欢迎您访问程序员文章站本站旨在为大家提供分享程序员计算机编程知识!
您现在的位置是: 首页

spring security3使用笔记

程序员文章站 2022-07-14 21:21:11
...

 

 

先对项目中用到的security进行总结如下:

  • sample

      熟悉一个example,了解一些security的运行机制

      例如参照spring-security-samples-tutorial-3.1.x.war,直接放到tomcat下webapps下

  • sample 集成到自己的项目中去

      这一步也很简单,就是把sample的配置拷贝到自己的项目中去。web.xml的配置添加进去,追加applicationContext-security.xml文件,只需简单地修改一下intercept-url,也可不修改,都拷贝过去。

  • 改造applicationContext-security

      由于例子中,使用的都是自动生成的login页面,而且用户信息是在配置文件中指定的,因此需要改造。我主要是从两方面去改造的。首先修改成自己的登录页,其次,从数据库中获取用户信息。

 

     如何修改成自己的登录login页呢?我主要参考了http://www.blogjava.net/youxia/archive/2008/12/07/244883.html,对整个security框架有了个整体了解,其次阅读了http://www.blogjava.net/SpartaYew/archive/2011/06/15/350630.html对security的不同配置方案,了解到security的如何配置。最终我还是查找的springsecurity官方pdf,了解<form-login>元素使用,配置login-page和login-processing-url就可替换成自己的login,default-target-url属性是自动跳转的页面。到目前为止感觉有点乱,实际上很简单的,就是整个form提交的流程,首先是login页面,用户输入信息,其次是login提交的处理的url,就是action的路径,其次就是处理成功跳转和处理失败跳转的页面。因此具体的配置属性可参考文档,如果你的是myeclipse,把鼠标放到<form-login>,可通过properties视图查看到所有的可配置属性,同理退出也需要自定义的页面。

 

     接下来就是如何从数据库读取用户信息?从以上两个网址上已经了解到只要修改UserDetailService,也就是user-service,修改的方式很多种,我直接选择的sql语句。这点我是从http://download.csdn.net/detail/klitao/2764850下载例子,各种各样的配置的例子都有。这样基本的配置基本搞定。参照代码如下:

<http use-expressions="true">

		<intercept-url pattern="/login.html" access="permitAll" />
		<intercept-url pattern="/loginprocess.html" access="permitAll" />
		<intercept-url pattern="/welcome.html" access="isAuthenticated()" />
		<intercept-url pattern="/ad/**" access="hasRole('ROLE_SYSTEM')" />
		<intercept-url pattern="/account/**" access="hasRole('ROLE_SYSTEM')" />
		<intercept-url pattern="/picc/**"
			access="hasAnyRole('ROLE_SYSTEM','ROLE_PICC')" />
		<intercept-url pattern="/**" access="denyAll" />
		<form-login login-page="/login.html"
			authentication-failure-url="/login.html" default-target-url="/"
			login-processing-url="/loginprocess.html" />
		<logout logout-success-url="/login.html" logout-url="/logout.html" />
		<remember-me />

		<session-management>
			<concurrency-control max-sessions="1"
				error-if-maximum-exceeded="true" />
		</session-management>

	</http>

	
	<authentication-manager>
		<authentication-provider user-service-ref="scskUserDetailsService">
			<password-encoder hash="md5">
				<salt-source user-property="username" />
			</password-encoder>
		</authentication-provider>
	</authentication-manager>
	
	<beans:bean id="scskUserDetailsService"
		class="org.springframework.security.core.userdetails.jdbc.JdbcDaoImpl">
		<beans:property name="dataSource" ref="dataSourceOrcl" />
		<beans:property name="usersByUsernameQuery"
			value="select t.account, t.password, decode(status, 0, 1, 0) as status from U_USERS t where t.account = ?" />
		<beans:property name="authoritiesByUsernameQuery"
			value="select t.account, t.user_role from U_USERS t where t.account = ?" />
	</beans:bean>
 

 

到目前为止,基本搞定security的简单配置。但是总感觉有点云里雾里的感觉,文档写的太零散,只能做手册查询了。然后到网上搜,总算发现了一本比较的security3书,请参考http://lengyun3566.iteye.com/blog/1068998,这里是中文的翻译,书写得也很好,翻译的也很不错的。大家自己认真读下,我保证收获颇丰!这样就会对security3有个完整清晰的认识!以后想扩展想改造,就不会摸石头过河啦!另外登录页追加验证参照http://www.iteye.com/topic/720867,我的配置如下

<http use-expressions="true" entry-point-ref="authenticationProcessingFilterEntryPoint">
		<intercept-url pattern="/login.html" access="permitAll" />
		<intercept-url pattern="/loginprocess.html" access="permitAll" />
		<intercept-url pattern="/upload.html" access="permitAll" />
		<intercept-url pattern="/public/**" access="permitAll" />
		<intercept-url pattern="/editUpload.html" access="permitAll" />
		<intercept-url pattern="/ad/**" access="hasRole('ROLE_SYSTEM')" />
		<intercept-url pattern="/account/**" access="hasRole('ROLE_SYSTEM')" />
		<intercept-url pattern="/picc/**"
			access="hasAnyRole('ROLE_SYSTEM','ROLE_PICC')" />
		<intercept-url pattern="/**" access="isAuthenticated()" />
		
		<custom-filter ref="scskUserLoginFilter" position="FORM_LOGIN_FILTER" />
		<!--  
		<form-login login-page="/login.html"
			authentication-failure-url="/login.html" default-target-url="/"
			login-processing-url="/loginprocess.html" />
		-->
		<logout logout-success-url="/login.html" logout-url="/logout.html" />
		<remember-me />
		
		<session-management>
			<concurrency-control max-sessions="1"
				error-if-maximum-exceeded="false" />
		</session-management>

	</http>

	<beans:bean id="authenticationProcessingFilterEntryPoint"
		class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint">
		<beans:property name="loginFormUrl" value="/login.html"></beans:property>
	</beans:bean>
	<beans:bean id="scskUserLoginFilter" class="com.ccc.scsk.filter.UserLoginFilter">
		<beans:property name="filterProcessesUrl" value="/loginprocess.html"></beans:property>
		<beans:property name="authenticationSuccessHandler"
			ref="loginLogAuthenticationSuccessHandler"></beans:property>
		<beans:property name="authenticationFailureHandler"
			ref="simpleUrlAuthenticationFailureHandler"></beans:property>
		<beans:property name="authenticationManager" ref="authenticationManager"></beans:property>
	</beans:bean>
	<beans:bean id="loginLogAuthenticationSuccessHandler"
		class="org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler">
		<beans:property name="defaultTargetUrl" value="/"></beans:property>
	</beans:bean>
	<beans:bean id="simpleUrlAuthenticationFailureHandler"
		class="org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler">
		<beans:property name="defaultFailureUrl" value="/login.html"></beans:property>
	</beans:bean>


	<authentication-manager alias="authenticationManager">
		<authentication-provider user-service-ref="scskUserDetailsService">
			<password-encoder hash="md5">
				<salt-source user-property="username" />
			</password-encoder>
		</authentication-provider>
	</authentication-manager>

	<beans:bean id="scskUserDetailsService"
		class="org.springframework.security.core.userdetails.jdbc.JdbcDaoImpl">
		<beans:property name="dataSource" ref="dataSourceOrcl" />
		<beans:property name="usersByUsernameQuery"
			value="select t.account, t.password, decode(status, 0, 1, 0) as status from U_USERS t where t.account = ?" />
		<beans:property name="authoritiesByUsernameQuery"
			value="select t.account, t.user_role from U_USERS t where t.account = ?" />
	</beans:bean>
	
	 <beans:bean id="messageSource" class="org.springframework.context.support.ResourceBundleMessageSource">
        <beans:property name="basename" value="org/springframework/security/messages" />
    </beans:bean>
 

       总之,参考文档,参考实例,多阅读相关的文档,多动手就可搞定的,不过,一定要把基础打牢的,最起码要熟悉一般的流程,对验证的基本流程要熟悉的,推荐要熟悉http://lengyun3566.iteye.com/blog/1103107内容

http://lengyun3566.iteye.com/blog/1103107 写道
推荐学习security的必备书