用户登录权限管理LDAP两种配置参考文档(spring-security和shiro)
序：这里主要对springmvc 项目中用spring-security和shiro两种连接LDAP的配置做说明
用来实现ldap对用户登录及权限的管理
一：spring security方式
（1）配置web.xml和导jar包：这里用maven 导入(spring-ldap-core spring-ldap-core-tiger spring-security-ldap spring-security-core spring-security-web spring-security-config spring-security-taglibs，这些都是1.31版本的jar)
可能有些包不用，但是我都加了 (礼多人不怪)
在web.xml里加入如下
<filter>
<filter-name>springSecurityFilterChain</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
<filter-name>springSecurityFilterChain</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
(2).配置spring-security文件
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:s="http://www.springframework.org/schema/security" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd">
<s:http>
<!--
<s:intercept-url pattern="/testttt" access="ROLE_ADMIN" /> -->
<s:intercept-url pattern="/admin/**" access="ROLE_USER" /> <!—所有请求admin开头的都必须是ROLE_USER角色的用户
<s:intercept-url pattern="/captcha-image"
access="IS_AUTHENTICATED_ANONYMOUSLY" /> <!—若请求captcha-image,则不做验证
<s:anonymous />
<!- 配置一个自定义的登录拦截器，因为默认的登录拦截器不能为我们处理验证码等其他登录问题-
<s:custom-filter position="FORM_LOGIN_FILTER" ref="authenticationFilter" />
<!--访问登录拦截器 -->
<s:http-basic entry-point-ref="authenticationEntryPoint" />
<!-- 单点登录配置 -->
<s:custom-filter position="CONCURRENT_SESSION_FILTER" ref="concurrencyFilter" />
<s:session-management session-authentication-strategy-ref="sas" />
<!-- 没有权限不够角色时访问某个资源 处理的配置 -->
<s:access-denied-handler ref="accessDeniedHandler"/>
</s:http>
<!-进行登录认证配置 authenticationManager 比较重要-
<s:authentication-manager alias="authenticationManager">
<s:ldap-authentication-provider
group-search-filter="member={0}" group-search-base="ou=groups"
user-search-base="ou=people" user-search-filter="uid={0}" />
<s:authentication-provider ref='secondLdapProvider' />
</s:authentication-manager>
<!-- 401 密码错误 403 没有权限 404 页面没找到 413 上传的文件或数据过大 -->
<!-- 此为权限不够角色，登录失败时异常拦截器 -->
<bean id="exceptionTranslationFilter"
class="org.springframework.security.web.access.ExceptionTranslationFilter">
<property name="authenticationEntryPoint" ref="authenticationEntryPoint" />
<property name="accessDeniedHandler" ref="accessDeniedHandler" />
</bean>
<!-- 登录页面入口 -->
<bean id="authenticationEntryPoint"
class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint">
<property name="loginFormUrl" value="/sign_in" />
</bean>
<!-- 在没有权限不够角色访问此资源时跳转入口 -->
<bean id="accessDeniedHandler"
class="org.springframework.security.web.access.AccessDeniedHandlerImpl">
<property name="errorPage" value="/authority.html" />
</bean>
<!-调用自定义登录拦截器MySpecialAuthenticationFilter，并配置 authenticationManager登录认证及其他认证-
<bean id="authenticationFilter" class="com.zqgame.util.MySpecialAuthenticationFilter">
<property name="authenticationManager" ref="authenticationManager" />
<!-- 调用单点登录认证配置 -->
<property name="sessionAuthenticationStrategy" ref="sas" />
<property name="filterProcessesUrl" value="/auth" /><!-- 调用处理登录的action -->
<property name="authenticationSuccessHandler" ref="successHandler" /><!--
调用登录认证成功后的处理 -->
<property name="authenticationFailureHandler" ref="simpleUrlAuthenticationFailureHandler" /><!--
调用登录失败后的处理配置 -->
</bean>
<!--登录认证成功后的处理
<bean id="successHandler"
class="org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler">
<property name="defaultTargetUrl" value="/body/adminmain" />
</bean>
<!--登录失败后的处理配置
<bean id="simpleUrlAuthenticationFailureHandler"
class="org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler">
<property name="defaultFailureUrl" value="/login_error" />
</bean>
<!-- 单点登录配置 begin -->
<bean id="concurrencyFilter"
class="org.springframework.security.web.session.ConcurrentSessionFilter">
<property name="sessionRegistry" ref="sessionRegistry" />
<property name="expiredUrl" value="/session-expired.html" />
</bean>
<bean id="sas"
class="org.springframework.security.web.authentication.session.ConcurrentSessionControlStrategy">
<constructor-arg name="sessionRegistry" ref="sessionRegistry" />
<property name="maximumSessions" value="1" />
</bean>
<bean id="sessionRegistry" class="org.springframework.security.core.session.SessionRegistryImpl" />
<!-- 单点登录配置 end -->
<!-下面就是根据自己所要连接的ldap具体情况来做ldap的本身配置了-
<bean id="contextSource"
class="org.springframework.security.ldap.DefaultSpringSecurityContextSource">
<constructor-arg value="ldap://180.96.13.102:389/dc=zqgame,dc=com" />
</bean>
<bean id="secondLdapProvider"
class="org.springframework.security.ldap.authentication.LdapAuthenticationProvider">
<constructor-arg>
<bean
class="org.springframework.security.ldap.authentication.BindAuthenticator">
<constructor-arg ref="contextSource" />
<property name="userSearch">
<bean id="userSearch"
class="org.springframework.security.ldap.search.FilterBasedLdapUserSearch">
<constructor-arg index="0" value="ou=people" />
<constructor-arg index="1" value="(uid={0})" />
<constructor-arg index="2" ref="contextSource" />
</bean>
</property>
</bean>
</constructor-arg>
<constructor-arg>
<bean
class="org.springframework.security.ldap.userdetails.DefaultLdapAuthoritiesPopulator">
<constructor-arg ref="contextSource" />
<constructor-arg value="ou=groups" />
<property name="groupSearchFilter" value="(member={0})" />
<property name="rolePrefix" value="ROLE_" />
<property name="searchSubtree" value="true" />
<property name="convertToUpperCase" value="true" />
</bean>
</constructor-arg>
</bean>
</beans>
(3) 自定义拦截器com.zqgame.util.MySpecialAuthenticationFilter
这个拦截器就是做ldap登录认证的，里面包括了一些用户输入信息正确性判断和验证码判断（所有不能登录情况都是异常捕获）AuthenticationServiceException会根据上面的配置文件中登录错误的配置而跳转
package com.zqgame.util;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.apache.commons.lang.StringUtils;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter;
public class MySpecialAuthenticationFilter extends AbstractAuthenticationProcessingFilter{
public MySpecialAuthenticationFilter() {
super("/auth");//这个auth就是外面要访问这个拦截器的入口
}
public MySpecialAuthenticationFilter(String defaultFilterProcessesUrl) {
super("/auth");
}
public static final String SPRING_SECURITY_FORM_USERNAME_KEY = "j_username";
public static final String SPRING_SECURITY_FORM_PASSWORD_KEY = "j_password";
private String usernameParameter = SPRING_SECURITY_FORM_USERNAME_KEY;
private String passwordParameter = SPRING_SECURITY_FORM_PASSWORD_KEY;
public Authentication attemptAuthentication(HttpServletRequest request,
HttpServletResponse response) throws AuthenticationException {
HttpSession session = request.getSession();
String username = obtainUsername(request);
String password = obtainPassword(request);
String catchImage = request.getParameter("captcha");//验证码
//判断用户名登录密码是否为空
if (StringUtils.isEmpty(username) || StringUtils.isEmpty(password)) {
session.setAttribute("loginError", "请输入用户名或者密码！");
throw new AuthenticationServiceException("j_username or j_password is not null!"); //跳转到login_error下
}
// 从session中获得验证码，与用户输入的验证码做比较
String sessionCaptcha = (String) session.getAttribute(Constant.CAPTCHA);
if (StringUtils.isEmpty(catchImage) || StringUtils.isEmpty(sessionCaptcha)) {
session.setAttribute("loginError", "验证码为空!");
throw new AuthenticationServiceException("the session captcha is not null!");//跳转到login_error下
}
session.removeAttribute(Constant.CAPTCHA);// 清空Sesion里的验证码
//验证码输入校验
if (!sessionCaptcha.equalsIgnoreCase(catchImage)) {
session.setAttribute("loginError", "验证码输入错误!");
throw new AuthenticationServiceException("the captcha is error!");//跳转到login_error下
}
UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(
username, password);
setDetails(request, authRequest);
Authentication authen = null;
//执行ldap的登录验证
try {
authen = this.getAuthenticationManager().authenticate(authRequest);
} catch (AuthenticationException failed) {
session.setAttribute("loginError", "用户名或密码错误!");
throw new AuthenticationServiceException("the captcha is error!");//跳转到login_error
}
session.setAttribute("managerSession", username);
return authen;
}
protected String obtainPassword(HttpServletRequest request) {
return request.getParameter(passwordParameter);
}
protected String obtainUsername(HttpServletRequest request) {
return request.getParameter(usernameParameter);
}
protected void setDetails(HttpServletRequest request, UsernamePasswordAuthenticationToken authRequest) {
authRequest.setDetails(authenticationDetailsSource.buildDetails(request));
}
}
(4)登录Action类
package com.zqgame.controllers.admin;
import javax.servlet.ServletOutputStream;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;
import javax.validation.Valid;
import org.apache.commons.lang3.StringUtils;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler;
import org.springframework.stereotype.Controller;
import org.springframework.ui.Model;
import org.springframework.validation.BindingResult;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;
import com.zqgame.common.Constant;
import com.zqgame.models.SignIn;
import com.zqgame.services.UserService;
import com.zqgame.util.Digest;
/**
* 后台登录控制器
* @author User
*/
@Controller
public class SessionsController{
/**
* 进入登录页面
* @return
*/
@RequestMapping(value = "/sign_in", method = RequestMethod.GET)
public String newForm(Model model) {
return "admin/sessions/new";
}
/**
* 登录错误
* @return
*/
@RequestMapping(value = "/login_error", method = RequestMethod.GET)
public String loginError(Model model) {
return "admin/sessions/new";
}
/**
* 退出登录 logout() 销毁会话
* @param request
* @return
*/
@RequestMapping(value = "signout")
public void signOut(HttpServletRequest request, HttpServletResponse response) {
try {
SecurityContextLogoutHandler securityLogout = new SecurityContextLogoutHandler();
securityLogout.logout(request, response, null);
request.getRequestDispatcher(
"WEB-INF/views/admin/sessions/loginout.jsp").forward(
request, response);
} catch (Exception e) {
e.printStackTrace();
}
}
}
(5)登录jsp页面form部分
<form action="/auth" id="loginForm" method="post"> //auth就是那个自定义拦截器的访问路径,而不是去action
<div class="box">
<c:if test="${!empty sessionScope.loginError}">
<fmt:message key='${sessionScope.loginError}' />
<c:remove var="loginError" scope="session" />//删除session中存储的错误提示
用户：<input type="text" class="inp1" name="j_username" id="username" size="12" maxlength="50" value="${signIn.j_username}"/>
<br>
密码：<input type="password" class="inp2" name="j_password" id="password" size="12" maxlength="50"/>
<br>
验证码:<input type="text" name="captcha" id="captcha" class="login_input required" MaxLength="6" style="width:55px;text-transform:uppercase;"/>
<br>这个验证码具体怎么生成的这里不做说明
<input type="submit">登 录</input>
</form>
上面就是整个LDAP与spring-security的配置了，当然这里只是我自己的处理方式，可能还有很多不好的地方，希望拍砖
二．Shiro 方式
（1）配置web.xml和导包(shiro-core shiro-web shiro-spring cglib-nodep 版本1.2.0)
Web.xml里加入
<filter>
<filter-name>shiroFilter</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
<init-param>
<param-name>targetFilterLifecycle</param-name>
<param-value>true</param-value>
</init-param>
</filter>
<filter-mapping>
<filter-name>shiroFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
(2)Shiro配置文件（文档里有注释，这个配置文件基本上不用改啥）
<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:context="http://www.springframework.org/schema/context"
xsi:schemaLocation="http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.1.xsd">
<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
<property name="securityManager" ref="securityManager" />
<property name="loginUrl" value="/sign_in"/>
<property name="successUrl" value="/body/adminmain"/>
<property name="filterChainDefinitions"><!—配置请求需要处理方式
<value>
/sign_in = anon
/admin/** = authc <!--admin的url全部要能够被验证通过-->
/sign_up = anon
/captcha-image = anon
/sessions/** = anon
</value>
</property>
</bean>
<bean id="sha512Matcher" class="org.apache.shiro.authc.credential.HashedCredentialsMatcher">
<property name="hashAlgorithmName" value="${shiro.hashAlgorithmName}" />
<property name="storedCredentialsHexEncoded" value="${shiro.storedCredentialsHexEncoded}" />
<property name="hashIterations" value="${shiro.hashIterations}" />
</bean>
<bean id="openldapRealm" class="org.apache.shiro.realm.ldap.JndiLdapRealm">
<!-配置登录认证访问ldap的树域-
<property name="userDnTemplate" value="cn={0},dc=zqgame,dc=com"/>
<property name="contextFactory" ref="contextFactory" />
</bean>
<!-配置ldap路径及配置一个默认的用户和密码-
<bean id="contextFactory" class="org.apache.shiro.realm.ldap.JndiLdapContextFactory">
<property name="url" value="ldap://180.96.13.102:389/??sub"/>
<property name="systemUsername" value="ldapuser"/>
<property name="systemPassword" value="zqgame.com"/>
</bean>
<bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
<property name="realm" ref="openldapRealm" />
<property name="sessionMode" value="native"/>
</bean>
<bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor" /> <bean class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator" depends-on="lifecycleBeanPostProcessor"/>
<bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
<property name="securityManager" ref="securityManager"/>
</bean>
</beans>
(3)登录action(这里action不用那么麻烦，所以这里就把登录的action和退出的action写上吧)
/*执行登录*/
public String create(@Valid SignIn signIn, BindingResult result, HttpSession session, Model model) {
if (result.hasErrors()) {
model.addAttribute("loginError", "请输入内容!");
model.addAttribute("signIn", signIn);
return "admin/sessions/new";
}
//从session中获得验证码
String sessionCaptcha = (String) session.getAttribute(Constant.CAPTCHA);
if(StringUtils.isEmpty(sessionCaptcha)) {
model.addAttribute("loginError", "session里的验证码为空!");
return "admin/sessions/new";
}
session.removeAttribute(Constant.CAPTCHA);//清空验证码
if(!sessionCaptcha.equalsIgnoreCase(signIn.getCaptcha())) {
model.addAttribute("loginError", "验证码输入错误!");
return "admin/sessions/new";
}
/*shiro执行ldap登录认证*/
UsernamePasswordToken token = new UsernamePasswordToken(signIn.getUsername(), signIn.getPassword());
token.setRememberMe(true);
Subject currentUser = SecurityUtils.getSubject();
try {
currentUser.login(token);
session.setAttribute(Constant.MANAGER_SESSION, signIn.getUsername());
}catch (Exception ice) {
result.reject("mismatch.signIn.password");
//password didn't match, try again?
}
if (currentUser.isAuthenticated()) {//登录成功进入主页
return "redirect:/body/adminmain";
}
model.addAttribute("loginError", "您输入的用户名或密码错误!");
return "admin/sessions/new";
}
/**
* 退出登录
* logout() 销毁回话
* @return
*/
@RequestMapping(value = "signout", method = RequestMethod.GET)
public void signOut(HttpServletRequest request, HttpServletResponse response) {
SecurityUtils.getSubject().logout();
try {
request.getRequestDispatcher("WEB-INF/views/admin/sessions/loginout.jsp").forward(request, response);
} catch (ServletException e) {
e.printStackTrace();
} catch (IOException e) {
e.printStackTrace();
}
}
到此两种方式都可以使用了，至于那个配置文件，可以把他放到web.xml里加载就行，就跟加载spring的文件一样就行
另：ldap本身的性质还在研究，不会哦