package com.sunny.auth;import java.sql.ResultSet;
import java.sql.SQLException;
import java.util.ArrayList;
import java.util.Collection;
import java.util.LinkedHashMap;
import java.util.List;import javax.sql.DataSource;import org.springframework.jdbc.core.support.JdbcDaoSupport;
import org.springframework.jdbc.object.MappingSqlQuery;
import org.springframework.security.access.ConfigAttribute;
import org.springframework.security.access.SecurityConfig;
import org.springframework.security.web.util.AntPathRequestMatcher;
import org.springframework.security.web.util.RequestMatcher;public class JdbcRequestMapBulider extends JdbcDaoSupport{//查询资源和权限关系的sql语句private String resourceQuery = "";//查询资源@SuppressWarnings("unchecked")public List<Resource> findResources() {ResourceMapping resourceMapping = new ResourceMapping(getDataSource(), resourceQuery);return resourceMapping.execute();}//拼接RequestMappublic LinkedHashMap<RequestMatcher, Collection<ConfigAttribute>> buildRequestMap() {LinkedHashMap<RequestMatcher, Collection<ConfigAttribute>> requestMap = new LinkedHashMap<>();List<Resource> resourceList = this.findResources();for (Resource resource : resourceList) {RequestMatcher requestMatcher = this.getRequestMatcher(resource.getUrl());List<ConfigAttribute> list = new ArrayList<ConfigAttribute>();list.add(new SecurityConfig(resource.getRole()));requestMap.put(requestMatcher, list);}return requestMap;}//通过一个字符串地址构建一个AntPathRequestMatcher对象protected RequestMatcher getRequestMatcher(String url) {return new AntPathRequestMatcher(url);}public String getResourceQuery() {return resourceQuery;}public void setResourceQuery(String resourceQuery) {this.resourceQuery = resourceQuery;}/*** 内部类，用于封装访问地址和权限* @ClassName: Resource * @Description: TODO(这里用一句话描述这个类的作用) * @author Sunny* @date 2018年7月4日 下午2:42:59 **/private class Resource {private String url;//资源访问的地址private String role;//所需要的权限public Resource(String url, String role) {this.url = url;this.role = role;}public String getUrl() {return url;}public String getRole() {return role;}}@SuppressWarnings("rawtypes")private class ResourceMapping extends MappingSqlQuery {protected ResourceMapping(DataSource dataSource, String resourceQuery) {super(dataSource, resourceQuery);compile();}//对结果集进行封装处理protected Object mapRow(ResultSet rs, int rownum) throws SQLException {String url = rs.getString(1);String role = rs.getString(2);Resource resource = new Resource(url, role);return resource;}}
}

package com.sunny.auth;import java.util.Collection;
import java.util.HashSet;
import java.util.List;
import java.util.Map;
import java.util.Set;import javax.servlet.http.HttpServletRequest;import org.springframework.beans.factory.InitializingBean;
import org.springframework.security.access.ConfigAttribute;
import org.springframework.security.web.FilterInvocation;
import org.springframework.security.web.access.intercept.FilterInvocationSecurityMetadataSource;
import org.springframework.security.web.util.RequestMatcher;public class MyFilterInvocationSecurityMetadataSource implements FilterInvocationSecurityMetadataSource, InitializingBean{private final static List<ConfigAttribute> NULL_CONFIG_ATTRIBUTE = null;// 资源权限集合private Map<RequestMatcher, Collection<ConfigAttribute>> requestMap;//查找数据库权限和资源关系private JdbcRequestMapBulider builder;/** 更具访问资源的地址查找所需要的权限*/@Overridepublic Collection<ConfigAttribute> getAttributes(Object object) throws IllegalArgumentException {final HttpServletRequest request = ((FilterInvocation) object).getRequest();Collection<ConfigAttribute> attrs = NULL_CONFIG_ATTRIBUTE;for (Map.Entry<RequestMatcher, Collection<ConfigAttribute>> entry : requestMap.entrySet()) {if (entry.getKey().matches(request)) {attrs = entry.getValue();break;}}return attrs;}/** 获取所有的权限*/@Overridepublic Collection<ConfigAttribute> getAllConfigAttributes() {Set<ConfigAttribute> allAttributes = new HashSet<ConfigAttribute>();for (Map.Entry<RequestMatcher, Collection<ConfigAttribute>> entry : requestMap.entrySet()) {allAttributes.addAll(entry.getValue());}System.out.println("拥有权限："+allAttributes.toString());return allAttributes;}@Overridepublic boolean supports(Class<?> clazz) {return FilterInvocation.class.isAssignableFrom(clazz);}//绑定requestMapprotected Map<RequestMatcher, Collection<ConfigAttribute>> bindRequestMap() {return builder.buildRequestMap();}@Overridepublic void afterPropertiesSet() throws Exception {this.requestMap = this.bindRequestMap();}public void refreshResuorceMap() {this.requestMap = this.bindRequestMap();}/******************* GET & SET *******************************/public JdbcRequestMapBulider getBuilder() {return builder;}public void setBuilder(JdbcRequestMapBulider builder) {this.builder = builder;}
}

<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security"xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"xsi:schemaLocation="http://www.springframework.org/schema/beanshttp://www.springframework.org/schema/beans/spring-beans-3.0.xsdhttp://www.springframework.org/schema/contexthttp://www.springframework.org/schema/context/spring-context-3.1.xsdhttp://www.springframework.org/schema/txhttp://www.springframework.org/schema/tx/spring-tx-3.0.xsdhttp://www.springframework.org/schema/securityhttp://www.springframework.org/schema/security/spring-security.xsd"><!-- 数据源 --><beans:bean id="dataSource" class="com.mchange.v2.c3p0.ComboPooledDataSource" destroy-method="close"><!-- 此为c3p0在spring中直接配置datasource c3p0是一个开源的JDBC连接池 --><beans:property name="driverClass" value="com.mysql.jdbc.Driver" /><beans:property name="jdbcUrl" value="jdbc:mysql://localhost:3306/springsecurity?useUnicode=true&amp;characterEncoding=UTF-8" /><beans:property name="user" value="root" /><beans:property name="password" value="" /><beans:property name="maxPoolSize" value="50"></beans:property><beans:property name="minPoolSize" value="10"></beans:property><beans:property name="initialPoolSize" value="10"></beans:property><beans:property name="maxIdleTime" value="25000"></beans:property><beans:property name="acquireIncrement" value="1"></beans:property><beans:property name="acquireRetryAttempts" value="30"></beans:property><beans:property name="acquireRetryDelay" value="1000"></beans:property><beans:property name="testConnectionOnCheckin" value="true"></beans:property><beans:property name="idleConnectionTestPeriod" value="18000"></beans:property><beans:property name="checkoutTimeout" value="5000"></beans:property><beans:property name="automaticTestTable" value="t_c3p0"></beans:property></beans:bean>
</beans:beans>

<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security"xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"xsi:schemaLocation="http://www.springframework.org/schema/beanshttp://www.springframework.org/schema/beans/spring-beans-3.0.xsdhttp://www.springframework.org/schema/contexthttp://www.springframework.org/schema/context/spring-context-3.1.xsdhttp://www.springframework.org/schema/txhttp://www.springframework.org/schema/tx/spring-tx-3.0.xsdhttp://www.springframework.org/schema/securityhttp://www.springframework.org/schema/security/spring-security.xsd"><!-- 不需要访问权限 --><http pattern="/page/login.jsp" security="none"></http><http auto-config="false"><form-login login-page="/page/login.jsp" default-target-url="/page/admin.jsp" authentication-failure-url="/page/login.jsp?error=true" /><logout invalidate-session="true" logout-success-url="/page/login.jsp" logout-url="/j_spring_security_logout" /><!-- 通过配置custom-filter来增加过滤器，before="FILTER_SECURITY_INTERCEPTOR"表示在SpringSecurity默认的过滤器之前执行。 --><custom-filter ref="filterSecurityInterceptor" before="FILTER_SECURITY_INTERCEPTOR" /></http><!-- 认证过滤器 --><beans:bean id="filterSecurityInterceptor" class="org.springframework.security.web.access.intercept.FilterSecurityInterceptor"><!-- 用户拥有的权限 --><beans:property name="accessDecisionManager" ref="accessDecisionManager" /><!-- 用户是否拥有所请求资源的权限 --><beans:property name="authenticationManager" ref="authenticationManager" /><!-- 资源与权限对应关系 --><beans:property name="securityMetadataSource" ref="securityMetadataSource" /></beans:bean><!-- 授权管理器 --><beans:bean id="accessDecisionManager" class="com.sunny.auth.MyAccessDecisionManager"></beans:bean><!--自定义的切入点--><beans:bean id="securityMetadataSource" class="com.sunny.auth.MyFilterInvocationSecurityMetadataSource"><beans:property name="builder" ref="builder"></beans:property></beans:bean><beans:bean id="builder" class="com.sunny.auth.JdbcRequestMapBulider"> <beans:property name="dataSource" ref="dataSource" /> <beans:property name="resourceQuery"value="select re.res_string,r.name from role r,resc re,resc_role rr where r.id=rr.role_id and re.id=rr.resc_id" /> </beans:bean><!--认证管理--><authentication-manager alias="authenticationManager"><authentication-provider><jdbc-user-service data-source-ref="dataSource" id="usersService"users-by-username-query="select username,password,status as enabled from user where username = ?"authorities-by-username-query="select user.username,role.name from user,role,user_role where user.id=user_role.user_id and user_role.role_id=role.id and user.username=?" /></authentication-provider></authentication-manager></beans:beans>

package com.sunny.auth;import java.util.Collection;
import java.util.Iterator;import org.springframework.security.access.AccessDecisionManager;
import org.springframework.security.access.AccessDeniedException;
import org.springframework.security.access.ConfigAttribute;
import org.springframework.security.authentication.InsufficientAuthenticationException;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.GrantedAuthority;public class MyAccessDecisionManager implements AccessDecisionManager{/* * 该方法决定该权限是否有权限访问该资源，其实object就是一个资源的地址，authentication是当前用户的* 对应权限，如果没登陆就为游客，登陆了就是该用户对应的权限*/@Overridepublic void decide(Authentication authentication, Object object, Collection<ConfigAttribute> configAttributes)throws AccessDeniedException, InsufficientAuthenticationException {if(configAttributes == null) {  return;}  //所请求的资源拥有的权限(一个资源对多个权限)  Iterator<ConfigAttribute> iterator = configAttributes.iterator();  while(iterator.hasNext()) {  ConfigAttribute configAttribute = iterator.next();  //访问所请求资源所需要的权限  String needPermission = configAttribute.getAttribute();  System.out.println("访问"+object.toString()+"需要的权限是：" + needPermission);  //用户所拥有的权限authentication  Collection<? extends GrantedAuthority> authorities = authentication.getAuthorities();for(GrantedAuthority ga : authorities) {  if(needPermission.equals(ga.getAuthority())) {  return;}  }}//没有权限  throw new AccessDeniedException("没有权限访问！ ");  }@Overridepublic boolean supports(ConfigAttribute attribute) {return true;}@Overridepublic boolean supports(Class<?> clazz) {return true;}
}

pom.xml中增加

            <!-- j2ee --><dependency><groupId>javax.servlet</groupId><artifactId>javax.servlet-api</artifactId><version>3.1.0</version></dependency>        

web.xml默认页面仍然是

五 结果