spring security 学习

转载文章，学习

 

Springside 3.3.1中权限控制用的是用户－角色－授权的方式。相应的建立了三张表
acct_authority     权限表
acct_role         角色表
acct_role_authority 角色权限关系表
acct_user          用户表
acct_user_role      用户角色关系表

spring security 设计了一个<http>标签用来配置url与 授权 的关系
applicationContext-security.xml:

 <description>SpringSecurity安全配置</description>
     <!-- http安全配置 -->
     <!-- auto-config属性其实是<form-login/>,<http-basic/>,<logout/>的缩写.
          没配置登录页面的情况下，spring自动生成一个. -->
     <s:http auto-config= "true"  use-expressions= "true" >
         <s:intercept-url pattern= "/css/**"  filters= "none"  />
         <s:intercept-url pattern= "/img/**"  filters= "none"  />
         <s:intercept-url pattern= "/js/**"  filters= "none"  />
     <!-- 设置通过这个url需要什么样的权限  -->
         <s:intercept-url pattern= "/account/user!save*"  access= "hasAnyRole('ROLE_修改用户')"  />
         <s:intercept-url pattern= "/account/user!delete*"  access= "hasAnyRole('ROLE_修改用户')"  />
         <s:intercept-url pattern= "/account/user*"  access= "hasAnyRole('ROLE_浏览用户')"  />
         <s:intercept-url pattern= "/account/role!save*"  access= "hasAnyRole('ROLE_修改角色')"  />
         <s:intercept-url pattern= "/account/role!delete*"  access= "hasAnyRole('ROLE_修改角色')"  />
         <s:intercept-url pattern= "/account/role*"  access= "hasAnyRole('ROLE_浏览角色')"  />
     <!-- < s:intercept-url pattern= '/login.htm*'  filters= 'none' />这个标签是把验证排除在外。因为这是一个登录页面。
         而s:form-login标签的login-page则指定遇到受限资源需要进行登录时候的页面.
          default -target-url指定了从登录页面登录后进行跳转的页面
         always-use- default -target这个属性表示登录成功后强制跳转到 default -target-url这个地址。默认情况下如果是从首先页面过来登录的，那么跳转是跳转回受限页面。 -->
         <s:form-login login-page= "/login.action"   default -target-url= "/account/role.action"  authentication-failure-url= "/login.action?error=true"   always-use- default -target = "ture" />
         <s:logout logout-success-url= "/"  />
     </s:http>

<description>SpringSecurity安全配置</description>
	<!-- http安全配置 -->
	<!-- auto-config属性其实是<form-login/>,<http-basic/>,<logout/>的缩写.
		 没配置登录页面的情况下，spring自动生成一个. -->
	<s:http auto-config="true" use-expressions="true">
		<s:intercept-url pattern="/css/**" filters="none" />
		<s:intercept-url pattern="/img/**" filters="none" />
		<s:intercept-url pattern="/js/**" filters="none" />
	<!-- 设置通过这个url需要什么样的权限  -->
	    <s:intercept-url pattern="/account/user!save*" access="hasAnyRole('ROLE_修改用户')" />
		<s:intercept-url pattern="/account/user!delete*" access="hasAnyRole('ROLE_修改用户')" />
		<s:intercept-url pattern="/account/user*" access="hasAnyRole('ROLE_浏览用户')" />
	    <s:intercept-url pattern="/account/role!save*" access="hasAnyRole('ROLE_修改角色')" />
		<s:intercept-url pattern="/account/role!delete*" access="hasAnyRole('ROLE_修改角色')" />
		<s:intercept-url pattern="/account/role*" access="hasAnyRole('ROLE_浏览角色')" />
	<!-- < s:intercept-url pattern='/login.htm*' filters='none'/>这个标签是把验证排除在外。因为这是一个登录页面。
		而s:form-login标签的login-page则指定遇到受限资源需要进行登录时候的页面.
		default-target-url指定了从登录页面登录后进行跳转的页面
		always-use-default-target这个属性表示登录成功后强制跳转到default-target-url这个地址。默认情况下如果是从首先页面过来登录的，那么跳转是跳转回受限页面。 -->
		<s:form-login login-page="/login.action" default-target-url="/account/role.action" authentication-failure-url="/login.action?error=true"  always-use-default-target ="ture"/>
		<s:logout logout-success-url="/" />
	</s:http>

要实现数据库与spring security的结合,我们必需实现UserDetailsService接口中的loadUserByUsername(String username)方法,此方法返回一个org.springframework.security.core.userdetails.User对象.因此,怎么样设计数据库都可以,不管我们是用一个表还是两个表或者说是三个表都可以,也不管我们是用户-授权,还是用户-角色-授权,或者是用户-用户组-角色-授权,这些spring security都不关心,它只关心返回的那个User对角.至于怎么样去查询数据库那就是我们的事了.
Springside 3.3.1 mini-web 中的UserDetailsServiceImpl类:

 /**
  * 实现SpringSecurity的UserDetailsService接口,实现获取用户Detail信息的回调函数.
  *
  * @author calvin
  */
 @Transactional (readOnly =  true )
 public   class  UserDetailsServiceImpl  implements  UserDetailsService {

      private  AccountManager accountManager;
      /**
      * 获取用户Details信息的回调函数.
      */
      public  UserDetails loadUserByUsername(String username)  throws  UsernameNotFoundException, DataAccessException {

         User user = accountManager.findUserByLoginName(username);
          if  (user ==  null ) {
              throw   new  UsernameNotFoundException( "用户"  + username +  " 不存在" );
         }

         Set<GrantedAuthority> grantedAuths = obtainGrantedAuthorities(user);

 //      System.out.println(grantedAuths);

          //-- mini-web示例中无以下属性, 暂时全部设为true. --//
          boolean  enabled =  true ;
          boolean  accountNonExpired =  true ;
          boolean  credentialsNonExpired =  true ;
          boolean  accountNonLocked =  true ;

         UserDetails userdetails =  new  org.springframework.security.core.userdetails.User(user.getLoginName(), user
                 .getPassword(), enabled, accountNonExpired, credentialsNonExpired, accountNonLocked, grantedAuths);

          return  userdetails;
     }
      /**
      * 获得用户所有角色的权限集合.
      */
      private  Set<GrantedAuthority> obtainGrantedAuthorities(User user) {
         Set<GrantedAuthority> authSet = Sets.newHashSet();
          for  (Role role : user.getRoleList()) {
              for  (Authority authority : role.getAuthorityList()) {
                 authSet.add( new  GrantedAuthorityImpl(authority.getPrefixedName()));
             }
         }
          return  authSet;
     }
      @Autowired
      public   void  setAccountManager(AccountManager accountManager) {
          this .accountManager = accountManager;
     }
 }

/**
 * 实现SpringSecurity的UserDetailsService接口,实现获取用户Detail信息的回调函数.
 * 
 * @author calvin
 */
@Transactional(readOnly = true)
public class UserDetailsServiceImpl implements UserDetailsService {

	private AccountManager accountManager;
	/**
	 * 获取用户Details信息的回调函数.
	 */
	public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException, DataAccessException {

		User user = accountManager.findUserByLoginName(username);
		if (user == null) {
			throw new UsernameNotFoundException("用户" + username + " 不存在");
		}

		Set<GrantedAuthority> grantedAuths = obtainGrantedAuthorities(user);
		
//		System.out.println(grantedAuths);

		//-- mini-web示例中无以下属性, 暂时全部设为true. --//
		boolean enabled = true;
		boolean accountNonExpired = true;
		boolean credentialsNonExpired = true;
		boolean accountNonLocked = true;

		UserDetails userdetails = new org.springframework.security.core.userdetails.User(user.getLoginName(), user
				.getPassword(), enabled, accountNonExpired, credentialsNonExpired, accountNonLocked, grantedAuths);
		
		return userdetails;
	}
	/**
	 * 获得用户所有角色的权限集合.
	 */
	private Set<GrantedAuthority> obtainGrantedAuthorities(User user) {
		Set<GrantedAuthority> authSet = Sets.newHashSet();
		for (Role role : user.getRoleList()) {
			for (Authority authority : role.getAuthorityList()) {
				authSet.add(new GrantedAuthorityImpl(authority.getPrefixedName()));
			}
		}
		return authSet;
	}
	@Autowired
	public void setAccountManager(AccountManager accountManager) {
		this.accountManager = accountManager;
	}
}

最后在applicationContext-security.xml配置保用userDetailsService类提供的用户信息认证

 <!-- 认证配置, 使用userDetailsService提供的用户信息 -->
 <s:authentication-manager alias= "authenticationManager" >
         <s:authentication-provider user-service-ref= "userDetailsService" >
             <s:password-encoder hash= "plaintext"  />
         </s:authentication-provider>
     </s:authentication-manager>

     <!-- 项目实现的用户查询服务 -->
     <bean id= "userDetailsService"   class = "org.springside.examples.miniweb.service.account.UserDetailsServiceImpl"  />
 </beans>

<!-- 认证配置, 使用userDetailsService提供的用户信息 -->
<s:authentication-manager alias="authenticationManager">
		<s:authentication-provider user-service-ref="userDetailsService">
			<s:password-encoder hash="plaintext" />
		</s:authentication-provider>
	</s:authentication-manager>

	<!-- 项目实现的用户查询服务 -->
	<bean id="userDetailsService" class="org.springside.examples.miniweb.service.account.UserDetailsServiceImpl" />
</beans>

以上实现了对url的仅限访问.
如果对部方url中的具体操作作认证,则可以在页面使用标签:

 <security:authorize ifAnyGranted= "ROLE_浏览角色" >
     <security:authorize ifNotGranted= "ROLE_修改角色" >
         <a href= "role!input.action?id=${id}" >查看</a>
     </security:authorize>
 </security:authorize>

<security:authorize ifAnyGranted="ROLE_浏览角色">
	<security:authorize ifNotGranted="ROLE_修改角色">
		<a href="role!input.action?id=${id}">查看</a>
	</security:authorize>
</security:authorize>

在web.xml中配置spring security 的上下文

 <!-- SpringSecurity filter-->
     <filter>
         <filter-name>springSecurityFilterChain</filter-name>
     <filter- class >org.springframework.web.filter.DelegatingFilterProxy</filter- class >
     </filter>

 <!-- Filter 映射 -->
     <filter-mapping>
         <filter-name>springSecurityFilterChain</filter-name>
         <url-pattern>/*</url-pattern>
     </filter-mapping>

<!-- SpringSecurity filter-->
	<filter>
		<filter-name>springSecurityFilterChain</filter-name>
	<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
	</filter>

<!-- Filter 映射 -->
	<filter-mapping>
		<filter-name>springSecurityFilterChain</filter-name>
		<url-pattern>/*</url-pattern>
	</filter-mapping>

程序跳转流程:
用户输入用户名和密码,程序通过web.xml中配置的springsecurity上下文到applicationContext-security.xml中找到认证处理类   userdetailsService类,
在 loadUserByUsername(String username)方法,程序去查找到用户,再通过用户找到它所属的角色,再通过角色找到它所拥有的权限.再将这些信息封装成org.springframework.security.core.userdetails.User对象返回.如果在查找当中用户不存在, 程序会通过applicationContext-security.xml配置文件中的 <s:http>标签中的<s:form-login >中的authentication-failure-url 属性值返回给用户,如果验证通过则返回default-target-url属性值给用户.用户在使用程序时,程序会通过applicationContext-security.xml文件中将<s:http> 标签中的<s:intercept-url> 中url所需要的权限与用户的权限作对比,如果用户拥有此权限,则会直接进行跳转,如果没有权限,则返回<s:http>标签中的<s:form-login >中的authentication-failure-url 属性值.