spring mvc+spring security实现自定义securtiy过虑器
理解不透彻，还在摸索中，写下来自己看
一、创建maven-web项目
web.xml配置
<?xml version="1.0" encoding="UTF-8"?> <web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://java.sun.com/xml/ns/javaee" xmlns:web="http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd" id="WebApp_ID" version="2.5"> <context-param> <param-name>webAppRootKey</param-name> <param-value>spring.root</param-value> </context-param> <!-- Spring的log4j监听器 --> <listener> <listener-class>org.springframework.web.util.Log4jConfigListener</listener-class> </listener> <!-- Spring view分发器 mvc Servlet的名字是（<servlet-name>）是dispatcher，所以Spring的约定胜于配置（Convention over Configuration，CoC）将会在WEB-INF目录下寻找名为dispatcher-servelt.xml的配置文件。我们没有覆 盖这种默认行为，你能在WEB-INF目录下找到这个文件，它包含了一些Spring MVC相关的配置。也可以指定路径 --> <servlet> <servlet-name>dispatcher</servlet-name> <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class> <init-param> <param-name>contextConfigLocation</param-name> <param-value>classpath:spring-mvc.xml</param-value> </init-param> <load-on-startup>1</load-on-startup> </servlet> <servlet-mapping> <servlet-name>dispatcher</servlet-name> <url-pattern>/</url-pattern> </servlet-mapping> <!--在web应用的部署描述文件中，用来配置ContextLoaderListener的XML文件地址是在<context-param>元素中给出的 --> <context-param> <param-name>contextConfigLocation</param-name> <param-value>classpath:spring-core.xml</param-value> </context-param> <listener> <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class> </listener> <!-- 字符集 过滤器 --> <filter> <filter-name>CharacterEncodingFilter</filter-name> <filter-class>org.springframework.web.filter.CharacterEncodingFilter</filter-class> <init-param> <param-name>encoding</param-name> <param-value>UTF-8</param-value> </init-param> <init-param> <param-name>forceEncoding</param-name> <param-value>true</param-value> </init-param> </filter> <filter-mapping> <filter-name>CharacterEncodingFilter</filter-name> <url-pattern>/*</url-pattern> </filter-mapping> <!-- Spring security --> <filter> <filter-name>springSecurityFilterChain</filter-name> <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class> </filter> <filter-mapping> <filter-name>springSecurityFilterChain</filter-name> <url-pattern>/*</url-pattern> </filter-mapping> <!-- security管理会话监听 --> <listener id="Listener_Spring_Security_Session_Event_Publisher"> <listener-class>org.springframework.security.web.session.HttpSessionEventPublisher</listener-class> </listener> <welcome-file-list> <welcome-file>index.jsp</welcome-file> </welcome-file-list> </web-app>
mvc.xml
<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:p="http://www.springframework.org/schema/p"
xmlns:context="http://www.springframework.org/schema/context"
xmlns:mvc="http://www.springframework.org/schema/mvc"
xsi:schemaLocation="
http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans.xsd
http://www.springframework.org/schema/context
http://www.springframework.org/schema/context/spring-context.xsd
http://www.springframework.org/schema/mvc
http://www.springframework.org/schema/mvc/spring-mvc-3.0.xsd ">
<context:component-scan base-package="spring.controller" />
<bean class="org.springframework.web.servlet.view.InternalResourceViewResolver">
<property name="prefix" value="/WEB-INF/views/" />
<property name="suffix" value=".jsp" />
</bean>
</beans>
security.xml
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:security="http://www.springframework.org/schema/security"
xmlns:p="http://www.springframework.org/schema/p" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
http://www.springframework.org/schema/security
http://www.springframework.org/schema/security/spring-security-3.0.xsd">
<!-- use-expressions:Spring 表达式语言配置访问控制 -->
<security:http auto-config="true" use-expressions="false">
<security:intercept-url pattern="/home/*" access="ROLE_USER" />
<!--默认登录页面 default-target-url默认跳转的页面 always-use-default-target登录成功后默认进入home.jsp -->
<security:form-login login-page="/portal/login" default-target-url="/home/index.jsp"
always-use-default-target="true" login-processing-url="/login"/>
<!--
退出配置 logout-success-url:退出成功后跳转的页面 ,
如果session配置了invalid-session-url默认跳转到指定的页面，logout-success-url不起作用
-->
<security:logout logout-url="/logout"
logout-success-url="/portal/login" />
<!-- 过滤器 -->
<security:custom-filter ref="pwdAuthentication" after="SECURITY_CONTEXT_FILTER"/>
<!--管理会话 invalid-session-url:session失效后跳转到的页面 invalid-session-url="/sessionTimeout.jsp"-->
<security:session-management >
<security:concurrency-control max-sessions="1"/>
</security:session-management>
</security:http>
<security:authentication-manager alias="authenticationManager">
<!-- <security:authentication-provider>
<security:user-service>
<security:user name="admin" password="123456"
authorities="ROLE_USER" />
</security:user-service>
</security:authentication-provider>
-->
<!-- 注意这里的ref属性定义。如果没有使用CAS认证，此处一般定义user-service-ref属性。这两个属性的区别在于
ref：直接将ref依赖的bean注入到AuthenticationProvider的providers集合中
user-service-ref：定义DaoAuthenticationProvider的bean注入到AuthenticationProvider的providers集合中，
并且DaoAuthenticationProvider的变量userDetailsService由user-service-ref依赖的bean注入。 -->
<security:authentication-provider ref="userService"></security:authentication-provider>
</security:authentication-manager>
<bean id="pwdAuthentication" class="spring.security.PwdAuthenticationProcessingFilter">
<property name="authenticationManager" ref="authenticationManager"></property>
<property name="faildPage" value="/portal/login"></property>
</bean>
</beans>
网上搜索了下security的验证流程：
springSecurity的登录验证是由org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter这个过滤器来完成的,在该类的父类AbstractAuthenticationProcessingFilter中有一个AuthenticationManager接口属性,验证工作主要是通过这个AuthenticationManager接口的实例来完成的。在默认情况下，springSecurity框架会把org.springframework.security.authentication.ProviderManager类的实例注入到该属性。
UsernamePasswordAuthenticationFilter的验证过程如下：
1. 首先过滤器会调用自身的attemptAuthentication方法，从request中取出authentication, authentication是在org.springframework.security.web.context.SecurityContextPersistenceFilter过滤器中通过捕获用户提交的登录表单中的内容生成的一个org.springframework.security.core.Authentication接口实例.
2. 拿到authentication对象后，过滤器会调用ProviderManager类的authenticate方法，并传入该对象
3.ProviderManager类的authenticate方法再调用自身的doAuthentication方法，在doAuthentication方法中会调用类中的List<AuthenticationProvider> providers集合中的各个AuthenticationProvider接口实现类中的authenticate(Authentication authentication)方法进行验证，由此可见，真正的验证逻辑是由各个各个AuthenticationProvider接口实现类来完成的,DaoAuthenticationProvider类是默认情况下注入的一个AuthenticationProvider接口实现类
4.AuthenticationProvider接口通过UserDetailsService来获取用户信息
需要用的类：user（用户） role（权限） userService userServiceImpl PwdAuthenticationProcessingFilter（过滤器）PwdAuthenticationToken
userServiceImpl
需要实现AuthenticationProvider接口，通过实现AuthenticationProvider接口实现类中的authenticate(Authentication authentication)方法进行验证，
boolean supports(Class<? extends Object> authentication) 方法来指定对哪个token进行操作，只有结果返回true才会执行authenticate(Authentication authentication)方法
Role要实现GrantedAuthority，GrantedAuthority接口中只有一个方法getAuthority，获取用户自定义的权限
user需要实现authentication，用来返回验证过后的用户（authentication）交给security验证权限；实现的方法，需要注意Collection<GrantedAuthority>getAuthorities()，此方法要返回实现GrantedAuthority接口的权限列表来验证用户权限。
PwdAuthenticationProcessingFilter继承AbstractAuthenticationProcessingFilter。实现attemptAuthentication方法，来进行登录的验证；还需要创建类构造方法，调用父类的构造设置访问此filter的路径（action的路径）；此外还可以重写父类的afterPropertiesSet方法，来自定义处理器，处理用户登录成功或失败后跳转到的页面
涉及到的其他类：
PwdAuthenticationToken，要自己创建一个token去继承AbstractAuthenticationToken，用来存取用户信息，该类主要用来，AbstractAuthenticationProcessingFilter的实现类调用this.getAuthenticationManager().authenticate(authentication)时传递给service进行验证
-----------------------------------------------------------------------------------------------------------
执行顺序：
用户未登录时，访问/home/*的路径时，页面会自动跳转到/portal/login页面，让用户进行登录操作。
输入登录信息提交后，根据action的访问路径来找相对应的filter中的构造方法设置的访问路径，如果一致则执行该filter中的attemptAuthentication方法，在方法中根据request获取到用户的信息存储到PwdAuthenticationToken中，然后调用this.getAuthenticationManager().authenticate(authentication)，authentication传入的是PwdAuthenticationToken
这时候会根据在security.xml中<security:authentication-manager alias="authenticationManager">中注入的<security:authentication-provider ref="userService">来进行判断（可以有多个authentication-provider）根据service中的supports方法来比较传入的对象PwdAuthenticationToken，如果返回值为true则执行该service中的authentication方法；在authentication方法中可以把该方法的参数转换成PwdAuthenticationToken来进行对用户名密码的校验，验证成功后获取用户的权限，注入到user中。成功后返回user验证获取权限成功，自动跳转到/home/index.jsp页面
附各类的代码
user.java
public class User implements Authentication {
/**
*
*/
private static final long serialVersionUID = 1L;
private String name;
private String pwd;
private String loginName;
@Override
public String getName() {
return name;
}
//权限
private Set<GrantedAuthority> accesses;
/**
* 获取权限
*/
@Override
public Collection<GrantedAuthority> getAuthorities() {
return accesses;
}
@Override
public Object getCredentials() {
return null;
}
@Override
public Object getDetails() {
return null;
}
@Override
public Object getPrincipal() {
return this.loginName;
}
//判断是否验证
private boolean authenticated=false;
/**
* 是否已验证
*/
@Override
public boolean isAuthenticated() {
return this.authenticated;
}
@Override
public void setAuthenticated(boolean arg0) throws IllegalArgumentException {
this.authenticated=arg0;
}
public String getLoginName() {
return loginName;
}
public void setLoginName(String loginName) {
this.loginName = loginName;
}
public Set<GrantedAuthority> getAccesses() {
return accesses;
}
public void setAccesses(Set<GrantedAuthority> accesses) {
this.accesses = accesses;
}
public String getPwd() {
return pwd;
}
public void setPwd(String pwd) {
this.pwd = pwd;
}
public void setName(String name) {
this.name = name;
}
}
role.java
public class Role implements GrantedAuthority{
private static final long serialVersionUID = 1L;
public static String PREFIX="ROLE_";
/**
* 获取权限
*/
@Override
public String getAuthority() {
return PREFIX+id;
}
/**
* 初始化用户权限
*@author baozhichao 2013-12-19下午5:46:36
* @return
*/
public static Role getRoleUser(){
Role ro = new Role();
ro.setId("USER");
ro.setName("普通用户");
return ro;
}
private String id;
private String name;
public String getId() {
return id;
}
public void setId(String id) {
this.id = id;
}
public String getName() {
return name;
}
public void setName(String name) {
this.name = name;
}
}
UserServiceImpl.java
public class UserServiceImpl implements UserService,AuthenticationProvider {
@Override
public Authentication authenticate(Authentication auth)
throws AuthenticationException {
PwdAuthenticationToken token = (PwdAuthenticationToken)auth;
if(token.getUserName()!=null && token.getPassword()!=null){
if(!token.getUserName().equals("admin")){
token.setErrCode("1");
return null;
}
if(!token.getPassword().equals("123456")){
token.setErrCode("2");
return null;
}
User user = new User();
user.setName(token.getName());
user.setPwd(token.getPassword());
//认证成功
user.setAuthenticated(true);
/**写入权限*/
Role role = Role.getRoleUser();
System.out.println(role.getAuthority());
Set<GrantedAuthority> accesses = new HashSet<GrantedAuthority>();
accesses.add(role);
user.setAccesses(accesses);
return user;
}
return null;
}
@Override
public boolean supports(Class<? extends Object> authentication) {
return authentication.equals(PwdAuthenticationToken.class);
}
}
pwdAuthenticationToken.java
public class PwdAuthenticationToken extends AbstractAuthenticationToken{
public PwdAuthenticationToken() {
super(null);
}
private String userName;
private String idCode;
private String password;
private String errCode;
private static final long serialVersionUID = 1L;
@Override
public Object getCredentials() {
return this.idCode+"_"+this.userName;
}
@Override
public Object getPrincipal() {
return this.password;
}
public String getUserName() {
return userName;
}
public void setUserName(String userName) {
this.userName = userName;
}
public String getIdCode() {
return idCode;
}
public void setIdCode(String idCode) {
this.idCode = idCode;
}
public String getPassword() {
return password;
}
public void setPassword(String password) {
this.password = password;
}
public String getErrCode() {
return errCode;
}
public void setErrCode(String errCode) {
this.errCode = errCode;
}
}
pwdAuthenticationProcessingFilter.java
public class PwdAuthenticationProcessingFilter extends
AbstractAuthenticationProcessingFilter {
private String faildPage;
/**
* 必须要实现无参构造
* spring项目名称、loginCheck访问路径
*/
protected PwdAuthenticationProcessingFilter() {
super("/loginCheck");//设置访问路径
}
@Override
public Authentication attemptAuthentication(HttpServletRequest request,
HttpServletResponse response) throws AuthenticationException,
IOException, ServletException {
String id = request.getParameter("id");
String name = request.getParameter("user_name");
String pwd = request.getParameter("pass_word");
PwdAuthenticationToken token = new PwdAuthenticationToken();
token.setIdCode(id);
token.setUserName(name);
token.setPassword(pwd);
Authentication auth = null;
try {
auth = this.getAuthenticationManager().authenticate(token);
} catch (AuthenticationException e) {
e.printStackTrace();
}
return auth;
}
@Override
public void afterPropertiesSet() {
super.afterPropertiesSet();
AuthenticationFaildPage faild = new AuthenticationFaildPage();
faild.setFaildPage(faildPage);
this.setAuthenticationFailureHandler(faild);
}
public String getFaildPage() {
return faildPage;
}
public void setFaildPage(String faildPage) {
this.faildPage = faildPage;
}
}
loginController.java
import org.springframework.stereotype.Controller;
/**
*@author baozhichao
*2013-12-19 下午3:09:17
*/
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;
@Controller
@RequestMapping("/portal")
public class LoginController {
@RequestMapping(method=RequestMethod.GET,value="/login")
public String login(){
return "login/login";
}
}