spring security 3中的10个典型用法小结

spring security 3比较庞大，但功能很强，下面小结下spring security 3中值得 

注意的10个典型用法 

1）多个authentication-provide可以同时使用 

<authentication-manager alias='authenticationManager'>
  <authentication-provider>
   <user-service>
    <user authorities='ROLE_GUEST' name='guest' password=''/>
   </user-service>
  </authentication-provider>
  <authentication-provider>
   <jdbc-user-service data-source-ref='dataSource'/>
  </authentication-provider>
 </authentication-manager>

2 传统的<security:http> 
 

<security:http>
 <security:intercept-url pattern='/admin/**' access='hasRole('ROLE_ADMIN')'/>
 <security:intercept-url pattern='/account/**' access='hasRole('ROLE_USER')' />
 <security:intercept-url pattern='/**' access='hasRole('ROLE_ANONYMOUS')' />
 <!-- other elements removed for clarity -->
</security:http>

3 可以使用一大堆密码加密器： 
   aseDigestPasswordEncoder 
BasePasswordEncoder 
LdapShaPasswordEncoder 
Md4PasswordEncoder, 
Md5PasswordEncoder 
MessageDigestPasswordEncoder 
MessageDigestPasswordEncoder 
PlaintextPasswordEncoder 
ShaPasswordEncoder 

4 SPRING security的标签 
  

<sec:authorize access='hasRole('supervisor')'>
This content will only be visible to users who have
the 'supervisor' authority in their list of <tt>GrantedAuthority</tt>s.
</sec:authorize>

  这是根据角色判断是否显示 
  
还可以根据URL判断是否显示 
 

<sec:authorize url='/admin'>
This content will only be visible to users who are authorized to send requests to the '/admin' URL.
</sec:authorize>

5 方法级的鉴别 
   @PreAuthorize  @PostAuthorize  @Secure 

  要启用上面三者，要 
<global-method-security pre-post-annotations='enabled' /> 

这三个是在方法调用前，先鉴别是否有权限使用，比如 
  

public interface IUserService

｛
@PreAuthorize("hasRole('ROLE_USER')")

 public void changePassword(String username, password);
｝

   感觉这个其实不是很常用 
6 同5，可以使用JSR-250 注解去做 
   <global-method-security jsr250-annotations=”enabled”/> 

  @RolesAllowed({“ROLE_USER”,”ROLE_ADMIN”}) 
@PermitAll 
@DenyAll 

这样使用： 
    @RolesAllowed({"ROLE_ADMIN","ROLE_USER"}) 
public void deleteUser(String username); 
   这个东西反正没用到，具体见手册 


7 配置open-id,步骤 
   

<form action='j_spring-openid-security-check' method='post'>
 <label for='openid_idenifier'>Login</label>:
 <input id='openid_identifier' name='openid_identifier' type='text'/>
 <input type='submit' value='Login' />
</form>

   <http auto-config='true'> 
<openid-login/> 

</http> 
   当然要加上：spring-security-openid.jar 

8 spring secruity能使用ldap 
  <ldap-server ldif='classpath:my-ldif-file.ldif' id='localserver' /> 

当然要加上：spring-security-openid.jar 

9 使用远程 ldap-server 
   <ldap-server url='ldap://myServer/dc=captaindebug,dc=com:389' id='ldapExternal' 
  manager-dn='uid=admin,ou=users,ou=systems' manager-password='s3cret'/> 

  8和9还没用过，估计配置起来还有更多东西 

10 使用https 
   <http auto-config='true' use-expressions='true'> 
    <intercept-url pattern='/login' requires-channel='https'/> 
    
</https> 

  这个比较简单，用requires-channel＝'https'