SpringMVC + security模块框架整合详解

最近整理一个二手后台管理项目，整体大体可分为： Springmvc + mybatis + tiles + easyui + security 这几个模块，再用maven做管理。刚拿到手里面东西实在太多，所以老大让重新整一个，只挑出骨架。不可否认，架构整体规划得还是很好的，尤其是前端界面用tiles+easyui ，开发很高效！其实，之前虽然听说过security，但做过的项目都没用过security，所以也算是一个新手！整合过程还是很烧脑的。

1、首先是springmvc部分，也是框架的最核心骨架部分。springmvc也是基于servlet框架完成的，所以我们都可以从web.xml入手，然后顺藤摸瓜，整理出整个架构。web.xml中主要部分是放置spring的各种配置：

[java] view plaincopy

<context-param>
<param-name>contextConfigLocation</param-name>
<param-value>
/WEB-INF/spring/appServlet/servlet-context.xml
</param-value>
</context-param>

和

[html] view plaincopy

<servlet>
<servlet-name>appServlet</servlet-name>
<servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
<init-param>
<param-name>contextConfigLocation</param-name>
<param-value>/WEB-INF/spring/appServlet/servlet-context.xml</param-value>
</init-param>
<load-on-startup>1</load-on-startup>
<async-supported>true</async-supported>
</servlet>
<servlet-mapping>
<servlet-name>appServlet</servlet-name>
<url-pattern>/</url-pattern>
</servlet-mapping>

这两部分指定了配置文件地址和web请求地址拦截规则。需要注意的是，然后配置文件里就是常用的注解、数据源、之类的，不一而足。

2、然后是security，本文实现了自定义的用户信息登录认证，主要部分：spring的security主要注意几个地方：

1）web.xml中配置security必须的过滤器，注意名字必须是springSecurityFilterChain,这是内置的过滤器；然后将过滤规则设置为/*，表示对所有请求都拦截。

2) 关于security的配置文件必须在<context-param>中加入，因为ContextLoaderListener在加载的时候就会去加载security相关的东西，而此时springmvc（servlet)模块还没有初始化。

二者配置如下：

[java] view plaincopy

<context-param>
<param-name>contextConfigLocation</param-name>
<param-value>
/WEB-INF/spring/appServlet/servlet-context.xml
</param-value>
</context-param>
<listener>
<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>
<filter>
<filter-name>springSecurityFilterChain</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
<filter-name>springSecurityFilterChain</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>

本文中security配置文件再servlet-context.xml中被引入，形如：

[java] view plaincopy

<beans:import resource="spring-security.xml"/>

3）spring-security.xml配置文件：

现在来看这个xml文件：

首先 <http>标签部分声明了访问拦截规则，这是security的关键。在这部分，我们先声明了一些不需要验证的资源和访问路径；然后是地址拦截规则部分：该部分拦截路径是/**，**表示可以跨目录结构，因此此处拦截该站点所有请求（除之前声明security=“none”的以外），然后拦截规则access="isAuthenticated()"，这是SecurityExpressionRoot中的判断是否认证过的方法之一，跟hasRole()类似，官方描述是Returns true if the user is not anonymous ，也就是用户认证后返回true。

[java] view plaincopy

<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security"
xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:security="http://www.springframework.org/schema/security"
xsi:schemaLocation="http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
http://www.springframework.org/schema/security
http://www.springframework.org/schema/security/spring-security-3.2.xsd">
<http pattern="/js/**" security="none"/>
<http pattern="/images/**" security="none"/>
<http pattern="/mgmt/**" security="none"/>
<http pattern="/image_sys/**" security="none"/>
<http pattern="/style/**" security="none"/>
<http pattern="/view/login.jsp" security="none"/>
<http pattern="/view/login/forgotPassword.jsp" security="none"/>
<http pattern="/securityCodeImage.html" security="none"/>
<http pattern="/checkSecurityCode.html" security="none"/>
<http pattern="/admin/validateMobile.html" security="none"/>
<http pattern="/verifycode/sendVerifyCode.html" security="none"/>
<http pattern="/admin/resetPassword.html" security="none"/>
<http use-expressions="true" entry-point-ref="authenticationProcessingFilterEntryPoint" access-denied-page="/view/403.jsp">
<intercept-url pattern="/**" access="isAuthenticated()" />
<remember-me />
<custom-filter ref="loginFilter" position="FORM_LOGIN_FILTER" />
<logout logout-url="/j_spring_security_logout" logout-success-url="/view/login.jsp" delete-cookies="JSESSIONID"/>
</http>
<beans:bean id="authenticationProcessingFilterEntryPoint" class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint">
<beans:property name="loginFormUrl" value="/view/login.jsp"></beans:property>
</beans:bean>
<beans:bean id="loginFilter"
class="com.security.AdminUsernamePasswordAuthenticationFilter">
<beans:property name="filterProcessesUrl" value="/j_spring_security_check"></beans:property>
<beans:property name="authenticationSuccessHandler" ref="myAuthenticationSuccessHandler"></beans:property>
<beans:property name="authenticationFailureHandler" ref="myAuthenticationFailureHandler"></beans:property>
<beans:property name="authenticationManager" ref="authenticationManager"></beans:property>
</beans:bean>
<beans:bean id="myAuthenticationFailureHandler"
class="org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler">
<beans:property name="defaultFailureUrl" value="/view/login.jsp?error=true" />
</beans:bean>
<beans:bean id="myAuthenticationSuccessHandler"
class="org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler">
<beans:property name="alwaysUseDefaultTargetUrl" value="true" />
<beans:property name="defaultTargetUrl" value="/index/homepage" />
</beans:bean>
<authentication-manager alias="authenticationManager" erase-credentials="false">
<authentication-provider ref="authenticationProvider" />
</authentication-manager>
<beans:bean id="authenticationProvider"
class="com.security.AdminAuthenticationProvider">
<beans:property name="userDetailsService" ref="userDetailsService" />
</beans:bean>
<beans:bean id="userDetailsService"
class="com.security.AdminUserDetailsService">
<beans:property name="adminService" ref="adminServiceImpl"></beans:property>
</beans:bean>

[java] view plaincopy

</beans:beans>

然后声明了自定义的用户登录的拦截器loginFilter，用于在登录时实现security认证。spring的登录认证模块执行顺序为：

1、UsernamePasswordAuthenticationFilter的attemptAuthentication（）方法，此部分可以做用户名密码的判断，正确后继续执行；

2、接下来调用AuthenticationManager的authenticate（）方法（中途具体怎么调用此处不深究），一个Mannager对应了多个authenticationProvider，其实最终是通过调用provider的authenticate（）方法来进行认证的，只要provider的supports方法返回true即可声明该provider或可进行认证，最后将被manager调用。在authenticate（）方法中，调用UserDetails的loadUserByUserName()方法来加载登录用户信息，包括权限信息，最后封装成AbstractAuthenticationToken,这个对象就是security模块认证后的用户完整信息。

自定义认证主要类如下：

[java] view plaincopy

/**
* 用户登录验证步骤一：attemptAutentication（）
*/
public class AdminUsernamePasswordAuthenticationFilter extends UsernamePasswordAuthenticationFilter {
public static final String VALIDATE_CODE = "validateCode";
public static final String USERNAME = "j_username";
public static final String PASSWORD = "j_password";
public static final String EMPLOYEENO = "j_employeeNo";
@Resource
private AdminService adminService;
@Override
public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response)
throws AuthenticationException {
if (!request.getMethod().equals("POST")) {
throw new AuthenticationServiceException("Authentication method not supported: " + request.getMethod());
}
// 判断用户信息
// UsernamePasswordAuthenticationToken实现 Authentication
UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(
adminModel.getAdminId(), password);
// 允许子类设置详细属性
setDetails(request, authRequest);
// 运行UserDetailsService的loadUserByUsername 再次封装Authentication
return this.getAuthenticationManager().authenticate(authRequest);
}
@Override
protected String obtainUsername(HttpServletRequest request) {
Object obj = request.getParameter(USERNAME);
return null == obj ? "" : obj.toString();
}
@Override
protected String obtainPassword(HttpServletRequest request) {
Object obj = request.getParameter(PASSWORD);
return null == obj ? "" : obj.toString();
}
}

[java] view plaincopy

/**
* 用户登录验证步骤二：authenticate（）
*/
public class AdminAuthenticationProvider implements AuthenticationProvider {
protected Logger logger = LoggerFactory.getLogger(this.getClass());
private UserDetailsService userDetailsService = null;
public AdminAuthenticationProvider() {
super();
}
/**
* @param userDetailsService
*/
public AdminAuthenticationProvider(UserDetailsService userDetailsService) {
super();
this.userDetailsService = userDetailsService;
}
public UserDetailsService getUserDetailsService() {
return userDetailsService;
}
public void setUserDetailsService(UserDetailsService userDetailsService) {
this.userDetailsService = userDetailsService;
}
/**
* provider的authenticate()方法，用于登录验证
*/
@SuppressWarnings("unchecked")
public Authentication authenticate(Authentication authentication) throws AuthenticationException {
// 1. Check username and password
try {
doLogin(authentication);
} catch (Exception e) {
if (e instanceof AuthenticationException) {
throw (AuthenticationException) e;
}
logger.error("failure to doLogin", e);
}
// 2. Get UserDetails
UserDetails userDetails = null;
try {
userDetails = this.userDetailsService.loadUserByUsername(authentication.getName());
} catch (Exception e) {
if (e instanceof AuthenticationException) {
throw (AuthenticationException) e;
}
logger.error("failure to get user detail", e);
}

[java] view plaincopy

// 3. Check and get all of admin roles and contexts.
Collection<GrantedAuthority> authorities = (Collection<GrantedAuthority>) userDetails.getAuthorities();
if (authorities != null && !authorities.isEmpty()) {
AdminAuthenticationToken token = new AdminAuthenticationToken(authentication.getName(),
authentication.getCredentials(), authorities);
token.setDetails(userDetails);
return token;
}
throw new BadCredentialsException("没有分配权限");
}
protected void doLogin(Authentication authentication) throws AuthenticationException {
}
@Override
public boolean supports(Class<?> authentication) {
// TODO Auto-generated method stub
return true;
}

[java] view plaincopy

/**用户详细信息获取
*/
public class AdminUserDetailsService implements UserDetailsService {
private Logger logger = LoggerFactory.getLogger(AdminUserDetailsService.class);
private AdminService adminService;
@Override
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
AdminUserDetails userDetails = new AdminUserDetails();
userDetails.setAdminId(username);
///加载用户基本信息
AdminModel adminModel = adminService.getAdminByAdminId(username);
try {
PropertyUtils.copyProperties(userDetails, adminModel);
} catch (IllegalAccessException e) {
logger.error("用户信息复制到userDetails出错",e);
} catch (InvocationTargetException e) {
logger.error("用户信息复制到userDetails出错",e);
} catch (NoSuchMethodException e) {
logger.error("用户信息复制到userDetails出错",e);
}
//加载权限信息
List<AdminRoleGrantedAuthority> authorities = this.adminService.getAuthorityByUserId(username);
if (authorities == null || authorities.size() == 0) {如果为普通用户
if (isCommonUserRequest()) {
AdminRoleGrantedAuthority authority =
new AdminRoleGrantedAuthority(AdminRoleGrantedAuthority.ADMIN_ROLE_TYPE_COMMON_USER);
userDetails.getAuthorities().add(authority);
} else {
logger.warn("person authorities is empty, personId is [{}]", username);
}
}
//加载用户权限
userDetails.getAuthorities().addAll(authorities);
///这个就是权限系统最后的用户信息
return userDetails;
}
private boolean isCommonUserRequest() {
// TODO Auto-generated method stub
return true;
}
public AdminService getAdminService() {
return adminService;
}
public void setAdminService(AdminService adminService) {
this.adminService = adminService;
}
}

[java] view plaincopy

public class AdminAuthenticationToken extends AbstractAuthenticationToken {
/**
*
*/
private static final long serialVersionUID = 5976309306377973996L;
private final Object principal;
private Object credentials;
public AdminAuthenticationToken(Object principal, Object credentials) {
super(null);
this.principal = principal;
this.credentials = credentials;
setAuthenticated(false);
}
c AdminAuthenticationToken(Object principal, Object credentials, Collection<? extends GrantedAuthority> authorities) {
super(authorities);
this.principal = principal;
this.credentials = credentials;
super.setAuthenticated(true); //注意，这里设置为true了！ must use super, as we override
}
public Object getCredentials() {
return this.credentials;
}
public Object getPrincipal() {
return this.principal;
}
public void setAuthenticated(boolean isAuthenticated) throws IllegalArgumentException {
if (isAuthenticated) {
throw new IllegalArgumentException("Cannot set this token to trusted - use constructor which takes a GrantedAuthority list instead");
}
super.setAuthenticated(false);
}
@Override
public void eraseCredentials() {
super.eraseCredentials();
credentials = null;
}
}

到这里基本就完成了spring security的设置，

4）最后就是jsp页面部分，页面主要是表单的action地址必须为：path+/j_spring_security_check,其中path是项目路径，然后登录的时候就可以使用security模块了！

至于文章中可能涉及到的一些bean或者service，这里就不贴代码了，毕竟项目较为完善，涉及东西太多，另外每个项目业务逻辑也不一样。

在整个框架整合过程中，遇到了很多奇怪的问题，很多是因为版本不一致引起的，建议用maven进行jar等依赖包的统一管理。

下面是spring security3.2的reference 手册：http://docs.spring.io/spring-security/site/docs/3.2.9.RELEASE/reference/htmlsingle/

SpringMVC + security模块框架整合详解相关推荐

Spring和Security整合详解
Spring和Security整合详解一.官方主页 Spring Security 二.概述 Spring 是一个非常流行和成功的 Java 应用开发框架.Spring Security 基于 Sp ...
Spring和Ehcache整合详解
Spring和Ehcache整合详解一.官方主页 Spring Cache 二.概述 EhCache 是一个纯Java的进程内缓存框架,具有快速.精干等特点. Spring 提供了对缓存功能的抽象: ...
java定时任务框架elasticjob详解
这篇文章主要介绍了java定时任务框架elasticjob详解,Elastic-Job是ddframe中dd-job的作业模块中分离出来的分布式弹性作业框架.该项目基于成熟的开源产品Quartz和Zo ...
springboot+jsp中文乱码_【spring 国际化】springMVC、springboot国际化处理详解
在web开发中我们常常会遇到国际化语言处理问题,那么如何来做到国际化呢? 你能get的知识点? 使用springgmvc与thymeleaf进行国际化处理. 使用springgmvc与jsp进行国际化 ...
Spring+SpringMVC+MyBatis+Maven框架整合
本文记录了Spring+SpringMVC+MyBatis+Maven框架整合的记录,主要记录以下几点一.Maven需要引入的jar包二.Spring与SpringMVC的配置分离三.Sp ...
layUI前端框架使用详解_layUI前端框架视频教程
百度云网盘下载 ayUI前端框架使用详解_layUI前端框架视频教程课程目录: 1前言 2为什么要用layUI框架 3layer组件的引用方法 4layer组件的使用方法详解 5用layer组件快速 ...
python中selenium模块驱动谷歌详解
python中selenium模块驱动谷歌详解 Selenium的介绍.配置和调用 Selenium(浏览器自动化测试框架) 是一个用于Web应用程序测试的工具.Selenium测试直接运行在浏览器中 ...
php tp框架,浅谈PHP之ThinkPHP框架使用详解
Thinkphp框架其精髓就在于实现了MVC思想,其中M为模板.V为视图.C为控制器,模板一般是公共使用类,在涉及数据库时,一般会跟数据表同名,视图会和控制器类里的方法进行名字的一一对应. 下载及配置 ...
java框架魔乐_16 魔乐科技 SpringBoot框架开发详解
资源内容: 16 魔乐科技 SpringBoot框架开发详解|____springboot开发代码.rar|____第一章:SpringBoot入门 |____2. SpringBo ...
layUI前端框架使用详解_layUI前端框架视频教程完整版
layUI前端框架使用详解_layUI前端框架视频教程课程目录: 1前言 2为什么要用layUI框架 3layer组件的引用方法 4layer组件的使用方法详解 5用layer组件快速开发一个表单验 ...

SpringMVC + security模块框架整合详解

SpringMVC + security模块框架整合详解相关推荐

最新文章

热门文章

SpringMVC + security模块 框架整合详解

SpringMVC + security模块 框架整合详解相关推荐

最新文章

热门文章

SpringMVC + security模块框架整合详解

SpringMVC + security模块框架整合详解相关推荐