spring security 3 中使用自定义数据库来设置权限

参考文档： http://wenku.baidu.com/view/4ec7e324ccbff121dd368364.html

 

在spring security3中使用自己定义的数据结构来实现权限设置。

 

1. 数据库
   • 用户表
   • 角色表
   • action表，即资源表
   • 角色-用户关联表
   • actiion-角色关联表
2. 配置过程
   • web.xml中加入过滤器
     <!-- 配置spiring security --> <filter> <filter-name>springSecurityFilterChain</filter-name> <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class> </filter> <filter-mapping> <filter-name>springSecurityFilterChain</filter-name> <url-pattern>/*</url-pattern> </filter-mapping> <!-- 配置spiring security结束 -->  
   • 在applicationContext.xml中import spring security部分的配置
     <import resource="security3.0_JPA.xml"/> 
   • 配置import resource="security3.0_JPA.xml
     <?xml version="1.0" encoding="UTF-8"?> <beans:beans xmlns="http://www.springframework.org/schema/security" xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.0.xsd"> <http auto-config="true" access-denied-page="/jsp/accessDenied.jsp"> <intercept-url pattern="/css/**" filters="none" /> <intercept-url pattern="/images/**" filters="none" /> <intercept-url pattern="/js/**" filters="none" /> <!-- 增加一个filter，这点与Acegi是不一样的，不能修改默认的filter了， 这个filter位于FILTER_SECURITY_INTERCEPTOR之前 --> <custom-filter ref="myFilter" before="FILTER_SECURITY_INTERCEPTOR" /> </http> <!-- 一个自定义的filter，必须包含authenticationManager,accessDecisionManager,securityMetadataSource三个属性， 我们的所有控制将在这三个类中实现，解释详见具体配置 --> <beans:bean id="myFilter" class="com.softvan.spring.security.FilterSecurityInterceptor"> <beans:property name="authenticationManager" ref="MyAuthenticationManager" /> <!-- 访问决策器，决定某个用户具有的角色，是否有足够的权限去访问某个资源 --> <beans:property name="accessDecisionManager" ref="AccessDecisionManager" /> <beans:property name="securityMetadataSource" ref="MySecurityMetadataSource" /> </beans:bean> <!-- 资源源数据定义，将所有的资源和权限对应关系建立起来，即定义某一资源可以被哪些角色访问 --> <beans:bean id="MySecurityMetadataSource" init-method="loadResourceDefine" class="com.softvan.spring.security.InvocationSecurityMetadataSourceService"> <beans:property name="roleService" ref="RoleService" /> <beans:property name="actionService" ref="ActionService" /> </beans:bean> <!-- 验证配置 ， 认证管理器，实现用户认证的入口，主要实现UserDetailsService接口即可 --> <authentication-manager alias="MyAuthenticationManager"> <authentication-provider user-service-ref="UserDetailService"> <!-- <s:password-encoder hash="sha" /> --> </authentication-provider> </authentication-manager> </beans:beans> 
3. 相关java代码
   • AccessDecisionManager.java
     /** * */ package com.softvan.spring.security; import org.apache.log4j.Logger; /** * @author 徐泽宇(roamer) * * 2010-7-4 */ import java.util.Collection; import java.util.Iterator; import org.springframework.security.access.AccessDeniedException; import org.springframework.security.access.ConfigAttribute; import org.springframework.security.access.SecurityConfig; import org.springframework.security.authentication.InsufficientAuthenticationException; import org.springframework.security.core.Authentication; import org.springframework.security.core.GrantedAuthority; import org.springframework.stereotype.Service; @Service("AccessDecisionManager") public class AccessDecisionManager implements org.springframework.security.access.AccessDecisionManager { /** * Logger for this class */ private static final Logger logger = Logger.getLogger(AccessDecisionManager.class); // In this method, need to compare authentication with configAttributes. // 1, A object is a URL, a filter was find permission configuration by this // URL, and pass to here. // 2, Check authentication has attribute in permission configuration // (configAttributes) // 3, If not match corresponding authentication, throw a // AccessDeniedException. public void decide(Authentication authentication, Object object, Collection<ConfigAttribute> configAttributes) throws AccessDeniedException, InsufficientAuthenticationException { if (logger.isDebugEnabled()) { logger.debug("decide(Authentication, Object, Collection<ConfigAttribute>) - start"); //$NON-NLS-1$ } if (configAttributes == null) { if (logger.isDebugEnabled()) { logger.debug("decide(Authentication, Object, Collection<ConfigAttribute>) - end"); //$NON-NLS-1$ } return; } if (logger.isDebugEnabled()){ logger.debug("正在访问的url是："+object.toString()); } Iterator<ConfigAttribute> ite = configAttributes.iterator(); while (ite.hasNext()) { ConfigAttribute ca = ite.next(); logger.debug("needRole is："+ca.getAttribute()); String needRole = ((SecurityConfig) ca).getAttribute(); for (GrantedAuthority ga : authentication.getAuthorities()) { logger.debug("/t授权信息是："+ga.getAuthority()); if (needRole.equals(ga.getAuthority())) { // ga is user's role. if (logger.isDebugEnabled()) { logger.debug("判断到，needRole 是"+needRole+",用户的角色是:"+ga.getAuthority()+"，授权数据相匹配"); logger.debug("decide(Authentication, Object, Collection<ConfigAttribute>) - end"); //$NON-NLS-1$ } return; } } } throw new AccessDeniedException("没有权限"); } public boolean supports(ConfigAttribute attribute) { // TODO Auto-generated method stub return true; } public boolean supports(Class<?> clazz) { return true; } } 
   • FilterSecurityInterceptor.java
     /** * */ package com.softvan.spring.security; import org.apache.log4j.Logger; /** * @author 徐泽宇(roamer) * * 2010-7-4 */ import java.io.IOException; import javax.servlet.Filter; import javax.servlet.FilterChain; import javax.servlet.FilterConfig; import javax.servlet.ServletException; import javax.servlet.ServletRequest; import javax.servlet.ServletResponse; import org.springframework.security.access.SecurityMetadataSource; import org.springframework.security.access.intercept.AbstractSecurityInterceptor; import org.springframework.security.access.intercept.InterceptorStatusToken; import org.springframework.security.web.FilterInvocation; import org.springframework.security.web.access.intercept.FilterInvocationSecurityMetadataSource; public class FilterSecurityInterceptor extends AbstractSecurityInterceptor implements Filter { /** * Logger for this class */ private static final Logger logger = Logger.getLogger(FilterSecurityInterceptor.class); private FilterInvocationSecurityMetadataSource securityMetadataSource; public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { if (logger.isDebugEnabled()) { logger.debug("doFilter(ServletRequest, ServletResponse, FilterChain) - start"); //$NON-NLS-1$ } FilterInvocation fi = new FilterInvocation(request, response, chain); invoke(fi); if (logger.isDebugEnabled()) { logger.debug("doFilter(ServletRequest, ServletResponse, FilterChain) - end"); //$NON-NLS-1$ } } public FilterInvocationSecurityMetadataSource getSecurityMetadataSource() { return this.securityMetadataSource; } public Class<? extends Object> getSecureObjectClass() { return FilterInvocation.class; } public void invoke(FilterInvocation fi) throws IOException, ServletException { InterceptorStatusToken token = super.beforeInvocation(fi); try { fi.getChain().doFilter(fi.getRequest(), fi.getResponse()); } finally { super.afterInvocation(token, null); } } @Override public SecurityMetadataSource obtainSecurityMetadataSource() { return this.securityMetadataSource; } public void setSecurityMetadataSource(FilterInvocationSecurityMetadataSource securityMetadataSource) { this.securityMetadataSource = securityMetadataSource; } public void destroy() { // TODO Auto-generated method stub } public void init(FilterConfig filterconfig) throws ServletException { // TODO Auto-generated method stub } } 
   • InvocationSecurityMetadataSourceService.java
     /** * */ package com.softvan.spring.security; import java.util.ArrayList; import java.util.Collection; import java.util.HashMap; import java.util.Iterator; import java.util.List; import java.util.Map; import org.apache.log4j.Logger; import org.springframework.security.access.ConfigAttribute; import org.springframework.security.access.SecurityConfig; import org.springframework.security.web.FilterInvocation; import org.springframework.security.web.access.intercept.FilterInvocationSecurityMetadataSource; import org.springframework.security.web.util.AntUrlPathMatcher; import org.springframework.security.web.util.UrlMatcher; import org.springframework.stereotype.Service; import com.alcor.acl.domain.TAction; import com.alcor.acl.domain.TRole; import com.alcor.acl.service.ActionService; import com.alcor.acl.service.RoleService; /* * * 最核心的地方，就是提供某个资源对应的权限定义，即getAttributes方法返回的结果。 * 注意，我例子中使用的是AntUrlPathMatcher这个path matcher来检查URL是否与资源定义匹配， * 事实上你还要用正则的方式来匹配，或者自己实现一个matcher。 * * 此类在初始化时，应该取到所有资源及其对应角色的定义 * * 说明：对于方法的spring注入，只能在方法和成员变量里注入， * 如果一个类要进行实例化的时候，不能注入对象和操作对象， * 所以在构造函数里不能进行操作注入的数据。 */ @Service("InvocationSecurityMetadataSourceService") public class InvocationSecurityMetadataSourceService implements FilterInvocationSecurityMetadataSource { /** * Logger for this class */ private static final Logger logger = Logger.getLogger(InvocationSecurityMetadataSourceService.class); private RoleService roleService ; private ActionService actionService; private UrlMatcher urlMatcher = new AntUrlPathMatcher(); private static Map<String, Collection<ConfigAttribute>> resourceMap = null; public void loadResourceDefine()throws Exception { this.resourceMap = new HashMap<String, Collection<ConfigAttribute>>(); //通过数据库中的信息设置，resouce和role for (TRole item:this.roleService.getAllRoles()){ Collection<ConfigAttribute> atts = new ArrayList<ConfigAttribute>(); ConfigAttribute ca = new SecurityConfig(item.getRoleName()); atts.add(ca); List<TAction> tActionList = actionService.findByRoleID(item.getRoleId()); //把资源放入到spring security的resouceMap中 for(TAction tAction:tActionList){ logger.debug("获得角色：["+item.getRoleName()+"]拥有的acton有："+tAction.getActionUrl()); this.resourceMap.put(tAction.getActionUrl(), atts); } } /*//通过硬编码设置，resouce和role resourceMap = new HashMap<String, Collection<ConfigAttribute>>(); Collection<ConfigAttribute> atts = new ArrayList<ConfigAttribute>(); ConfigAttribute ca = new SecurityConfig("admin"); atts.add(ca); resourceMap.put("/jsp/admin.jsp", atts); resourceMap.put("/swf/zara.html", atts);*/ } // According to a URL, Find out permission configuration of this URL. public Collection<ConfigAttribute> getAttributes(Object object) throws IllegalArgumentException { if (logger.isDebugEnabled()) { logger.debug("getAttributes(Object) - start"); //$NON-NLS-1$ } // guess object is a URL. String url = ((FilterInvocation) object).getRequestUrl(); Iterator<String> ite = resourceMap.keySet().iterator(); while (ite.hasNext()) { String resURL = ite.next(); if (urlMatcher.pathMatchesUrl(url, resURL)) { Collection<ConfigAttribute> returnCollection = resourceMap.get(resURL); if (logger.isDebugEnabled()) { logger.debug("getAttributes(Object) - end"); //$NON-NLS-1$ } return returnCollection; } } if (logger.isDebugEnabled()) { logger.debug("getAttributes(Object) - end"); //$NON-NLS-1$ } return null; } public boolean supports(Class<?> clazz) { return true; } public Collection<ConfigAttribute> getAllConfigAttributes() { return null; } public RoleService getRoleService() { return roleService; } public void setRoleService(RoleService roleService) { this.roleService = roleService; } public ActionService getActionService() { return actionService; } public void setActionService(ActionService actionService) { this.actionService = actionService; } } 
   • UserDetailService.java
     /** * */ package com.softvan.spring.security; import java.util.ArrayList; import java.util.Collection; import java.util.Set; import javax.inject.Inject; import org.apache.log4j.Logger; import org.springframework.dao.DataAccessException; import org.springframework.security.core.GrantedAuthority; import org.springframework.security.core.authority.GrantedAuthorityImpl; import org.springframework.security.core.userdetails.User; import org.springframework.security.core.userdetails.UserDetails; import org.springframework.security.core.userdetails.UserDetailsService; import org.springframework.security.core.userdetails.UsernameNotFoundException; import org.springframework.stereotype.Service; import com.alcor.acl.domain.TRole; import com.alcor.acl.domain.TUser; @Service("UserDetailService") public class UserDetailService implements UserDetailsService { /** * Logger for this class */ private static final Logger logger = Logger.getLogger(UserDetailService.class); @Inject com.alcor.acl.component.User user ; public UserDetails loadUserByUsername(String username)throws UsernameNotFoundException, DataAccessException { if (logger.isDebugEnabled()) { logger.debug("loadUserByUsername(String) - start"); //$NON-NLS-1$ } Collection<GrantedAuthority> auths=new ArrayList<GrantedAuthority>(); String password=null; //取得用户的密码 TUser tUser = user.getUserByName(username); if (tUser ==null){ String message = "用户"+username+"不存在"; logger.error(message); throw new UsernameNotFoundException(message); } password=user.getUserByName(username).getPassword(); //获得用户的角色 Set<TRole> tRoles =tUser.getTRoles(); for(TRole item : tRoles){ GrantedAuthorityImpl grantedAuthorityImpl = new GrantedAuthorityImpl(item.getRoleName()); if (logger.isDebugEnabled()){ logger.debug("用户：["+tUser.getName()+"]拥有角色：["+item.getRoleName()+"],即spring security中的access"); } auths.add(grantedAuthorityImpl); } User user = new User(username,password, true, true, true, true, auths); if (logger.isDebugEnabled()) { logger.debug("loadUserByUsername(String) - end"); //$NON-NLS-1$ } return user; } }