应用场景
现有的数据库中包含以下几张表格用于权限管理
<beans:beans xmlns="http://www.springframework.org/schema/security"
xmlns:beans="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
http://www.springframework.org/schema/security
http://www.springframework.org/schema/security/spring-security-3.1.xsd">
<http pattern="/js/**" security="none" />
<http use-expressions="true" access-denied-page="/error.html">
<intercept-url pattern="/peoplemanage/**" access="hasRole('admin')" />
<form-login login-page='/login.jsp'/>
<logout />
</http>
<authentication-manager>
<authentication-provider>
<user-service>
<user name="zhangsan" password="zhangsan" authorities="admin,user"/>
<user name="wangwu" password="wangwu" authorities="user" />
</user-service>
</authentication-provider>
</authentication-manager>
</beans:beans>2.同样的配置还原成Bean的方式 <beans xmlns="http://www.springframework.org/schema/beans"
xmlns:sec="http://www.springframework.org/schema/security"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
http://www.springframework.org/schema/security
http://www.springframework.org/schema/security/spring-security-3.1.xsd">
<bean id="filterChainProxy" class="org.springframework.security.web.FilterChainProxy">
<constructor-arg>
<list>
<sec:filter-chain pattern="/js/**" filters="none"/>
<sec:filter-chain pattern="/**"
filters="securityContextPersistenceFilter,authenticationFilter,exceptionTranslationFilter,filterSecurityInterceptor"/>
</list>
</constructor-arg>
</bean>
<bean id="filterSecurityInterceptor" class="org.springframework.security.web.access.intercept.FilterSecurityInterceptor">
<property name="authenticationManager" ref="authenticationManager"/>
<property name="accessDecisionManager" ref="accessDecisionManager"/>
<property name="securityMetadataSource">
<sec:filter-security-metadata-source use-expressions="true">
<sec:intercept-url pattern="/peoplemanage/**" access="hasRole('admin')"/>
</sec:filter-security-metadata-source>
</property>
</bean>
<!-- exceptionTranslationFilter -->
<bean id="exceptionTranslationFilter" class="org.springframework.security.web.access.ExceptionTranslationFilter">
<property name="authenticationEntryPoint" ref="authenticationEntryPoint"/>
<property name="accessDeniedHandler" ref="accessDeniedHandler"/>
</bean>
<bean id="authenticationEntryPoint" class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint">
<property name="loginFormUrl" value="/login.jsp"/>
</bean>
<bean id="accessDeniedHandler" class="org.springframework.security.web.access.AccessDeniedHandlerImpl">
<property name="errorPage" value="/error.html"/>
</bean>
<!-- securityContextPersistenceFilter -->
<bean id="securityContextPersistenceFilter" class="org.springframework.security.web.context.SecurityContextPersistenceFilter"/>
<!-- authenticationFilter -->
<bean id="authenticationFilter" class="org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter">
<property name="authenticationManager" ref="authenticationManager"/>
<property name="filterProcessesUrl" value="/j_spring_security_check"/>
</bean>
<!-- Core Service -->
<bean id="authenticationManager" class="org.springframework.security.authentication.ProviderManager">
<property name="providers">
<list>
<ref local="daoAuthenticationProvider"/>
</list>
</property>
</bean>
<bean id="daoAuthenticationProvider" class="org.springframework.security.authentication.dao.DaoAuthenticationProvider">
<property name="userDetailsService" ref="inMemoryDaoImpl"/>
</bean>
<bean id="inMemoryDaoImpl" class="org.springframework.security.provisioning.InMemoryUserDetailsManager">
<constructor-arg name="users">
<props>
<prop key="zhangsan">zhangsan,enabled</prop>
<prop key="wangwu">wangwu,enabled</prop>
</props>
</constructor-arg>
</bean>
<bean id="accessDecisionManager" class="org.springframework.security.access.vote.AffirmativeBased">
<property name="decisionVoters">
<list>
<bean class="org.springframework.security.web.access.expression.WebExpressionVoter"></bean>
</list>
</property>
</bean>
</beans>还原成Bean的配置方式之后，在实现个性化的定制就变得清晰明了了。 public class MyUserDetailsService implements UserDetailsService {
public UserDetails loadUserByUsername(String userName) throws UsernameNotFoundException {
/**
* TODO 从数据库中加载用户信息，并封装成UserDetails对象
*/
}
}2.替换Demo中的对应的配置 <bean id="daoAuthenticationProvider" class="org.springframework.security.authentication.dao.DaoAuthenticationProvider">
<property name="userDetailsService" ref="myUserDetailsService"/>
</bean>
<bean id="myUserDetailsService" class="com.youcompany.MyUserDetailsService"/> 二、修改filterSecurityInterceptor中securityMetadataSource属性的注入方式 public class MyFilterInvocationSecurityMetadataSource implements FilterInvocationSecurityMetadataSource {
private Map<RequestMatcher, Collection<ConfigAttribute>> requestMap;
public MyFilterInvocationSecurityMetadataSource(){
requestMap=new HashMap<RequestMatcher, Collection<ConfigAttribute>>();
loadMetadataInfo();//将数据库中的资源和角色实体封装到requestMap里
}
private void loadMetadataInfo() {
List<Resource> resources=...//TODO 获取数据库中所有的资源实体
for(Resource res:resources){
Set<ConfigAttribute> allAttributes = new HashSet<ConfigAttribute>();
List<Role> roles=...//TODO 获取该资源对应的访问角色
for(Role role:roles){
allAttributes.add(new SecurityConfig(role.getRoleName()));
}
RequestMatcher key=new AntPathRequestMatcher(res.getUrl()+"/**");
requestMap.put(key, allAttributes);
}
}
public Collection<ConfigAttribute> getAllConfigAttributes() {
Set<ConfigAttribute> allAttributes = new HashSet<ConfigAttribute>();
List<Role> roles...//TODO 获取库中所有的角色实体
for(Role role:roles){
allAttributes.add(new SecurityConfig(role.getRoleName()));
}
return allAttributes;
}
public Collection<ConfigAttribute> getAttributes(Object object) throws IllegalArgumentException {
HttpServletRequest request = ((FilterInvocation) object).getRequest();
for (Map.Entry<RequestMatcher, Collection<ConfigAttribute>> entry : requestMap.entrySet()) {
if (entry.getKey().matches(request)) {
return entry.getValue();
}
}
return null;
}
public boolean supports(Class<?> clazz) {
return FilterInvocation.class.isAssignableFrom(clazz);
}
}2.修改Demo中相应的配置 <bean id="filterSecurityInterceptor" class="org.springframework.security.web.access.intercept.FilterSecurityInterceptor">
<property name="authenticationManager" ref="authenticationManager"/>
<property name="accessDecisionManager" ref="accessDecisionManager"/>
<property name="securityMetadataSource" ref="myFilterInvocationSecurityMetadataSource"/>
</bean>
<bean id="myFilterInvocationSecurityMetadataSource" class="com.youcompany.MyFilterInvocationSecurityMetadataSource"/> 三、修改accessDecisionManager中decisionVoters的实现逻辑 public class MyAccessDecisionVoter implements AccessDecisionVoter<Object> {
public boolean supports(ConfigAttribute attribute) {
return true;
}
public boolean supports(Class<?> clazz) {
return true;
}
public int vote(Authentication authentication, Object object, Collection<ConfigAttribute> attributes) {
int result = ACCESS_DENIED;
for (ConfigAttribute attribute : attributes) {//可访问该页面的角色
for (GrantedAuthority authority : authentication.getAuthorities()) {//登录用户具备的角色
if (attribute.getAttribute().equals(authority.getAuthority())) {//判断用户是否具有相应角色
return ACCESS_GRANTED;
}
}
}
return result;
}
}2.修改Demo中对应的配置 <bean id="accessDecisionManager" class="org.springframework.security.access.vote.AffirmativeBased">
<property name="decisionVoters">
<list>
<bean class="com.youcompany.MyAccessDecisionVoter"></bean>
</list>
</property>
</bean>至此，SpringSecurity个性化定制修改完成。有点长，部分代码加了TODO，有不理解的可与我联系，需要源码的网友可留邮箱