自定义securityFilter过滤链

spring security3 网上的教程很多,但基本都是大同小异,大部分都是用标签配置,所以找了点时间看了下源码,我用的spring security3.1版本,使用bean声明的方式配置过滤链,看本文章需要读者对spring security3 有一定程度的了解

先来配置下web.xml,HttpSessionEventPublisher是使用session管理时需要用到的

         securityFilterChainProxy
         class>
             org.springframework.web.filter.DelegatingFilterProxy
         class>


         securityFilterChainProxy
         /*

接着我们要配置一条过滤链(值得注意的是这个bean的id要跟web.xml里配置的filter-name要一致才可以)

     "securityFilterChainProxy"
         class="org.springframework.security.web.FilterChainProxy">


                 "/services/**"
                     filters="none" />
                 "/test*" filters="none" />
                 "/**"
                     filters="concurrentSessionFilter,securityContextPersistenceFilter,logoutFilter,usernamePasswordAuthenticationFilter,rememberMeAuthenticationFilter,sessionManagementFilter,anonymousAuthFilter,exceptionTranslationFilter,filterSecurityInterceptor" />

下面我们逐个filter来看

首先是filterSecurityInterceptor,这是资源访问第一个要过的filter,至于这里面的属性注入请看我之前的spring security3 自定义权限管理的那篇文章

     "userDetailsService"
         class="com.shadow.security.service.UserDetailsServiceImpl" />


     "accessDecisionManager"
         class="com.shadow.security.service.AccessDecisionManagerImpl" />


     "securityMetadataSource"
         class="com.shadow.security.service.SecurityMetadataSourceExtendImpl">
         "matcher" value="ant" />



     "filterSecurityInterceptor"
         class="org.springframework.security.web.access.intercept.FilterSecurityInterceptor">
         "authenticationManager"
             ref="authenticationManager" />
         "accessDecisionManager"
             ref="accessDecisionManager" />
         "securityMetadataSource"
             ref="securityMetadataSource" />



         "webInvocationFilter"
                class="org.springframework.security.web.access.DefaultWebInvocationPrivilegeEvaluator">
                "filterSecurityInterceptor" />

然后是异常捕获的filter,里面有两个属性需要注入,authenticationEntryPoint是配置默认跳转的,accessDeniedHandler是配置当检测无权限访问跳转

     "exceptionTranslationFilter"
         class="org.springframework.security.web.access.ExceptionTranslationFilter">
         "authenticationEntryPoint"
             ref="authenticationEntryPoint" />
         "accessDeniedHandler">


                 class="org.springframework.security.web.access.AccessDeniedHandlerImpl">
                 "errorPage" value="/error/audit.jsp" />

然后是sessionManagementFilter,这个过滤器配置是否在登录后重新生成一个session防止伪造攻击

 "sessionManagementFilter"
     class="org.springframework.security.web.session.SessionManagementFilter">
     "securityContextRepository"
         ref="securityContextRepository" />
     "sessionAuthenticationStrategy"
         ref="concurrentSessionControlStrategy" />



 "concurrentSessionControlStrategy"
     class="org.springframework.security.web.authentication.session.ConcurrentSessionControlStrategy">
     "sessionRegistry" ref="sessionRegistry" />
     "maximumSessions" value="1" />
     "exceptionIfMaximumExceeded" value="false" />


 "sessionRegistry"
     class="org.springframework.security.core.session.SessionRegistryImpl" />


 "concurrentSessionFilter"
     class="org.springframework.security.web.session.ConcurrentSessionFilter">
     "sessionRegistry" ref="sessionRegistry" />
     "expiredUrl" value="/error/timeout.jsp" />
     "logoutHandlers">

             "logoutHandler" />

然后是rememberMeAuthenticationFilter,这个过滤器主要是配置记住密码功能

     "rememberMeAuthenticationFilter"
         class="org.springframework.security.web.authentication.rememberme.RememberMeAuthenticationFilter">
         "rememberMeServices" ref="rememberMeServices" />
         "authenticationManager"
             ref="authenticationManager" />

     "rememberMeServices"
         class="org.springframework.security.web.authentication.rememberme.TokenBasedRememberMeServices">
         "userDetailsService" ref="userDetailsService" />
         "parameter" value="rememberMe" />

         "tokenValiditySeconds" value="604800" />
         "key" value="springRocks" />

     "rememberMeAuthenticationProvider"
         class="org.springframework.security.authentication.RememberMeAuthenticationProvider">
         "key" value="springRocks" />

然后是usernamePasswordAuthenticationFilter请参考我之前的spring security3自定义权限管理那篇文章

然后是logoutFilter,这个过滤器主要是做安全注销功能,注入rememberMeServices属性是为了安全退出的时候把记住密码的状态也删除了

     "logoutFilter"
         class="org.springframework.security.web.authentication.logout.LogoutFilter">
         "/logout.jsp" />


                 "logoutHandler" />
                 "rememberMeServices" />


         "filterProcessesUrl" value="/logout" />



     "logoutHandler"
         class="org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler">

然后是securityContextPersistenceFilter,这个过滤器是为了持久化SecurityContext实例

     "securityContextPersistenceFilter"
         class="org.springframework.security.web.context.SecurityContextPersistenceFilter">
         "securityContextRepository"
             ref="securityContextRepository" />



     "securityContextRepository"
         class="org.springframework.security.web.context.HttpSessionSecurityContextRepository">
         "allowSessionCreation" value="true" />
         "disableUrlRewriting" value="false" />

然后是concurrentSessionFilter,这个过滤器是控制session并发问题

     "concurrentSessionFilter"
         class="org.springframework.security.web.session.ConcurrentSessionFilter">
         "sessionRegistry" ref="sessionRegistry" />
         "expiredUrl" value="/error/timeout.jsp" />
         "logoutHandlers">

                 "logoutHandler" />

然后大致的过滤链就配置好了,对于cas等那些有需要用到的filter就自己看看源码,放到链条里就可以了