ａｃｅｇｉ

Last week, about Acegi security framework of the SSH application in the beginning because Acegi configuration file loading mode confusion a few days, in the end is added to the form of plug-in configuration file struts struts  -config.xml  In statement or in the web deployment descriptor  .xml  In statement? Finally the answer, in the web  .xml  In a statement. Acegi as claimed, it will be loosely coupled with your existing applications for seamless integration. Following the initial application on it to be a description. 

    Among them, the need to use the jar package are: acegi  -security-1.0.3.jar     acegi-security-cas-1.0.3.jar     commons-codec-1.3.jar   1.    First is the web deployment descriptor  .xml <?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns="http://java.sun.com/xml/ns/j2ee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" version="2.4" xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee   http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd">
  <!--   Container boot parameters  -->
<context-param>
  <param-name>contextConfigLocation</param-name>
  <param-value>/WEB-INF/applicationContext-acegi-security.xml</param-value>
</context-param>

<!--   Character encoding filter  -->
<filter>
        <filter-name>Set Character Encoding</filter-name>
        <filter-class>com.xps.util.SetCharacterEncodingFilter</filter-class>
        <init-param>
            <param-name>encoding</param-name>
            <param-value>UTF-8</param-value>
        </init-param>
    </filter>
    <filter-mapping>
        <filter-name>Set Character Encoding</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>
   
<!-- Acegi  Filter  -->
   <filter>
        <filter-name>Acegi Filter Chain Proxy</filter-name>
        <filter-class>org.acegisecurity.util.FilterToBeanProxy</filter-class>
        <init-param>
            <param-name>targetClass</param-name>
            <param-value>org.acegisecurity.util.FilterChainProxy</param-value>
        </init-param>
    </filter>
    <filter-mapping>
      <filter-name>Acegi Filter Chain Proxy</filter-name>
      <url-pattern>/*</url-pattern>
    </filter-mapping>
  
   <!-- struts  Controller initialization configuration  -->
  <servlet>
     <servlet-name>action</servlet-name>
     <servlet-class>org.apache.struts.action.ActionServlet</servlet-class>
     <init-param>
        <param-name>config</param-name>
        <param-value>/WEB-INF/struts-config.xml</param-value>
     </init-param>
     <init-param>
        <param-name>debug</param-name>
        <param-value>3</param-value>
     </init-param>
     <init-param>
        <param-name>detail</param-name>
        <param-value>3</param-value>
     </init-param>
     <load-on-startup>0</load-on-startup>
   </servlet>
   <servlet-mapping>
     <servlet-name>action</servlet-name>
     <url-pattern>*.do</url-pattern>
   </servlet-mapping>
  
   <!--   Acegi of the context for the listener load  -->
<listener>
  <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>
  
   <!--   System default home page  -->
   <welcome-file-list>
    <welcome-file>/jsp/index.jsp</welcome-file>
   </welcome-file-list>
</web-app>    Red is the application Acegi need to add, first of all context  -param  To Acegi's configuration file as a startup parameter loaded into the container, while FilterToBeanProxy as it name suggests, is a filter agent, which is responsible for the different resources to each filter corresponds to, ContextLoaderListener monitor the situation for context loading. 2  .    Second, more complex Acegi configuration file applicationContext  -acegi-security.xml  .  <?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE beans PUBLIC "-//SPRING//DTD BEAN//EN" "http://www.springframework.org/dtd/spring-beans.dtd">
<beans>

<!--   Acegi authentication database for the preparation of the data source configuration  -->
<bean>
  <property name="driverClassName">
   <value>com.mysql.jdbc.Driver</value>
  </property>
  <property name="url">
   <value>jdbc:mysql://localhost:3306/xgame</value>
  </property>
  <property name="username">
   <value>root</value>
  </property>
  <property name="password">
   <value>123456</value>
  </property>
</bean>

<!--   Filter chain proxy  --> 
<bean>
  <property name="filterInvocationDefinitionSource">
   <value>
    CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON
    PATTERN_TYPE_APACHE_ANT
    /**=httpSessionContextIntegrationFilter,logoutFilter,
authenticationProcessingFilter,securityContextHolderAwareRequestFilter,
rememberMeProcessingFilter,anonymousProcessingFilter,
exceptionTranslationFilter,filterInvocationInterceptor
   </value>
  </property>
</bean>

<!--   Session context integration filter  -->
<bean/>

<!--   Cancellation filter  -->
<bean>
  <constructor-arg value="/jsp/index.jsp"/> <!-- URL redirected to after logout -->
  <constructor-arg>
   <list>
    <ref bean="rememberMeServices"/>
    <bean/>
   </list>
  </constructor-arg>
</bean>

<!--   Authentication processing filter  -->
<bean>
  <property name="authenticationManager" ref="authenticationManager"/>
  <property name="authenticationFailureUrl" value="/jsp/login.jsp"/>
  <property name="defaultTargetUrl" value="/login.do"/>
  <property name="filterProcessesUrl" value="/j_acegi_security_check"/>
  <property name="rememberMeServices" ref="rememberMeServices"/>
</bean>
  
<bean/>

<!-- Cookie  Log filters  -->
<bean>
  <property name="authenticationManager" ref="authenticationManager"/>
  <property name="rememberMeServices" ref="rememberMeServices"/>
</bean>

<!--   Anonymous logon processing filters  -->
<bean>
  <property name="key" value="changeThis"/>
  <property name="userAttribute" value="anonymousUser,AUTH_ANONYMOUS"/>
</bean>

<!--   Exception handling filter  -->
<bean>
  <property name="authenticationEntryPoint">
   <bean>
    <property name="loginFormUrl" value="/jsp/login.jsp"/>
    <property name="forceHttps" value="false"/>
   </bean>
  </property>
  <property name="accessDeniedHandler">
   <bean>
    <property name="errorPage" value="/jsp/noGrant.jsp"/>
   </bean>
  </property>
</bean>

<!--   Filter Blocker  -->
<bean>
      <property name="authenticationManager"><ref bean="authenticationManager"/></property>
      <property name="accessDecisionManager"><ref local="httpRequestAccessDecisionManager"/></property>
      <property name="objectDefinitionSource">
         <value>
       PATTERN_TYPE_APACHE_ANT
     
       <!--   Permissions for all users  -->
       /searchUser.do=AUTH_USER,AUTH_ROOT,AUTH_RELEASER,AUTH_AUDITOR
    /updateInformation.do=AUTH_USER,AUTH_ROOT,AUTH_RELEASER,AUTH_AUDITOR
     
       <!--   Permission to ordinary users  -->
    /preOrderAd.do=AUTH_USER
    /orderAd.do=AUTH_USER
    /myAdList.do=AUTH_USER
    /findReOrderAd.do=AUTH_USER
    /ReOrder.do=AUTH_USER
   
    <!--====   Super administrator rights  ====-->
   
    <!--   Auditor competence  -->
    /noaudit.do=AUTH_AUDITOR,AUTH_ROOT
    /allAuditAdNoPass.do=AUTH_AUDITOR,AUTH_ROOT
    /auditedAd.do=AUTH_AUDITOR
    /audited.do=AUTH_AUDITOR,AUTH_ROOT
    /notify.do=AUTH_AUDITOR,AUTH_ROOT
    /editAuditedEmail.do=AUTH_AUDITOR,AUTH_ROOT
   
    <!--   Members of the authority issued  -->
    /unpaymentOrderList.do=AUTH_RELEASER,AUTH_ROOT
    /paymentOrderList.do=AUTH_RELEASER,AUTH_ROOT  
   
    <!--   Super administrator rights  -->
    /manageAdpos.do=AUTH_ROOT
    /manageUser.do=AUTH_ROOT
    /addNewAdpos.do=AUTH_ROOT


         </value>
      </property>
    </bean>

<!--   Request for arbitration Manager  -->
   <bean>
     <property name="allowIfAllAbstainDecisions"><value>false</value></property>
      <property name="decisionVoters">
         <list>
             <ref bean="roleVoter"/>
         </list>
      </property>
   </bean>

<!-- Cookie  Server  -->
<bean>
  <property name="userDetailsService" ref="jdbcDaoImpl"/>
  <property name="key" value="changeThis"/>
</bean>

<!--   Certification Manager  -->
<bean>
  <property name="providers">
   <list>
    <ref local="daoAuthenticationProvider"/>
    <bean>
     <property name="key" value="changeThis"/>
    </bean>
    <bean>
     <property name="key" value="changeThis"/>
    </bean>
   </list>
  </property>
</bean>

<!--   A simple database-based authentication  -->
<bean>
  <property name="userDetailsService" ref="jdbcDaoImpl"/>
  <property name="userCache">
   <bean>
    <property name="cache">
     <bean>
      <property name="cacheManager">
       <bean/>
      </property>
      <property name="cacheName" value="userCache"/>
     </bean>
    </property>
   </bean>
  </property>
</bean>

<!--   User name password match verification and return UserDetails  -->
<bean>
  <property name="dataSource" ref="dataSource"/>     
  <property name="usersByUsernameQuery">          
   <value>select username, password, enabled from user where username = ? and enabled = 1</value>      
  </property>
  <property name="authoritiesByUsernameQuery">          
   <value>
    select u.username, a.authority
    from user u, authorities a, user_auth ua
    where u.id=ua.user_id and a.id=ua.auth_id and u.username=?
   </value>      
  </property>
</bean>

<!--   Log in Log listener, only for logging,  (  Optional  ) -->
<bean/>

<!--   Permissions voting machine, mainly used for setting permissions prefix  -->
<bean>
  <property name="rolePrefix" value="AUTH_"/>
</bean>
</beans>

    After a general need in the user login session in order to record user information needs of local calls, so you can log in but after turning LoginAction, in this Action which you can User name seesion years, and then mapping to display the login success page , the code is as follows: 

package com.xps.controller.action;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;

import org.acegisecurity.context.SecurityContextHolder;
import org.acegisecurity.userdetails.UserDetails;
import org.apache.struts.action.Action;
import org.apache.struts.action.ActionForm;
import org.apache.struts.action.ActionForward;
import org.apache.struts.action.ActionMapping;


public class LoginAction extends Action {


public ActionForward execute(ActionMapping mapping, ActionForm form,
   HttpServletRequest request, HttpServletResponse response) {
 
  String username = null;
  //  Acegi's Context from the get user information 
  Object obj = SecurityContextHolder.getContext().getAuthentication().getPrincipal();
 
  if(obj instanceof UserDetails){
   username = ((UserDetails)obj).getUsername();
  }else{
   username = obj.toString();
  }
 
  HttpSession session = request.getSession(true);
  session.setAttribute("username", username);
  return mapping.findForward("success");
}
}

    Acegi configuration file above the red part of the changes according to their own needs. Acegi configuration file for instructions, have many friends stood out clearly, and I also do not have much to say, in the next article in reference to a blue font is the User's  (  It uses the Acegi version of acegi  -security-0.8.3.jar  , So some packages may have different  )  If the above did not understand the explanations below can be combined to understand. Note: The blue field is a reference section, as reproduced on the internet too much, could not find the original source, please forgive me 

  In applicationContext  -acegi-security.xml  In

FILTER CHAIN

  FilterChainProxy will call the filter in order to  ,  These filter functions can enjoy Spring ioc  , CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON  Defines the url to lowercase before comparison, PATTERN  _TYPE_APACHE_ANT  Define the matching model using Apache ant 

  Basic authentication 

1) authenticationManager
  Play the role of authentication management, which will verify the function entrusted to the number of Provider, and by traversing Providers  ,   To ensure access to different sources of authentication, if a Provider can be successfully identified the current user's identity, authenticate  ()  Method will return a complete license information contains the user Authentication object, otherwise it will throw an AuthenticationException. 
Acegi  Provides a different implementation AuthenticationProvider  ,  Such as: 
        DaoAuthenticationProvider   Read user information from the database authenticate 
        AnonymousAuthenticationProvider   Anonymous user authentication 
        RememberMeAuthenticationProvider   Saved cookie in the user authentication information 
        AuthByAdapterProvider   Use container adapter authentication 
        CasAuthenticationProvider   According to verify the identity of Yale Center Certification Service  ,   Used to implement single sign 
        JaasAuthenticationProvider   Landing configuration from JASS authenticate access to user information 
        RemoteAuthenticationProvider   Authenticate users based remote service 
        RunAsImplAuthenticationProvider   Manager of identity has been replaced by the user authentication 
        X509AuthenticationProvider   To obtain certification from the X509 authenticate user information 
        TestingAuthenticationProvider   The use of unit testing 

          Each person will have their own authentication information specified in that certificate, if this proves DaoAuthenticationProvider information only UsernamePasswordAuthenticationToken certification. 


2) daoAuthenticationProvider
  A simple database-based authentication. DaoAuthenticationProvider access to the database to match the account password and, if successful at the same time through the user returns an Authentication object that contains authorization information, otherwise the authentication fails, throw a AuthenticatiionException. 


3) passwordEncoder
  The use of encryption devices on the user input the text is encrypted. Acegi provides three encryption devices  :
PlaintextPasswordEncoder  - By default, no encryption, return plaintext  .
ShaPasswordEncoder  - Hash algorithm  (SHA)  Encryption 
Md5PasswordEncoder  - News Summary  (MD5)  Encryption 

4) jdbcDaoImpl
  Used to get user information in the data. acegi provides authorized users and table structure, but you can own to achieve. By usersByUsernameQuery this SQL to get your  (  User ID  ,  Password  ,  State information  );  By authoritiesByUsernameQuery this SQL to get your  (  User ID  ,  Authorization information  )

5) userCache  &  resourceCache
Cache user and resource information corresponding permissions. When requesting a protected resource, daoAuthenticationProvider will be called to obtain the user authorization information. If obtained from the database each time, then the price is high, for the infrequent user and resource information to change the terms, it is best to related cached authorization information.  (  See 2  .6.3   Resources to expand the definition of competence  )
userCache  Provides two implementation  : NullUserCache  And EhCacheBasedUserCache  , NullUserCache  In fact without any cache, EhCacheBasedUserCache is achieved using Ehcache slow function. 

6) basicProcessingFilter
  Certification for handling HTTP header information, such as the remote protocol from the Spring  (  Such as Hessian and Burlap  )  Or common browser such as IE  ,Navigator  The HTTP header to get user information, the properties they refer to the assembly by authenticationManager certification manager. If authentication is successful, will be an Authentication object into session, or, if the authentication fails, control will be transferred to the authentication Entry Point  (  Assembly by authenticationEntryPoint property  )

7) basicProcessingFilterEntryPoint
  Through the browser sends a HTTP401  (  Unauthorized  )  Message prompts the user to log on. 
  Handle HTTP-based authorization process, when the verification process after abnormal  "  Whereabouts  "  Usually achieve steering, in response have added features such as error messages. 

8) authenticationProcessingFilterEntryPoint
  When thrown AccessDeniedException when the user is redirected to the login screen. Property loginFormUrl configured with a login form URL  ,  When you need the user login, authenticationProcessingFilterEntryPoint will redirect the user to the URL 

HTTP  Security Request 

1) httpSessionContextIntegrationFilter
  Each request to obtain pre-HttpSessionContextIntegrationFilter Authentication object from the Session, After the request  ,   Session Authentication object stored again in the next request for use  ,  The filter must be used before other Acegi filter, so that it can span multiple requests. 


2) httpRequestAccessDecisionManager
  After the voting mechanism to determine whether access to a resource  (URL  Or methods  )  . allowIfAllAbstainDecisions is false, if one or more of the decisionVoters vote  ,  Is authorized by. Optional decision-making mechanism ConsensusBased and UnanimousBased 


3) roleVoter
   Value is set to begin rolePrefix permission to vote  ,  If AUTH  _ , ROLE_

4  ) ExceptionTranslationFilter 
  Abnormal conversion filters, mainly dealing with AccessDeniedException and AuthenticationException, will find the right of each anomaly  "  Whereabouts  "

5) authenticationProcessingFilter
  And the servlet spec is almost  ,  Processing login requests  .  When authentication is successful, AuthenticationProcessingFilter place in a session Authentication object, and redirect to the login success page 
         authenticationFailureUrl  Turn the definition of a page when login fails 
         defaultTargetUrl  Turn the definition of landing page success 
         filterProcessesUrl  Defined landing page request 
         rememberMeServices  Used to add the cookie information after successful authentication 

6) filterInvocationInterceptor
  Shift in the implementation of the pre-inspection objectDefinitionSource url set of user rights information. First of all, objectDefinitionSource defines the properties needed to access URL information  (  Attribute information here is only a symbol of what use to tell accessDecisionManager voter to vote  )  . Then, authenticationManager out with their own user authentication provider to verify the information. Finally, voters hold the user authentication and access properties url need, call their own voter to vote, decide whether to allow access. 


7) filterDefinitionSource
  Custom DBFilterInvocationDefinitionSource read from the database and the cache need to protect resources and their access to information 

  Method calls the security control 

1) methodSecurityInterceptor
  Intercept in the implementation of the method before, check the user rights information 
2) methodDefinitionSource
  Custom MethodDefinitionSource permission to read from the cache 

   <bean>
        <property name="authenticationManager" ref="authenticationManager"/>
        <property name="accessDecisionManager" ref="httpRequestAccessDecisionManager"/>
        <property name="objectDefinitionSource" ref="methodDefinitionSource"/>
    </bean>
    <bean>
        <property name="acegiCacheManager" ref="acegiCacheManager"/>
    </bean>

  3.    Finally, the login page login  .jsp
<html>
<head>
  <title>  User Login  </title>
  <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body topmargin="0">
      <form action="j_acegi_security_check" method="POST">
      <table>
        <tr><td>  User name  :</td><td><input type='text' name='j_username'></td></tr>
        <tr><td>  Password  :</td><td><input type='password' name='j_password'></td></tr>
        <tr>
         <td><input name="submit" type="submit" value="  Login  "></td>
         <td><input name="reset" type="reset" value="  Reset  "></td>
        </tr>
      </table>
    </form>
</body>
</html>


    The red part of the name must be fixed with Acegi, if you want to log off, simply add  <a href="j_acegi_logout">  Off  </a>  If the records need to login to the cookie, you can use  <input type="checkbox" name="_acegi_security_remember_me">Don't ask for my password for two weeks , So that users do not log on within two weeks, also had access to the system. 

    Postscript, in fact, Acegi authentication and authorization aspects of the function is very powerful, it worthy of its complex configuration  - -  ! I just use it to do a little elementary applications, for some advanced features (like the method level of access control, etc.) used in the study again Yi Hou.