权限管理系统 Spring-authority

是由 spring+springmvc+hibernate+spring-security +easyui +boostrap 写的一个框架集合，目前实现了一个基础的权限管理系统，权限是基于细粒度的过滤，对于初学权限设计的人来说也算是个最简洁的权限实现，基于它来做项目，它只是做了一些绝大部分项目都应该做的一些基础功能。

1参考资料 

http://blog.csdn.net/k10509806/article/details/6369131

http://www.cnblogs.com/wenxiu/archive/2011/01/22/1942084.html

http://ootabc.iteye.com/blog/688213

http://wenku.baidu.com/view/abf23846336c1eb91a375d83.html

http://www.cnblogs.com/zhangliang0115/archive/2012/04/02/2429584.html

http://aokunsang.iteye.com/blog/1638558

2.数据库建表

采用基于角色-资源-用户-权限管理设计。

      2.1.权限表    sys_authorities

       

    2.2.权限资源表    sys_authorities_resources

     

   2.3.菜单表    sys_menus

      

   2.4.资源表   sys_resources

    

   2.4.角色菜单表   sys_role_menu

   2.5 角色表   sys_roles

     

  2.5 角色权限表    sys_roles_anthorities

  

 2.6  用户表   sys_users

   

2.6  用户角色表   sys_users_roles：

3.梳理资料，整理思路

3.1.Spring Security3.1的2种常见方式

 1.  用户信息和权限存储于数据库，而资源和权限的对应采用硬编码配置。

2.  细分角色和权限，并将角色、用户、资源、权限均都存储于数据库中。并且自定义过滤器，代替原来的FilterSecurityInterceptor过滤 器；并分别实现AccessDecisionManager、UserDetailsService和 InvocationSecurityMetadataSourceService，并在配置文件中进行相应配置。

 

4.代码整理

 

接下来开始着手代码编写，不管是两种实现方式中的哪种方式，个人感觉都需要把加载用户信息放在一个类里面管理，直观方便，结构清晰，不要用在配置文件直接写sql语句。

4.1.资源和权限对应写在配置文件中

      1、     web.xml配置

<?xml version="1.0" encoding="UTF-8"?>
<web-app version="3.0" xmlns="http://java.sun.com/xml/ns/javaee"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xsi:schemaLocation="http://java.sun.com/xml/ns/javaee 
	http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd">
	<display-name></display-name>

	<context-param>
		<param-name>log4jConfigLocation</param-name>
		<param-value>/WEB-INF/log4j.properties</param-value>
	</context-param>
	<context-param>
		<param-name>log4jRefreshInterval</param-name>
		<param-value>600000</param-value>
	</context-param>
	<context-param>
		<param-name>webAppRootKey</param-name>
		<param-value>webPath</param-value>
	</context-param>
	<listener>
		<listener-class>org.springframework.web.util.Log4jConfigListener</listener-class>
	</listener>
	<filter>
		<filter-name>encodingFilter</filter-name>
		<filter-class>org.springframework.web.filter.CharacterEncodingFilter</filter-class>
		<init-param>
			<param-name>encoding</param-name>
			<param-value>UTF-8</param-value>
		</init-param>
		<init-param>
			<param-name>forceEncoding</param-name>
			<param-value>true</param-value>
		</init-param>
	</filter>
	<filter>
		<filter-name>springSecurityFilterChain</filter-name>
		<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
	</filter>
	<filter-mapping>
		<filter-name>springSecurityFilterChain</filter-name>
		<url-pattern>/*</url-pattern>
	</filter-mapping>
	<filter-mapping>
		<filter-name>encodingFilter</filter-name>
		<url-pattern>/*</url-pattern>
	</filter-mapping>


	<listener>
		<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
	</listener>
	
	<context-param>
		<param-name>contextConfigLocation</param-name>
		<param-value>classpath*:applicationContext.xml</param-value>
	</context-param>
	<servlet>
		<servlet-name>dispatcher</servlet-name>
		<servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
		<load-on-startup>1</load-on-startup>
	</servlet>
	<servlet-mapping>
		<servlet-name>dispatcher</servlet-name>
		<url-pattern>/</url-pattern>
	</servlet-mapping>

	<welcome-file-list>
		<welcome-file>/WEB-INF/jsp/common/login.jsp</welcome-file>
	</welcome-file-list>
	<session-config>
		<session-timeout>60</session-timeout>
	</session-config>
</web-app>

Xml代码  
  2、  application-security.xml文件的配置。application-servlet.xml配置不懂的参考spring MVC搭建全程。

Java代码  收藏代码

 

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xmlns:security="http://www.springframework.org/schema/security"
       xmlns:beans="http://www.springframework.org/schema/beans"
       xsi:schemaLocation="http://www.springframework.org/schema/beans
       http://www.springframework.org/schema/beans/spring-beans.xsd
       http://www.springframework.org/schema/security
       http://www.springframework.org/schema/security/spring-security.xsd">
       
       
    <security:http security="none" pattern="/public/**"/>
    <security:http security="none" pattern="/login*"/>
    <security:http security="none" pattern="/maxSessionError*"/>
    <security:http security="none" pattern="/forbidden*"/>
    <security:http use-expressions="true">
        <security:intercept-url pattern="/**" access="isAuthenticated()"/>
        <security:form-login login-page="/login"
                             default-target-url="/home"
                             authentication-failure-url="/login"
                             authentication-success-handler-ref="loginSuccessHandler"
        />
        <security:logout  invalidate-session="true"  delete-cookies="true" success-handler-ref="logoutSuccessHandler" />
        <security:access-denied-handler error-page="/forbidden"/>
        <security:session-management session-fixation-protection="newSession" >
            <security:concurrency-control max-sessions="1" error-if-maximum-exceeded="false"  expired-url="/maxSessionError" />
        </security:session-management>
        
        <security:custom-filter ref="myFilter" before="FILTER_SECURITY_INTERCEPTOR" />
    </security:http>

    <!--用户权限管理-->
    <security:authentication-manager alias="authenticationManager"  >
        <security:authentication-provider user-service-ref="userInfoProvider" >
            <security:password-encoder hash="md5" base64="true"/>
        </security:authentication-provider>
    </security:authentication-manager>


    <!--过滤器-->
    <beans:bean id="myFilter" class="com.authority.filter.MyFilterSecurityInterceptor">
        <beans:property name="authenticationManager" ref="authenticationManager"/>
        <beans:property name="accessDecisionManager"  ref="myAccessDesisionmanager"/>
        <beans:property name="securityMetadataSource" ref="mySecurityMetadataSource"/>
    </beans:bean>
    
    <!--访问决策-->
    <bean id="myAccessDesisionmanager" class="com.authority.filter.MyAccessDesisionmanager" />
    
    <!--用户信息Provider-->
    <bean id="userInfoProvider" class="com.authority.service.impl.UserInfoServiceImpl" />
    
    <!--登陆成功-->
    <bean id="loginSuccessHandler" class="com.authority.handler.MyLoginSuccessHandler" />
    <!--退出登录-->
    <bean id="logoutSuccessHandler" class="com.authority.handler.MyLogoutSuccessHandler" />

    <!--系统资源管理-->
    <bean id="mySecurityMetadataSource" class="com.authority.filter.MySecurityMetadataSource" >
    </bean>
    
    <!--登陆失败-->
    <bean id="loginFailHandler" class="com.authority.handler.MyLoginFailHandler"/>

</beans>

1.系统实现了基于URL的权限管理，页面操作控制到按钮级别，根据权限配置进行显示，并在拦截器再次认证，只有分配权限后才能进行操作

页面效果图：

 

 

 

源码分享：

   http://git.oschina.net/gz-tony/spring-authority/