spring security 3 中使用自定义数据库来设置权限

参考文档： http://wenku.baidu.com/view/4ec7e324ccbff121dd368364.html

 

在spring security3中使用自己定义的数据结构来实现权限设置。

 

  1. 数据库
    • 用户表
    • 角色表
    • action表，即资源表
    • 角色-用户关联表
    • actiion-角色关联表
  2. 配置过程
    • web.xml中加入过滤器
      [xhtml:nogutter] view plaincopy
      1. <!-- 配置spiring security -->  
      2.     <filter>  
      3.         <filter-name>springSecurityFilterChain</filter-name>  
      4.         <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>  
      5.     </filter>  
      6.     <filter-mapping>  
      7.         <filter-name>springSecurityFilterChain</filter-name>  
      8.         <url-pattern>/*</url-pattern>  
      9.     </filter-mapping>  
      10. <!-- 配置spiring security结束 -->  
       
    • 在applicationContext.xml中import spring security部分的配置
      [c-sharp] view plaincopy
      1. <import resource="security3.0_JPA.xml"/>   
    • 配置import resource="security3.0_JPA.xml
      [c-sharp:nogutter] view plaincopy
      1. <?xml version="1.0" encoding="UTF-8"?>  
      2. <beans:beans xmlns="http://www.springframework.org/schema/security" xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.springframework.org/schema/beans  
      3.            http://www.springframework.org/schema/beans/spring-beans-3.0.xsd  
      4.            http://www.springframework.org/schema/security  
      5.            http://www.springframework.org/schema/security/spring-security-3.0.xsd">  
      6.     <http auto-config="true" access-denied-page="/jsp/accessDenied.jsp">  
      7.         <intercept-url pattern="/css/**" filters="none" />  
      8.         <intercept-url pattern="/images/**" filters="none" />  
      9.         <intercept-url pattern="/js/**" filters="none" />  
      10.         <!-- 增加一个filter，这点与Acegi是不一样的，不能修改默认的filter了，  
      11.         这个filter位于FILTER_SECURITY_INTERCEPTOR之前  -->  
      12.         <custom-filter ref="myFilter" before="FILTER_SECURITY_INTERCEPTOR" />  
      13.     </http>  
      14.     <!-- 一个自定义的filter，必须包含authenticationManager,accessDecisionManager,securityMetadataSource三个属性，  
      15.         我们的所有控制将在这三个类中实现，解释详见具体配置  -->  
      16.     <beans:bean id="myFilter" class="com.softvan.spring.security.FilterSecurityInterceptor">  
      17.         <beans:property name="authenticationManager" ref="MyAuthenticationManager" />  
      18.         <!-- 访问决策器，决定某个用户具有的角色，是否有足够的权限去访问某个资源     -->  
      19.         <beans:property name="accessDecisionManager" ref="AccessDecisionManager" />  
      20.         <beans:property name="securityMetadataSource" ref="MySecurityMetadataSource" />  
      21.     </beans:bean>  
      22.     <!-- 资源源数据定义，将所有的资源和权限对应关系建立起来，即定义某一资源可以被哪些角色访问     -->  
      23.     <beans:bean id="MySecurityMetadataSource" init-method="loadResourceDefine"  class="com.softvan.spring.security.InvocationSecurityMetadataSourceService">  
      24.         <beans:property name="roleService" ref="RoleService" />  
      25.         <beans:property name="actionService" ref="ActionService" />  
      26.     </beans:bean>  
      27.   
      28.     <!-- 验证配置 ， 认证管理器，实现用户认证的入口，主要实现UserDetailsService接口即可 -->  
      29.     <authentication-manager alias="MyAuthenticationManager">  
      30.         <authentication-provider user-service-ref="UserDetailService">  
      31.             <!--  
      32.             <s:password-encoder hash="sha" />  
      33.              -->  
      34.         </authentication-provider>  
      35.     </authentication-manager>  
      36. </beans:beans>   
  3. 相关java代码
    • AccessDecisionManager.java
      [java:nogutter] view plaincopy
      1. /** 
      2.  *  
      3.  */  
      4. package com.softvan.spring.security;  
      5. import org.apache.log4j.Logger;  
      6. /** 
      7.  * @author 徐泽宇(roamer) 
      8.  * 
      9.  * 2010-7-4 
      10.  */  
      11. import java.util.Collection;  
      12. import java.util.Iterator;  
      13. import org.springframework.security.access.AccessDeniedException;  
      14. import org.springframework.security.access.ConfigAttribute;  
      15. import org.springframework.security.access.SecurityConfig;  
      16. import org.springframework.security.authentication.InsufficientAuthenticationException;  
      17. import org.springframework.security.core.Authentication;  
      18. import org.springframework.security.core.GrantedAuthority;  
      19. import org.springframework.stereotype.Service;  
      20. @Service("AccessDecisionManager")  
      21. public class AccessDecisionManager implements org.springframework.security.access.AccessDecisionManager {  
      22.     /** 
      23.      * Logger for this class 
      24.      */  
      25.     private static final Logger logger = Logger.getLogger(AccessDecisionManager.class);  
      26.     // In this method, need to compare authentication with configAttributes.  
      27.     // 1, A object is a URL, a filter was find permission configuration by this  
      28.     // URL, and pass to here.  
      29.     // 2, Check authentication has attribute in permission configuration  
      30.     // (configAttributes)  
      31.     // 3, If not match corresponding authentication, throw a  
      32.     // AccessDeniedException.  
      33.     public void decide(Authentication authentication, Object object, Collection<ConfigAttribute> configAttributes) throws AccessDeniedException, InsufficientAuthenticationException {  
      34.         if (logger.isDebugEnabled()) {  
      35.             logger.debug("decide(Authentication, Object, Collection<ConfigAttribute>) - start"); //$NON-NLS-1$  
      36.         }  
      37.         if (configAttributes == null) {  
      38.             if (logger.isDebugEnabled()) {  
      39.                 logger.debug("decide(Authentication, Object, Collection<ConfigAttribute>) - end"); //$NON-NLS-1$  
      40.             }  
      41.             return;  
      42.         }  
      43.         if (logger.isDebugEnabled()){  
      44.             logger.debug("正在访问的url是："+object.toString());  
      45.         }  
      46.         Iterator<ConfigAttribute> ite = configAttributes.iterator();  
      47.         while (ite.hasNext()) {  
      48.             ConfigAttribute ca = ite.next();  
      49.             logger.debug("needRole is："+ca.getAttribute());  
      50.             String needRole = ((SecurityConfig) ca).getAttribute();  
      51.             for (GrantedAuthority ga : authentication.getAuthorities()) {  
      52.                 logger.debug("/t授权信息是："+ga.getAuthority());  
      53.                 if (needRole.equals(ga.getAuthority())) { // ga is user's role.  
      54.                     if (logger.isDebugEnabled()) {  
      55.                         logger.debug("判断到，needRole 是"+needRole+",用户的角色是:"+ga.getAuthority()+"，授权数据相匹配");  
      56.                         logger.debug("decide(Authentication, Object, Collection<ConfigAttribute>) - end"); //$NON-NLS-1$  
      57.                     }  
      58.                     return;  
      59.                 }  
      60.             }  
      61.         }  
      62.         throw new AccessDeniedException("没有权限");  
      63.     }  
      64.     public boolean supports(ConfigAttribute attribute) {  
      65.         // TODO Auto-generated method stub  
      66.         return true;  
      67.     }  
      68.     public boolean supports(Class<?> clazz) {  
      69.         return true;  
      70.     }  
      71. }   
    • FilterSecurityInterceptor.java
      [java:nogutter] view plaincopy
      1. /** 
      2.  *  
      3.  */  
      4. package com.softvan.spring.security;  
      5. import org.apache.log4j.Logger;  
      6. /** 
      7.  * @author 徐泽宇(roamer) 
      8.  * 
      9.  * 2010-7-4 
      10.  */  
      11. import java.io.IOException;  
      12. import javax.servlet.Filter;  
      13. import javax.servlet.FilterChain;  
      14. import javax.servlet.FilterConfig;  
      15. import javax.servlet.ServletException;  
      16. import javax.servlet.ServletRequest;  
      17. import javax.servlet.ServletResponse;  
      18. import org.springframework.security.access.SecurityMetadataSource;  
      19. import org.springframework.security.access.intercept.AbstractSecurityInterceptor;  
      20. import org.springframework.security.access.intercept.InterceptorStatusToken;  
      21. import org.springframework.security.web.FilterInvocation;  
      22. import org.springframework.security.web.access.intercept.FilterInvocationSecurityMetadataSource;  
      23. public class FilterSecurityInterceptor extends AbstractSecurityInterceptor implements Filter {  
      24.     /** 
      25.      * Logger for this class 
      26.      */  
      27.     private static final Logger logger = Logger.getLogger(FilterSecurityInterceptor.class);  
      28.     private FilterInvocationSecurityMetadataSource securityMetadataSource;  
      29.     public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {  
      30.         if (logger.isDebugEnabled()) {  
      31.             logger.debug("doFilter(ServletRequest, ServletResponse, FilterChain) - start"); //$NON-NLS-1$  
      32.         }  
      33.         FilterInvocation fi = new FilterInvocation(request, response, chain);  
      34.         invoke(fi);  
      35.         if (logger.isDebugEnabled()) {  
      36.             logger.debug("doFilter(ServletRequest, ServletResponse, FilterChain) - end"); //$NON-NLS-1$  
      37.         }  
      38.     }  
      39.     public FilterInvocationSecurityMetadataSource getSecurityMetadataSource() {  
      40.         return this.securityMetadataSource;  
      41.     }  
      42.     public Class<? extends Object> getSecureObjectClass() {  
      43.         return FilterInvocation.class;  
      44.     }  
      45.     public void invoke(FilterInvocation fi) throws IOException, ServletException {  
      46.         InterceptorStatusToken token = super.beforeInvocation(fi);  
      47.         try {  
      48.             fi.getChain().doFilter(fi.getRequest(), fi.getResponse());  
      49.         } finally {  
      50.             super.afterInvocation(token, null);  
      51.         }  
      52.     }  
      53.     @Override  
      54.     public SecurityMetadataSource obtainSecurityMetadataSource() {  
      55.         return this.securityMetadataSource;  
      56.     }  
      57.     public void setSecurityMetadataSource(FilterInvocationSecurityMetadataSource securityMetadataSource) {  
      58.         this.securityMetadataSource = securityMetadataSource;  
      59.     }  
      60.     public void destroy() {  
      61.         // TODO Auto-generated method stub  
      62.     }  
      63.     public void init(FilterConfig filterconfig) throws ServletException {  
      64.         // TODO Auto-generated method stub  
      65.     }  
      66. }   
    • InvocationSecurityMetadataSourceService.java
      [java:nogutter] view plaincopy
      1. /** 
      2.  *  
      3.  */  
      4. package com.softvan.spring.security;  
      5. import java.util.ArrayList;  
      6. import java.util.Collection;  
      7. import java.util.HashMap;  
      8. import java.util.Iterator;  
      9. import java.util.List;  
      10. import java.util.Map;  
      11. import org.apache.log4j.Logger;  
      12. import org.springframework.security.access.ConfigAttribute;  
      13. import org.springframework.security.access.SecurityConfig;  
      14. import org.springframework.security.web.FilterInvocation;  
      15. import org.springframework.security.web.access.intercept.FilterInvocationSecurityMetadataSource;  
      16. import org.springframework.security.web.util.AntUrlPathMatcher;  
      17. import org.springframework.security.web.util.UrlMatcher;  
      18. import org.springframework.stereotype.Service;  
      19. import com.alcor.acl.domain.TAction;  
      20. import com.alcor.acl.domain.TRole;  
      21. import com.alcor.acl.service.ActionService;  
      22. import com.alcor.acl.service.RoleService;  
      23. /* 
      24.  *  
      25.  * 最核心的地方，就是提供某个资源对应的权限定义，即getAttributes方法返回的结果。 
      26.  * 注意，我例子中使用的是AntUrlPathMatcher这个path matcher来检查URL是否与资源定义匹配， 
      27.  * 事实上你还要用正则的方式来匹配，或者自己实现一个matcher。 
      28.  *  
      29.  * 此类在初始化时，应该取到所有资源及其对应角色的定义 
      30.  *  
      31.  * 说明：对于方法的spring注入，只能在方法和成员变量里注入， 
      32.  * 如果一个类要进行实例化的时候，不能注入对象和操作对象， 
      33.  * 所以在构造函数里不能进行操作注入的数据。 
      34.  */  
      35. @Service("InvocationSecurityMetadataSourceService")  
      36. public class InvocationSecurityMetadataSourceService implements FilterInvocationSecurityMetadataSource {  
      37.     /** 
      38.      * Logger for this class 
      39.      */  
      40.     private static final Logger logger = Logger.getLogger(InvocationSecurityMetadataSourceService.class);  
      41.       
      42.     private RoleService roleService ;  
      43.     private ActionService actionService;   
      44.       
      45.     private UrlMatcher urlMatcher = new AntUrlPathMatcher();  
      46.     private static Map<String, Collection<ConfigAttribute>> resourceMap = null;  
      47.     public  void loadResourceDefine()throws Exception  {  
      48.         this.resourceMap = new HashMap<String, Collection<ConfigAttribute>>();  
      49.           
      50.         //通过数据库中的信息设置，resouce和role  
      51.         for (TRole item:this.roleService.getAllRoles()){  
      52.             Collection<ConfigAttribute> atts = new ArrayList<ConfigAttribute>();  
      53.             ConfigAttribute ca = new SecurityConfig(item.getRoleName());  
      54.             atts.add(ca);  
      55.             List<TAction> tActionList = actionService.findByRoleID(item.getRoleId());  
      56.             //把资源放入到spring security的resouceMap中  
      57.             for(TAction tAction:tActionList){  
      58.                 logger.debug("获得角色：["+item.getRoleName()+"]拥有的acton有："+tAction.getActionUrl());  
      59.                 this.resourceMap.put(tAction.getActionUrl(), atts);  
      60.             }  
      61.         }  
      62.           
      63.         /*//通过硬编码设置，resouce和role 
      64.         resourceMap = new HashMap<String, Collection<ConfigAttribute>>(); 
      65.         Collection<ConfigAttribute> atts = new ArrayList<ConfigAttribute>(); 
      66.         ConfigAttribute ca = new SecurityConfig("admin");  
      67.         atts.add(ca);  
      68.         resourceMap.put("/jsp/admin.jsp", atts);  
      69.         resourceMap.put("/swf/zara.html", atts);*/   
      70.           
      71.     }  
      72.     // According to a URL, Find out permission configuration of this URL.  
      73.     public Collection<ConfigAttribute> getAttributes(Object object) throws IllegalArgumentException {  
      74.         if (logger.isDebugEnabled()) {  
      75.             logger.debug("getAttributes(Object) - start"); //$NON-NLS-1$  
      76.         }  
      77.         // guess object is a URL.  
      78.         String url = ((FilterInvocation) object).getRequestUrl();  
      79.         Iterator<String> ite = resourceMap.keySet().iterator();  
      80.         while (ite.hasNext()) {  
      81.             String resURL = ite.next();  
      82.             if (urlMatcher.pathMatchesUrl(url, resURL)) {  
      83.                 Collection<ConfigAttribute> returnCollection = resourceMap.get(resURL);  
      84.                 if (logger.isDebugEnabled()) {  
      85.                     logger.debug("getAttributes(Object) - end"); //$NON-NLS-1$  
      86.                 }  
      87.                 return returnCollection;  
      88.             }  
      89.         }  
      90.         if (logger.isDebugEnabled()) {  
      91.             logger.debug("getAttributes(Object) - end"); //$NON-NLS-1$  
      92.         }  
      93.         return null;  
      94.     }  
      95.     public boolean supports(Class<?> clazz) {  
      96.         return true;  
      97.     }  
      98.     public Collection<ConfigAttribute> getAllConfigAttributes() {  
      99.         return null;  
      100.     }  
      101.     public RoleService getRoleService() {  
      102.         return roleService;  
      103.     }  
      104.     public void setRoleService(RoleService roleService) {  
      105.         this.roleService = roleService;  
      106.     }  
      107.     public ActionService getActionService() {  
      108.         return actionService;  
      109.     }  
      110.     public void setActionService(ActionService actionService) {  
      111.         this.actionService = actionService;  
      112.     }  
      113. }   
    • UserDetailService.java
      [java:nogutter] view plaincopy
      1. /** 
      2.  *  
      3.  */  
      4. package com.softvan.spring.security;  
      5. import java.util.ArrayList;  
      6. import java.util.Collection;  
      7. import java.util.Set;  
      8. import javax.inject.Inject;  
      9. import org.apache.log4j.Logger;  
      10. import org.springframework.dao.DataAccessException;  
      11. import org.springframework.security.core.GrantedAuthority;  
      12. import org.springframework.security.core.authority.GrantedAuthorityImpl;  
      13. import org.springframework.security.core.userdetails.User;  
      14. import org.springframework.security.core.userdetails.UserDetails;  
      15. import org.springframework.security.core.userdetails.UserDetailsService;  
      16. import org.springframework.security.core.userdetails.UsernameNotFoundException;  
      17. import org.springframework.stereotype.Service;  
      18. import com.alcor.acl.domain.TRole;  
      19. import com.alcor.acl.domain.TUser;  
      20. @Service("UserDetailService")  
      21. public class UserDetailService implements UserDetailsService  {  
      22.     /** 
      23.      * Logger for this class 
      24.      */  
      25.     private static final Logger logger = Logger.getLogger(UserDetailService.class);  
      26.     @Inject  
      27.     com.alcor.acl.component.User user ;   
      28.           
      29.     public UserDetails loadUserByUsername(String username)throws UsernameNotFoundException, DataAccessException {  
      30.         if (logger.isDebugEnabled()) {  
      31.             logger.debug("loadUserByUsername(String) - start"); //$NON-NLS-1$  
      32.         }  
      33.               
      34.             Collection<GrantedAuthority> auths=new ArrayList<GrantedAuthority>();  
      35.               
      36.             String password=null;  
      37.             //取得用户的密码  
      38.             TUser tUser = user.getUserByName(username);  
      39.             if (tUser ==null){  
      40.                 String message = "用户"+username+"不存在";  
      41.                 logger.error(message);  
      42.                 throw new UsernameNotFoundException(message);  
      43.             }  
      44.             password=user.getUserByName(username).getPassword();  
      45.               
      46.             //获得用户的角色  
      47.             Set<TRole> tRoles =tUser.getTRoles();  
      48.             for(TRole item : tRoles){  
      49.                 GrantedAuthorityImpl grantedAuthorityImpl = new GrantedAuthorityImpl(item.getRoleName());  
      50.                 if (logger.isDebugEnabled()){  
      51.                     logger.debug("用户：["+tUser.getName()+"]拥有角色：["+item.getRoleName()+"],即spring security中的access");  
      52.                 }  
      53.                 auths.add(grantedAuthorityImpl);  
      54.             }  
      55.               
      56.             User user = new User(username,password, true, true, true, true, auths);  
      57.               
      58.         if (logger.isDebugEnabled()) {  
      59.             logger.debug("loadUserByUsername(String) - end"); //$NON-NLS-1$  
      60.         }  
      61.             return user;  
      62.     }  
      63. }  
posted @ 2012-02-18 13:28  张良  阅读(2762)  评论(0)  编辑  收藏  举报