学习Spring-security （2）

时间 2019-11-06

原文原文链接

Maven项目建立好以后，并加载好对应的Jar包依赖以后。css

接着搭建Spring-Security环境java

注意：使用Spring-Security 必须得加载Spring框架的依赖包（Spring，Common等等Jar）mysql

配置web.xml 加载Spring容器的监听器 ContextLoaderListener
加载Spring-Security的拦截器 filter.DelegatingFilterProxy
加载上述两个的配置文件

web.xml配置文件以下：web

<?xml version="1.0"?>
<!DOCTYPE web-app PUBLIC "-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN"
                         "http://java.sun.com/dtd/web-app_2_3.dtd">
<web-app>
 <display-name>Archetype Created Web Application</display-name>
 <context-param>
  <param-name>contextConfigLocation</param-name>
  <param-value>classpath:applicationContext.xml,
        classpath:applicationContext-security.xml</param-value>
 </context-param>
 <!-- SpringSecurity 核心过滤器配置 -->
 <filter>
  <filter-name>springSecurityFilterChain</filter-name>
  <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
 </filter>
 <filter-mapping>
  <filter-name>springSecurityFilterChain</filter-name>
  <url-pattern>/*</url-pattern>
 </filter-mapping>
 <listener>
  <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
 </listener>
 <login-config>
  <auth-method>BASIC</auth-method>
 </login-config>
</web-app>

配置Spring-security.xml文件以下：spring

<?xml version="1.0" encoding="UTF-8"?>  
<beans xmlns="http://www.springframework.org/schema/beans"  
    xmlns:sec="http://www.springframework.org/schema/security"  
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"  
    xsi:schemaLocation="http://www.springframework.org/schema/beans  
        http://www.springframework.org/schema/beans/spring-beans-3.0.xsd  
        http://www.springframework.org/schema/security  
        http://www.springframework.org/schema/security/spring-security-3.2.xsd">  
  
    <!-- 配置不过滤的资源（静态资源及登陆相关） -->  
    <sec:http pattern="/**/*.css" security="none"></sec:http>  
    <sec:http pattern="/**/*.jpg" security="none"></sec:http>  
    <sec:http pattern="/**/*.jpeg" security="none"></sec:http>  
    <sec:http pattern="/**/*.gif" security="none"></sec:http>  
    <sec:http pattern="/**/*.png" security="none"></sec:http>  
    <sec:http pattern="/js/*.js" security="none"></sec:http>  
      
    <sec:http pattern="/login.jsp" security="none"></sec:http>  
    <sec:http pattern="/getCode" security="none" /><!-- 不过滤验证码 -->  
    <sec:http pattern="/test/**" security="none"></sec:http><!-- 不过滤测试内容 -->  
      
    <sec:http auto-config="true">  
        <!-- 配置资源连接过滤，表示意思为：访问/app.jsp 须要ROLE_SERVICE 权限 -->
        <sec:intercept-url pattern="/app.jsp" access="ROLE_SERVICE"/>  
         <!-- 配置资源连接过滤，表示意思为：访问全部资源   须要ROLE_ADMIN 权限 -->
        <sec:intercept-url pattern="/**" access="ROLE_ADMIN"/>  
        <!-- 注意，Spring-security采用从上到下过滤，你访问的连接 Spring从上面开始往下找。上面的优先级比下面的优先级高。-->
        
        <!-- 
        	自定义登录页面，login-page 自定义登录页面
        	authentication-failure-url 用户权限校验失败以后才会跳转到这个页面，若是数据库中没有这个用户则不会跳转到这个页面。
        	default-target-url 登录成功后跳转的页面。
        	注：登录页面用户名固定 name:j_username，密码 name:j_password，action:/j_spring_security_check
         -->
        <sec:form-login login-page="/login.jsp" authentication-failure-url="/loginfail.jsp" default-target-url="/index.jsp"/>
        
        <!-- 
        	登出， invalidate-session 是否删除session
			logout-url：登出处理连接
			logout-success-url：登出成功页面
			注：登出操做 只须要连接到 logout便可登出当前用户        	
        -->
        <sec:logout invalidate-session="true" logout-url="/logout" logout-success-url="/login.jsp"/>      
    </sec:http>  

    <!-- 权限管理器，用来查询用户的全部权限使用。登录用户以后，由这个拦截器来查询用户，分配对应的权限 ，而后分配给sec:http 来作对应的拦截-->
    <sec:authentication-manager>  
    	<!-- 手动定义一个用户以及对应的权限 -->
        <sec:authentication-provider>  
            <sec:user-service >  
                <sec:user name="admin" password="admin" authorities="ROLE_ADMIN"/>  
            </sec:user-service>  
        </sec:authentication-provider>
        <!-- 本身定义 一个类处理用户登录的时候，用户名，密码，权限获取-->
        <sec:authentication-provider user-service-ref="Userservices"></sec:authentication-provider>
        <!-- 直接经过SQL来获取数据库中的用户名，密码，权限-->
        <sec:authentication-provider>
        	<sec:jdbc-user-service data-source-ref="Datasource" authorities-by-username-query="select b.username as username,a.ROLE_CODE as authority from ZX_ROLE a left join ZX_USER b on a.USER_ID=b.ID where b.username=?" 
				users-by-username-query="select username,password,enable as status from ZX_USER where username=?"/>
        </sec:authentication-provider>
    </sec:authentication-manager>  
</beans>

配置applicationContext.xml文件以下：sql

<?xml version="1.0" encoding="UTF-8"?>  
<beans xmlns="http://www.springframework.org/schema/beans"  
    xmlns:sec="http://www.springframework.org/schema/security"  
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"  
    xsi:schemaLocation="http://www.springframework.org/schema/beans  
        http://www.springframework.org/schema/beans/spring-beans-3.0.xsd  
        http://www.springframework.org/schema/security  
        http://www.springframework.org/schema/security/spring-security-3.1.xsd">  
        
        <bean id="sessionFactory" class="org.springframework.orm.hibernate3.LocalSessionFactoryBean">
        	<property name="dataSource" ref="Datasource"></property>
        	<property name="mappingLocations">
        		<list>
        			<value>classpath*:/hibernate/*.hbm.xml</value>
        		</list>
        	</property>
        </bean>
        <!-- 
        	这个类为用户登录 处理类，须要实现UserDetailsService接口  
        	重写 loadUserByUsername 方法，而且注意  此方法的返回值为UserDetails类型
        	而UserDetails 是一个接口，因此应该返回他的实现类 org.springframework.security.core.userdetails.User
        	注意org.springframework.security.core.userdetails.User的参数 有七个
        	username,用户登录名
        	password,密码
        	enabled,是否可用
        	accountNonExpired,set to true if the account has not expired
			credentialsNonExpired, set to true if the credentials have not expired
			accountNonLocked, set to true if the account is not locked
			authorities,是用户的权限集合 泛型为<?  extends GrantedAuthority> collection
			因此这个值须要咱们定义一个泛型为GrantedAuthority(这是一个接口 ，他的实现类为GrantedAuthorityImpl)集合
			咱们查询出对应的用户角色后 遍历 而且实例化GrantedAuthorityImpl 设置对应的角色代码 放入集合
			最后返回org.springframework.security.core.userdetails.User便可
        -->
        <bean id="Datasource" class="org.apache.commons.dbcp.BasicDataSource">
        	<property name="driverClassName" value="com.mysql.jdbc.Driver"></property>
        	<property name="url" value="*"></property>
        	<property name="username" value="**"></property>
        	<property name="password" value="***"></property>
        </bean>
    	<bean id="Userservices" class="services.userserviceDaoImp">
    		<property name="udi" ref="userdaoimp"></property>
    	</bean>
    	<bean id="userdaoimp" class="Dao.userDaoimp">
    		<property name="sessionFactory" ref="sessionFactory"></property>
    	</bean>
</beans>

用户登录操做类以下：数据库

package services;
import java.util.ArrayList;
import java.util.Collection;
import java.util.List;

import hibernate.Role;
import hibernate.User;

import org.springframework.security.config.http.UserDetailsServiceFactoryBean;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.GrantedAuthorityImpl;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;

import Dao.userDaoimp;


public class userserviceDaoImp implements UserDetailsService{
	private userDaoimp udi;
	public UserDetails loadUserByUsername(String username)
			throws UsernameNotFoundException {
		System.out.println(username);
		System.out.println(udi.getSessionFactory());
		User u=udi.getUserByname(username);
		System.out.println(u.toString());
		List<Role> list=udi.getRoleByUser(u);
		List<GrantedAuthority> rolelist=new ArrayList<GrantedAuthority>();
		for (int i = 0; i < list.size(); i++) {
			Role rol=list.get(i);
			System.out.println(rol.getRoleCode());
			GrantedAuthorityImpl gi=new GrantedAuthorityImpl(rol.getRoleCode());
			rolelist.add(gi);
		}
		org.springframework.security.core.userdetails.User user=new org.springframework.security.core.userdetails.User(u.getUsername(), u.getPassword(),true, true, true, true, rolelist);
		return user;
	}
	public userDaoimp getUdi() {
		return udi;
	}
	public void setUdi(userDaoimp udi) {
		this.udi = udi;
	}
	
}

这样整个配置完成apache

注意：我的管理器（userserviceDaoImp ）必须继承 UserDetailsService 。可是其中权限的处理方法可能不一样。上述的方法适用于Spring Security 3.*版本对于Spring Security 4.*的话处理方法不一样以下：session

public class AuthuserService extends SqlSessionTemplate implements UserDetailsService{
	public AuthuserService(SqlSessionFactory sqlSessionFactory) {
		super(sqlSessionFactory);
	}

	public UserDetails loadUserByUsername(String username)
			throws UsernameNotFoundException {
		UserServices us=new UserServices(getSqlSessionFactory());
		List<role> list=us.getRoleByusername(username);
		System.out.println(list);
		List<GrantedAuthority> rolelist=new ArrayList<GrantedAuthority>();
		for (int i = 0; i < list.size(); i++) {
			role rol=list.get(i);
			System.out.println(rol.getRoleCode());
            //在Spring Security 4.*中移除了GrantedAuthorityImpl类。添加了SimpleGrantedAuthority
            //咱们对权限的封装将采用这个类
			GrantedAuthority gi=new SimpleGrantedAuthority(rol.getRoleCode());
			rolelist.add(gi);
		}
		return new  User(username, "password", rolelist);
	}
	
}