' , 'user' ,1, '普通用户' );
 /*!40000 ALTER   TABLE  `pub_users` ENABLE KEYS */;


 --
 -- Definition of table `pub_users_roles`
 --

 DROP   TABLE  IF EXISTS `pub_users_roles`;
 CREATE   TABLE  `pub_users_roles` (
   `id` bigint (20)  NOT   NULL  AUTO_INCREMENT,
   `user_id` bigint (20)  NOT   NULL ,
   `role_id` bigint (20)  NOT   NULL ,
   `ur_enabled` tinyint(1) NOT   NULL ,
   PRIMARY   KEY  (`id`),
   KEY  `users_roles_ibfk_1` (`user_id`),
   KEY  `users_roles_ibfk_2` (`role_id`),
   CONSTRAINT  `users_roles_ibfk_1`  FOREIGN   KEY  (`user_id`)  REFERENCES  `pub_users` (`id`),
   CONSTRAINT  `users_roles_ibfk_2`  FOREIGN   KEY  (`role_id`)  REFERENCES  `pub_roles` (`id`)
 ) ENGINE=InnoDB AUTO_INCREMENT=303 DEFAULT  CHARSET=utf8;

 --
 -- Dumping data for table `pub_users_roles`
 --

 /*!40000 ALTER   TABLE  `pub_users_roles` DISABLE KEYS */;
 INSERT   INTO  `pub_users_roles` (`id`,`user_id`,`role_id`,`ur_enabled`)  VALUES
  (300,100,200,1),
  (301,100,201,1),
  (302,101,201,1);
 /*!40000 ALTER   TABLE  `pub_users_roles` ENABLE KEYS */;

 2、自定义实现spring security的四个类

 

 package  com.spring.security.service.impl;

 import  javax.annotation.Resource;

 import  org.springframework.security.core.userdetails.UserDetails;
 import  org.springframework.security.core.userdetails.UsernameNotFoundException;
 import  org.springframework.stereotype.Service;

 import  com.spring.security.dao.UserDao;
 import  com.spring.security.domain.User;
 import  com.spring.security.service.CustomUserDetailsService;

 @Service ( "customUserDetailsService" )
 public   class  CustomUserDetailsServiceImpl  implements  CustomUserDetailsService {

     @Resource
     private  UserDao userDao;

     @Override
     public  UserDetails loadUserByUsername(String userName) throws  UsernameNotFoundException {

         User user = userDao.findUserByName(userName);

         if  (user ==  null ) {
             throw   new  UsernameNotFoundException( "用户名"  + userName +  "不存在" );
         }

         // 因为User已经实现了UserDetails接口，所以直接返回user即可
         return  user;
     }
 }

 

 package  com.spring.security.service.impl;

 import  java.util.Collection;
 import  java.util.Iterator;

 import  org.springframework.security.access.AccessDeniedException;
 import  org.springframework.security.access.ConfigAttribute;
 import  org.springframework.security.access.SecurityConfig;
 import  org.springframework.security.authentication.InsufficientAuthenticationException;
 import  org.springframework.security.core.Authentication;
 import  org.springframework.security.core.GrantedAuthority;
 import  org.springframework.stereotype.Service;

 import  com.spring.security.service.CustomAccessDecisionManager;

 /**
  * AccessdecisionManager在Spring security中是很重要的。
  *
  * 在验证部分简略提过了，所有的Authentication实现需要保存在一个GrantedAuthority对象数组中。 这就是赋予给主体的权限。
  * GrantedAuthority对象通过AuthenticationManager 保存到
  * Authentication对象里，然后从AccessDecisionManager读出来，进行授权判断。
  *
  * Spring Security提供了一些拦截器，来控制对安全对象的访问权限，例如方法调用或web请求。
  * 一个是否允许执行调用的预调用决定，是由AccessDecisionManager实现的。 这个 AccessDecisionManager
  * 被AbstractSecurityInterceptor调用， 它用来作最终访问控制的决定。
  * 这个AccessDecisionManager接口包含三个方法：
  *
  * void decide(Authentication authentication, Object secureObject,
  * List<ConfigAttributeDefinition> config) throws AccessDeniedException; boolean
  * supports(ConfigAttribute attribute); boolean supports(Class clazz);
  *
  * 从第一个方法可以看出来，AccessDecisionManager使用方法参数传递所有信息，这好像在认证评估时进行决定。
  * 特别是，在真实的安全方法期望调用的时候，传递安全Object启用那些参数。 比如，让我们假设安全对象是一个MethodInvocation。
  * 很容易为任何Customer参数查询MethodInvocation，
  * 然后在AccessDecisionManager里实现一些有序的安全逻辑，来确认主体是否允许在那个客户上操作。
  * 如果访问被拒绝，实现将抛出一个AccessDeniedException异常。
  *
  * 这个 supports(ConfigAttribute) 方法在启动的时候被
  * AbstractSecurityInterceptor调用，来决定AccessDecisionManager
  * 是否可以执行传递ConfigAttribute。 supports(Class)方法被安全拦截器实现调用，
  * 包含安全拦截器将显示的AccessDecisionManager支持安全对象的类型。
  */

 @Service ( "customAccessDecisionManager" )
 public   class  CustomAccessDecisionManagerImpl  implements  CustomAccessDecisionManager {

     /* (non-Javadoc)
      * @see org.springframework.security.access.AccessDecisionManager#decide(org.springframework.security.core.Authentication, java.lang.Object, java.util.Collection)
      */
     public   void  decide(Authentication authentication, Object object,Collection<ConfigAttribute> configAttributes)
         throws  AccessDeniedException, InsufficientAuthenticationException {

         if  (configAttributes ==  null ) {
             return ;
         }

         Iterator<ConfigAttribute> ite = configAttributes.iterator();

         while  (ite.hasNext()) {

             ConfigAttribute ca = ite.next();
             String needRole = ((SecurityConfig) ca).getAttribute();

             // ga 为用户所被赋予的权限。 needRole 为访问相应的资源应该具有的权限。
             for  (GrantedAuthority ga : authentication.getAuthorities()) {
                 if  (needRole.trim().equals(ga.getAuthority().trim())) {
                     return ;
                 }
             }
         }

         throw   new  AccessDeniedException( "Acess Denied" );
     }

     /* (non-Javadoc)
      * @see org.springframework.security.access.AccessDecisionManager#supports(org.springframework.security.access.ConfigAttribute)
      */
     public   boolean  supports(ConfigAttribute attribute) {

         return   true ;
     }

     /* (non-Javadoc)
      * @see org.springframework.security.access.AccessDecisionManager#supports(java.lang.Class)
      */
     public   boolean  supports(Class<?> clazz) {

         return   true ;
     }
 }

 

 package  com.spring.security.service.impl;

 import  java.io.IOException;

 import  javax.servlet.FilterChain;
 import  javax.servlet.FilterConfig;
 import  javax.servlet.ServletException;
 import  javax.servlet.ServletRequest;
 import  javax.servlet.ServletResponse;

 import  org.springframework.security.access.SecurityMetadataSource;
 import  org.springframework.security.access.intercept.AbstractSecurityInterceptor;
 import  org.springframework.security.access.intercept.InterceptorStatusToken;
 import  org.springframework.security.web.FilterInvocation;
 import  org.springframework.security.web.access.intercept.FilterInvocationSecurityMetadataSource;
 import  org.springframework.stereotype.Service;

 import  com.spring.security.service.CustomFilterSecurityInterceptor;

 /** */
 /**
  * 该过滤器的主要作用就是通过spring著名的IoC生成securityMetadataSource。
  * securityMetadataSource相当于本包中自定义的MyInvocationSecurityMetadataSourceService。
  * 该MyInvocationSecurityMetadataSourceService的作用提从数据库提取权限和资源，装配到HashMap中，
  * 供Spring Security使用，用于权限校验。
  *
  */

 @Service ( "customFilterSecurityInterceptor" )
 public   class  CustomFilterSecurityInterceptorImpl  extends  AbstractSecurityInterceptor  implements  CustomFilterSecurityInterceptor {

     private  FilterInvocationSecurityMetadataSource securityMetadataSource;

     public   void  setSecurityMetadataSource(
             FilterInvocationSecurityMetadataSource securityMetadataSource) {
         this .securityMetadataSource = securityMetadataSource;
     }


     public   void  doFilter(ServletRequest request, ServletResponse response,FilterChain chain)  throws  IOException, ServletException {

         FilterInvocation fi = new  FilterInvocation(request, response, chain);
         invoke(fi);
     }

     public  FilterInvocationSecurityMetadataSource getSecurityMetadataSource() {

         return   this .securityMetadataSource;
     }

     public  Class<?  extends  Object> getSecureObjectClass() {

         return  FilterInvocation. class ;
     }

     public   void  invoke(FilterInvocation fi)  throws  IOException,ServletException {

         InterceptorStatusToken token = super .beforeInvocation(fi);

         try  {
             fi.getChain().doFilter(fi.getRequest(), fi.getResponse());
         } finally  {
             super .afterInvocation(token,  null );
         }

     }

     @Override
     public  SecurityMetadataSource obtainSecurityMetadataSource() {
         return   this .securityMetadataSource;
     }

     public   void  destroy() {

     }

     public   void  init(FilterConfig filterconfig)  throws  ServletException {

     }
 }

 

 package  com.spring.security.service.impl;

 import  java.util.ArrayList;
 import  java.util.Collection;
 import  java.util.HashMap;
 import  java.util.HashSet;
 import  java.util.Iterator;
 import  java.util.List;
 import  java.util.Map;
 import  java.util.Set;

 import  javax.annotation.PostConstruct;
 import  javax.servlet.http.HttpServletRequest;

 import  org.springframework.security.access.ConfigAttribute;
 import  org.springframework.security.access.SecurityConfig;
 import  org.springframework.security.web.FilterInvocation;
 import  org.springframework.security.web.util.AntPathRequestMatcher;
 import  org.springframework.stereotype.Service;

 import  com.spring.security.dao.ResourceDao;
 import  com.spring.security.domain.Resource;
 import  com.spring.security.domain.Role;
 import  com.spring.security.service.CustomInvocationSecurityMetadataSource;

 @Service ( "customInvocationSecurityMetadataSource" )
 public   class  CustomInvocationSecurityMetadataSourceImpl  implements  CustomInvocationSecurityMetadataSource {

     @javax .annotation.Resource
     private  ResourceDao resourceDao;

     private  AntPathRequestMatcher pathMatcher;

     private  HashMap<String, Collection<ConfigAttribute>> resourceMap =  null ;

     /**
      * 自定义方法，这个类放入到Spring容器后，
      * 指定init为初始化方法，从数据库中读取资源
      *
      */
     @PostConstruct
     public   void  init(){

         this .resourceMap =  new  HashMap<String, Collection<ConfigAttribute>>();
         for  (Resource item : resourceDao.getAllResource()) {
             resourceMap.put(item.getResource_string(), listToCollection(item.getRoles()));
         }
     }

     @Override
     public  Collection<ConfigAttribute> getAllConfigAttributes() {

         Set<ConfigAttribute> allAttributes = new  HashSet<ConfigAttribute>();
         for  (Map.Entry<String, Collection<ConfigAttribute>> entry : resourceMap.entrySet()) {
             allAttributes.addAll(entry.getValue());
         }

         return  allAttributes;
     }

     @Override
     public  Collection<ConfigAttribute> getAttributes(Object object) throws  IllegalArgumentException {

         HttpServletRequest request = ((FilterInvocation) object).getRequest();
         System.out.println("requestUrl is "  + request.getRequestURI());

         if  (resourceMap ==  null ) {
             this .loadAllResourcesAndAuthorities();
         }
         Iterator<String> it = resourceMap.keySet().iterator();

         while  (it.hasNext()) {
             String resURL = it.next();
             pathMatcher = new  AntPathRequestMatcher(resURL);
             if  (pathMatcher.matches(request)) {
                 Collection<ConfigAttribute> returnCollection = resourceMap.get(resURL);

                 return  returnCollection;
             }
         }

         return   null ;
     }

     @Override
     public   boolean  supports(Class<?> arg0) {
         // TODO Auto-generated method stub
         return   true ;
     }


     /**
      * 自定义方法，将List<Role>集合转换为框架需要的Collection<ConfigAttribute>集合
      *
      * @param roles
      * @return
      */
     private  Collection<ConfigAttribute> listToCollection(List<Role> roles) {

         List<ConfigAttribute> list = new  ArrayList<ConfigAttribute>();

         for  (Role role : roles) {
             list.add(new  SecurityConfig(role.getRole_name()));
         }

         return  list;
     }

     /**
      * 加载所有资源与权限的关系
      */
     private   void  loadAllResourcesAndAuthorities() {

         if  (resourceMap ==  null ) {
             resourceMap = new  HashMap<String, Collection<ConfigAttribute>>();
         }

         List<Resource> resources = this .resourceDao.getAllResource();
         for  (Resource resource : resources) {
             resourceMap.put(resource.getResource_string(),listToCollection(resource.getRoles()));
         }
     }
 }

 

3、定义用户，角色，资源的类

 

 package  com.spring.security.domain;

 import  java.io.Serializable;
 import  java.util.ArrayList;
 import  java.util.List;

 /**
  * Resources
  */

 public   class  Resource  implements  Serializable {

     private   static   final   long  serialVersionUID = 1L;

     private  Integer id;
     private  String resource_name;
     private  String resource_type;
     private  String resource_string;
     private  String resource_enabled;
     private  String resource_desc;
     private  List<Role> roles =  new  ArrayList<Role>();

     public  Integer getId() {
         return  id;
     }

     public   void  setId(Integer id) {
         this .id = id;
     }

     public  String getResource_name() {
         return  resource_name;
     }

     public   void  setResource_name(String resource_name) {
         this .resource_name = resource_name;
     }

     public  String getResource_type() {
         return  resource_type;
     }

     public   void  setResource_type(String resource_type) {
         this .resource_type = resource_type;
     }

     public  String getResource_string() {
         return  resource_string;
     }

     public   void  setResource_string(String resource_string) {
         this .resource_string = resource_string;
     }

     public  String getResource_enabled() {
         return  resource_enabled;
     }

     public   void  setResource_enabled(String resource_enabled) {
         this .resource_enabled = resource_enabled;
     }

     public  String getResource_desc() {
         return  resource_desc;
     }

     public   void  setResource_desc(String resource_desc) {
         this .resource_desc = resource_desc;
     }

     public  List<Role> getRoles() {
         return  roles;
     }

     public   void  setRoles(List<Role> roles) {
         this .roles = roles;
     }
 }

 

 package  com.spring.security.domain;

 import  java.io.Serializable;

 /**
  * Roles.
  */

 public   class  Role  implements  Serializable {

     private   static   final   long  serialVersionUID = 1L;

     private  Integer id;
     private  String role_name;
     private  Integer role_enabled;
     private  String role_desc;

     public  Role() {
     }

     public  Integer getId() {
         return  id;
     }

     public   void  setId(Integer id) {
         this .id = id;
     }

     public  String getRole_name() {
         return  role_name;
     }

     public   void  setRole_name(String role_name) {
         this .role_name = role_name;
     }

     public  Integer getRole_enabled() {
         return  role_enabled;
     }

     public   void  setRole_enabled(Integer role_enabled) {
         this .role_enabled = role_enabled;
     }

     public  String getRole_desc() {
         return  role_desc;
     }

     public   void  setRole_desc(String role_desc) {
         this .role_desc = role_desc;
     }
 }

 

 package  com.spring.security.domain;

 import  java.io.Serializable;
 import  java.util.ArrayList;
 import  java.util.Collection;
 import  java.util.List;

 import  org.springframework.security.core.GrantedAuthority;
 import  org.springframework.security.core.authority.SimpleGrantedAuthority;
 import  org.springframework.security.core.userdetails.UserDetails;

 public   class  User  implements  UserDetails, Serializable {

     private   static   final   long  serialVersionUID = 1L;

     private  Integer id;
     private  String user_account;
     private  Integer user_enabled;
     private  String user_password;
     private  String user_desc;
     private  List<Role> roles =  new  ArrayList<Role>();

     public  User() {
     }

     public  Integer getId() {
         return  id;
     }

     public   void  setId(Integer id) {
         this .id = id;
     }

     public  String getUser_account() {
         return  user_account;
     }

     public   void  setUser_account(String user_account) {
         this .user_account = user_account;
     }

     public  Integer getUser_enabled() {
         return  user_enabled;
     }

     public   void  setUser_enabled(Integer user_enabled) {
         this .user_enabled = user_enabled;
     }

     public  String getUser_password() {
         return  user_password;
     }

     public   void  setUser_password(String user_password) {
         this .user_password = user_password;
     }

     public  String getUser_desc() {
         return  user_desc;
     }

     public   void  setUser_desc(String user_desc) {
         this .user_desc = user_desc;
     }

     public  List<Role> getRoles() {
         return  roles;
     }

     public   void  setRoles(List<Role> roles) {
         this .roles = roles;
     }

     /*
      * 获取用户权限集合,权限使用GrantedAuthority接口表示，框架中有它的实现类
      * GrantedAuthorityImpl,只需要把角色的名称放入即可 (non-Javadoc)
      *
      * @see
      * org.springframework.security.core.userdetails.UserDetails#getAuthorities
      * ()
      */
     @Override
     public  Collection<?  extends  GrantedAuthority> getAuthorities() {
         List<GrantedAuthority> list = new  ArrayList<GrantedAuthority>();
         for  (Role role : roles) {
             list.add(new  SimpleGrantedAuthority(role.getRole_name()));
         }

         return  list;
     }

     /*
      * 获取用户名 (non-Javadoc)
      *
      * @see
      * org.springframework.security.core.userdetails.UserDetails#getUsername()
      */
     @Override
     public  String getUsername() {
         // TODO Auto-generated method stub
         return   this .user_account;
     }

     /*
      * 用户密码 (non-Javadoc)
      *
      * @see
      * org.springframework.security.core.userdetails.UserDetails#getPassword()
      */
     @Override
     public  String getPassword() {
         // TODO Auto-generated method stub
         return   this .user_password;
     }

     /*
      * 直接返回true，表示没有过期 (non-Javadoc)
      *
      * @see
      * org.springframework.security.core.userdetails.UserDetails#isAccountNonExpired
      * ()
      */
     @Override
     public   boolean  isAccountNonExpired() {
         // TODO Auto-generated method stub
         return   true ;
     }

     /*
      * 直接返回true，表示没有锁定 (non-Javadoc)
      *
      * @see
      * org.springframework.security.core.userdetails.UserDetails#isAccountNonLocked
      * ()
      */
     @Override
     public   boolean  isAccountNonLocked() {
         // TODO Auto-generated method stub
         return   true ;
     }

     @Override
     public   boolean  isCredentialsNonExpired() {
         // TODO Auto-generated method stub
         return   true ;
     }

     /*
      * 是否禁用 (non-Javadoc)
      *
      * @see
      * org.springframework.security.core.userdetails.UserDetails#isEnabled()
      */
     @Override
     public   boolean  isEnabled() {
         // TODO Auto-generated method stub
         return   true ;
     }
 }

 4 用户，资源，角色DAo类的实现

 package  com.spring.security.dao.impl;

 import  java.sql.ResultSet;
 import  java.sql.SQLException;
 import  java.util.List;

 import  org.springframework.jdbc.core.BeanPropertyRowMapper;
 import  org.springframework.jdbc.core.RowMapper;
 import  org.springframework.stereotype.Repository;

 import  com.spring.security.dao.UserDao;
 import  com.spring.security.dao.support.SimpleDaoSupport;
 import  com.spring.security.domain.Role;
 import  com.spring.security.domain.User;

 @Repository ( "userDao" )
 public   class  UserDaoImpl  extends  SimpleDaoSupport  implements  UserDao {

     @Override
     public  User findUserByName(String userName) {

         String sql = "SELECT id,user_account,user_enabled,user_password,user_desc FROM pub_users where user_account=?" ;

         return   this .getSimpleJdbcTemplate().queryForObject(sql,
                 new  UserMapper(), userName);
     }

     /**
      * 获取User对象的role列表
      *
      * @param userID
      * @return RoleList
      */
     public  List<Role> getRolesByUserID(String userName) {

         String sql = "SELECT r.id,r.role_name,r.role_enabled,r.role_desc FROM pub_users u,pub_roles r,pub_users_roles ur "
                 + "WHERE u.id=ur.user_id AND r.id=ur.role_id AND u.user_account=?" ;

         return   this .getSimpleJdbcTemplate().query(sql,
                 BeanPropertyRowMapper.newInstance(Role.class ), userName);
     }

     /**
      * 定义UserMapper
      */
     protected   class  UserMapper  implements  RowMapper<User> {

         public  User mapRow(ResultSet rs,  int  rowNum)  throws  SQLException {
             User user = new  User();
             user.setId(rs.getInt("id" ));
             user.setUser_account(rs.getString("user_account" ));
             user.setUser_password(rs.getString("user_password" ));
             user.setUser_enabled(rs.getInt("user_enabled" ));
             user.setUser_desc(rs.getString("user_desc" ));

             // 调用上面的方法获取用户所有的权限
             user.setRoles(getRolesByUserID(rs.getString("user_account" )));

             return  user;
         }
     }
 }

 

 package  com.spring.security.dao.impl;

 import  java.sql.ResultSet;
 import  java.sql.SQLException;
 import  java.util.List;

 import  org.springframework.jdbc.core.RowMapper;
 import  org.springframework.stereotype.Repository;

 import  com.spring.security.dao.ResourceDao;
 import  com.spring.security.dao.support.SimpleDaoSupport;
 import  com.spring.security.domain.Resource;
 import  com.spring.security.domain.Role;

 @Repository ( "resourceDao" )
 public   class  ResourceDaoImpl  extends  SimpleDaoSupport  implements  ResourceDao {

     @Override
     public  List<Resource> getAllResource() {

         List<Resource> list = null ;
         String sql = "SELECT * from pub_resources" ;
         list = this .getSimpleJdbcTemplate().query(sql,  new  RowMapper<Resource>() {
             public  Resource mapRow(ResultSet rs,  int  arg1)  throws  SQLException {
                 Resource resource = new  Resource();
                 resource.setId(rs.getInt("id" ));
                 resource.setResource_name(rs.getString("resource_name" ));
                 resource.setResource_type(rs.getString("resource_type" ));
                 resource.setResource_string(rs.getString("resource_string" ));
                 resource.setResource_enabled(rs.getString("resource_enabled" ));
                 resource.setResource_desc(rs.getString("resource_desc" ));
                 resource.setRoles(getRoleByResourceId(resource.getId()));

                 return  resource;
             }
         });

         return  list;
     }

     private  List<Role> getRoleByResourceId( int  id) {

         String sql = "SELECT r.id,r.role_name,r.role_enabled,r.role_desc FROM pub_roles r,pub_roles_resources rr WHERE rr.role_id=r.id AND rr.resource_id=?" ;
         return   this .getSimpleJdbcTemplate().query(sql,  new  RowMapper<Role>() {
             public  Role mapRow(ResultSet rs,  int  arg1)  throws  SQLException {
                 Role role = new  Role();
                 role.setId(rs.getInt("id" ));
                 role.setRole_name(rs.getString("role_name" ));
                 role.setRole_enabled(rs.getInt("role_enabled" ));
                 role.setRole_desc(rs.getString("role_desc" ));

                 return  role;
             }
         }, new  Object[] { id });
     }
 }

 

5 spring security的配置如下：

 <? xml   version = "1.0"   encoding = "UTF-8" ?>
 < beans:beans   xmlns = "http://www.springframework.org/schema/security"
     xmlns:beans = "http://www.springframework.org/schema/beans"   xmlns:xsi = "http://www.w3.org/2001/XMLSchema-instance"
     xsi:schemaLocation ="http://www.springframework.org/schema/beans
     http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
                         http://www.springframework.org/schema/security
                         http://www.springframework.org/schema/security/spring-security-3.1.xsd">

     < global-method-security   pre-post-annotations = "enabled"   />

     <!--对登录页面不进行拦截，在页面后面加*表示，该页面后面可能会带一些参数 -->
     < http   pattern = "/login.jsp*"   security = "none"   />
     < http   pattern = "/common/**"   security = "none"   />
     < http   pattern = "/js/**"   security = "none"   />

     <!-- 保护应用程序配置一些列的权限问题，当没有权限403返回页面为403.jsp -->
     < http   auto-config = "true"   access-denied-page = "/common/403.jsp"   use-expressions = "true" >
         <!-- login-page: 指定登录页面,并指定默认的target访问地址index.jsp -->
         < form-login   login-page = "/login.jsp"   default-target-url = '/index.jsp'   always-use-default-target = 'true'   />
         <!-- 配置用户退出的默认返回页面 -->
         < logout   logout-success-url = "/login.jsp"   />
         <!-- 会话管理配置 ,设置最多登录一次，二次登录会让第一次登录失效，
          则设置error-if-maximum-exceeded为false，要求第一次有效设置为true -->
         < session-management   invalid-session-url = "/common/timeout.jsp" >
             < concurrency-control   max-sessions = "1"   error-if-maximum-exceeded = "false"   />
         </ session-management >

         <!-- 将自己的过滤器加入到过滤器链中， 放在FILTER_SECURITY_INTERCEPTOR之前 -->
         < custom-filter   ref = "customFilterSecurityInterceptor"   before = "FILTER_SECURITY_INTERCEPTOR"   />
     </ http >

     <!-- 配置自己的拦截器 -->
     < beans:bean   id = "customFilterSecurityInterceptor"
         class = "com.spring.security.service.impl.CustomFilterSecurityInterceptorImpl" >
         < beans:property   name = "authenticationManager"   ref = "autheticationManager" />
         < beans:property   name = "accessDecisionManager"   ref = "customAccessDecisionManager"   />
         <!-- resourceService在applicationContext.xml中定义 -->
         < beans:property   name = "securityMetadataSource"   ref = "customInvocationSecurityMetadataSource"   />
     </ beans:bean >

     <!--配置认证管理器 -->
     < authentication-manager   alias = "autheticationManager" >
         <!-- 使用自定义UserDetailsService -->
         < authentication-provider   user-service-ref = "customUserDetailsService" >
             < password-encoder   hash = "md5" />
         </ authentication-provider >
     </ authentication-manager >

     < beans:bean   id = "webPrivilegeEvaluator"   class = "org.springframework.security.web.access.DefaultWebInvocationPrivilegeEvaluator" >
         < beans:constructor-arg   ref = "customFilterSecurityInterceptor" />
     </ beans:bean >

    <!-- Jcaptcha相关的配置 -->
     < beans:bean   id = "captchaService"    class = "com.octo.captcha.service.image.DefaultManageableImageCaptchaService" >
         < beans:property   name = "captchaEngine" >
             < beans:bean   class = "com.spring.security.jcaptcha.GMailEngine"   />
         </ beans:property >
         <!-- 默认生成的图片180秒过期 , 可另行设置 -->
         < beans:property   name = "minGuarantedStorageDelayInSeconds"   value = "180"   />
     </ beans:bean >

 </ beans:beans >

 

 <? xml   version = "1.0"   encoding = "UTF-8" ?>
 < web-app   xmlns:xsi = "http://www.w3.org/2001/XMLSchema-instance"
     xmlns = "http://java.sun.com/xml/ns/javaee"   xmlns:web = "http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
     xsi:schemaLocation = "http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
     id = "WebApp_ID"   version = "2.5" >
     < display-name > springSecurityIII </ display-name >
     < context-param >
         < param-name > log4jConfigLocation </ param-name >
         < param-value > classpath:log4j.xml </ param-value >
     </ context-param >
     < context-param >
         < param-name > log4jRefreshInterval </ param-name >
         < param-value > 60000 </ param-value >
     </ context-param >
     < context-param >
         < param-name > contextConfigLocation </ param-name >
         < param-value > classpath:applicationContext.xml </ param-value >
     </ context-param >
     < listener >
         < listener-class > org.springframework.web.util.Log4jConfigListener </ listener-class >
     </ listener >
     < listener >
         < listener-class > org.springframework.web.context.ContextLoaderListener </ listener-class >
     </ listener >
     < listener >
         < listener-class > org.springframework.web.util.IntrospectorCleanupListener </ listener-class >
     </ listener >
     < filter >
         < filter-name > CharacterEncodingFilter </ filter-name >
         < filter-class > org.springframework.web.filter.CharacterEncodingFilter </ filter-class >
         < init-param >
             < param-name > encoding </ param-name >
             < param-value > UTF-8 </ param-value >
         </ init-param >
         < init-param >
             < param-name > forceEncoding </ param-name >
             < param-value > true </ param-value >
         </ init-param >
     </ filter >
     < filter-mapping >
         < filter-name > CharacterEncodingFilter </ filter-name >
         < url-pattern > /* </ url-pattern >
     </ filter-mapping >

     < session-config >
         < session-timeout > 30 </ session-timeout >
     </ session-config >

     <!-- JCaptcha`s filter -->
     < filter >
         < filter-name > jcaptchaFilter </ filter-name >
         < filter-class > com.spring.security.jcaptcha.JCaptchaFilter </ filter-class >
         < init-param >
             < param-name > failureUrl </ param-name >
             < param-value > /login.jsp </ param-value >
         </ init-param >
     </ filter >

     <!-- jcaptcha图片生成URL. -->
     < filter-mapping >
         < filter-name > jcaptchaFilter </ filter-name >
         < url-pattern > /jcaptcha.jpg </ url-pattern >
     </ filter-mapping >

     <!-- jcaptcha登录表单处理URL. 必须放在springSecurityFilter的filter-mapping定义之前 -->
     < filter-mapping >
         < filter-name > jcaptchaFilter </ filter-name >
         < url-pattern > /j_spring_security_check </ url-pattern >
     </ filter-mapping >

     < filter >
         < filter-name > springSecurityFilterChain </ filter-name >
         < filter-class > org.springframework.web.filter.DelegatingFilterProxy </ filter-class >
     </ filter >
     < filter-mapping >
         < filter-name > springSecurityFilterChain </ filter-name >
         < url-pattern > /* </ url-pattern >
     </ filter-mapping >

     < listener >
         < listener-class > org.springframework.security.web.session.HttpSessionEventPublisher </ listener-class >
     </ listener >

     < welcome-file-list >
         < welcome-file > index.jsp </ welcome-file >
     </ welcome-file-list >
 </ web-app >

 

 

 

6、其他页面保持不变，进行访问页面如下：

 

 

 admin用户点击admin页面

 切换user用户登入页面进入

 

 点击admin页面，用户访问被拒绝

总结： 这种方法虽然将用户、角色、资源存放到数据库中，但spring security 中<sec:authorize url> tag 的隐藏功能消失，这需要自己去定义类似标签去自行控制。

 

要想在真正在企业中做到很好的控制，其设计会更复杂，下面是基于RBAC设计的数据库