spring security的简单应用

本文只包涵spring security配置部分，不是一个完整项目，不过可以任意添加到一个web项目中，不需要对原来的程序做任何修改

部分内容来源于网络，如有雷同，毫无意外

1、xml配置文件

<?xml version="1.0" encoding="UTF-8"?>

<beans:beans xmlns="http://www.springframework.org/schema/security"

    xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

    xmlns:context="http://www.springframework.org/schema/context"

    xsi:schemaLocation="http://www.springframework.org/schema/beans

http://www.springframework.org/schema/beans/spring-beans-3.0.xsd

http://www.springframework.org/schema/security

http://www.springframework.org/schema/security/spring-security-3.1.xsd">

    <global-method-security pre-post-annotations="enabled">

    </global-method-security>

    <!-- 不拦截的路径 -->

    <http pattern="/registerPage" security="none" />

    <http pattern="/mainPage" security="none"></http>

    <http pattern="/item/itemid**" security="none"></http>

    <http pattern="/css/**" security="none" />

    <http pattern="/font/**" security="none" />

    <http pattern="/images/**" security="none" />

    <http pattern="/js/**" security="none" />

    <http auto-config="true">

        <!-- 登录配置 -->

        <form-login login-page="/loginPage"

            authentication-failure-url="/login/failure"

            login-processing-url="/login"

            authentication-success-handler-ref="mySuccessHandler"

            username-parameter="username"

            password-parameter="password" />

        <!-- 用户登出 -->

        <logout invalidate-session="true" logout-success-url="/loginPage"

            logout-url="/logout" />

        <!-- 拦截页面 -->

        <intercept-url pattern="/item/**" access="ROLE_USER" />

        <intercept-url pattern="/admin/**" access="ROLE_USER" />

    </http>

    <!-- 登录成功的处理方法 -->

    <beans:bean id="mySuccessHandler" class="security.LoginSuccessHandle" ></beans:bean>

    <!-- 获取UserDettail的bean -->

    <beans:bean id="UserDetailService" class="security.MyUserDetailService"></beans:bean>

    <!-- 在这里也是一个大坑，查询网上的文章，这里都是引用的实现了UserDetailsService的类 -->

    <beans:bean id="UserService" class="security.SecurityProvider"></beans:bean>

    <authentication-manager>

        <authentication-provider ref="UserService">

        </authentication-provider>

    </authentication-manager>

</beans:beans>

2、用户权限信息类

省略相关数据库代码以及dao层代码

package po;

public class UserRole {

    private String username;

    private String password;

    private String role;

    public UserRole(String username, String password, String role) {

        super();

        this.username = username;

        this.password = password;

        this.role = role;

    }

    public String getUsername() {

        return username;

    }

    public void setUsername(String username) {

        this.username = username;

    }

    public String getPassword() {

        return password;

    }

    public void setPassword(String password) {

        this.password = password;

    }

    public String getRole() {

        return role;

    }

    public void setRole(String role) {

        this.role = role;

    }

}

3、MyUserDetail类，实现UserDetail接口，包含用户信息和用户权限类型

package security;

import java.util.Collection;

import org.springframework.security.core.GrantedAuthority;

import org.springframework.security.core.userdetails.UserDetails;

import po.UserRole;

public class MyUserDetail implements UserDetails {

    /**

     *

     */

    private static final long serialVersionUID = -5619502406659516775L;

    private UserRole myUser;

    private Collection<? extends GrantedAuthority> authorities;

    public MyUserDetail(UserRole user,Collection<? extends GrantedAuthority> authorities) {

        this.myUser = user;

        this.authorities = authorities;

    }

    public Collection<? extends GrantedAuthority> getAuthorities() {

        return authorities;

    }

    public UserRole getMyUser() {

        return myUser;

    }

    public String getPassword() {

        return myUser.getPassword();

    }

    public String getUsername() {

        return myUser.getUsername();

    }

    public boolean isAccountNonExpired() {

        return false;

    }

    public boolean isAccountNonLocked() {

        return false;

    }

    public boolean isCredentialsNonExpired() {

        return false;

    }

    public boolean isEnabled() {

        return false;

    }

}

4、MyUserDetailService类，实现UserDetailsService接口，用来获取一个UserDetail对象

package security;

import java.util.ArrayList;

import java.util.Collection;

import org.springframework.beans.factory.annotation.Autowired;

import org.springframework.security.core.GrantedAuthority;

import org.springframework.security.core.authority.SimpleGrantedAuthority;

import org.springframework.security.core.userdetails.UserDetails;

import org.springframework.security.core.userdetails.UserDetailsService;

import org.springframework.security.core.userdetails.UsernameNotFoundException;

import org.springframework.stereotype.Service;

import mapper.UserRoleMapper;

import po.UserRole;

@Service

public class MyUserDetailService implements UserDetailsService  {

    @Autowired

    UserRoleMapper userdao;

    public UserDetails loadUserByUsername(String username)

            throws UsernameNotFoundException {

        UserRole user =userdao.getUserByName(username);

        if(user==null)

        {

            throw new  UsernameNotFoundException("找不到该用户");

        }

//        Collection<GrantedAuthority> grantedAuthorities = new ArrayList<>();

//        SimpleGrantedAuthority grantedAuthority = new SimpleGrantedAuthority(role);

//        grantedAuthorities.add(grantedAuthority);

        return new MyUserDetail(user, getAuthorities(user.getRole()));

    }

    private Collection<GrantedAuthority> getAuthorities(String role) {

        Collection<GrantedAuthority> grantedAuthorities = new ArrayList<GrantedAuthority>();

        SimpleGrantedAuthority grantedAuthority = new SimpleGrantedAuthority(role);

        grantedAuthorities.add(grantedAuthority);

        return grantedAuthorities;

    }

}

5、SecurityProvider类，实现了AuthenticationProvider，返回一个UsernamePasswordAuthenticationToken

package security;

import org.springframework.beans.factory.annotation.Autowired;

import org.springframework.security.authentication.AuthenticationProvider;

import org.springframework.security.authentication.BadCredentialsException;

import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;

import org.springframework.security.core.Authentication;

import org.springframework.security.core.AuthenticationException;

import org.springframework.security.core.userdetails.UserDetails;

import org.springframework.security.core.userdetails.UsernameNotFoundException;

public class SecurityProvider implements AuthenticationProvider {

    @Autowired

    private MyUserDetailService userDetailsService;

    public Authentication authenticate(Authentication authentication)

            throws AuthenticationException {

        UsernamePasswordAuthenticationToken token = (UsernamePasswordAuthenticationToken) authentication;

        UserDetails userDetails = userDetailsService.loadUserByUsername(token.getName());

        if (userDetails == null) {

            throw new UsernameNotFoundException("找不到该用户");

        }

        if(!userDetails.getPassword().equals(token.getCredentials().toString()))

        {

              throw new BadCredentialsException("用户密码错误");

        }

        return new UsernamePasswordAuthenticationToken(userDetails, userDetails.getPassword(),userDetails.getAuthorities());

    }

    public boolean supports(Class<?> authentication) {

        return UsernamePasswordAuthenticationToken.class.equals(authentication);

    }

}

6、登录成功后自定义处理过程

spring security可以在配置文件中设置登录成功后的跳转页面，或者是直接返回认证前想要访问的页面，但是因为有时候用户是使用ajax请求登录，所以需要自定义一些操作，我是在登录成功后跳转到控制层url，

在url中携带需要跳转的参数，然后在控制层中将url参数返回到ajax，再由前端重新请求控制层跳转

package security;

import java.io.IOException;

import javax.servlet.ServletException;

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletResponse;

import org.springframework.beans.factory.InitializingBean;

import org.springframework.security.core.Authentication;

import org.springframework.security.web.authentication.AuthenticationSuccessHandler;

import org.springframework.security.web.savedrequest.HttpSessionRequestCache;

import org.springframework.security.web.savedrequest.RequestCache;

import org.springframework.security.web.savedrequest.SavedRequest;

public class LoginSuccessHandle implements AuthenticationSuccessHandler, InitializingBean {

    private RequestCache requestCache = new HttpSessionRequestCache();

    @Override

    public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authen)

            throws IOException, ServletException {

        SavedRequest savedRequest = requestCache.getRequest(request, response);

        // 默认认证后跳转路径

        String targetUrl = "/mainPage";

        // 如果登录前有请求为拦截页面，则验证后跳转到该页面

        if (savedRequest != null) {

            targetUrl = savedRequest.getRedirectUrl();

        }

        // 跳转到认证成功处理控制器

        response.sendRedirect("/loginSuccess?url=" + targetUrl);

    }

    @Override

    public void afterPropertiesSet() throws Exception {

    }

}

巴特西