spring security 登录、权限管理配置

登录流程

1）容器启动(MySecurityMetadataSource：loadResourceDefine加载系统资源与权限列表)

 2）用户发出请求

 3）过滤器拦截(MySecurityFilter:doFilter)

 4）取得请求资源所需权限(MySecurityMetadataSource:getAttributes)

 5）匹配用户拥有权限和请求权限(MyAccessDecisionManager:decide)，如果用户没有相应的权限，

     执行第6步，否则执行第7步。

 6）登录

 7）验证并授权(MyUserDetailServiceImpl:loadUserByUsername)

1、web.xml中加入过滤器

​

2. <!-- SpringSecurity 核心过滤器配置 -->  
3. <filter>  
4.     <filter-name>springSecurityFilterChain</filter-name>  
5.     <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>  
6. </filter>  
7. <filter-mapping>  
8.     <filter-name>springSecurityFilterChain</filter-name>  
9.     <url-pattern>/*</url-pattern>  
10. </filter-mapping>  

<!-- SpringSecurity 核心过滤器配置 -->
<filter>
    <filter-name>springSecurityFilterChain</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
    <filter-name>springSecurityFilterChain</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

2、新建spring-security.xml文件

​

2. <?xml version="1.0" encoding="UTF-8"?>  
3. <beans:beans xmlns="http://www.springframework.org/schema/security"  
4.     xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"  
5.     xsi:schemaLocation="http://www.springframework.org/schema/beans  
6.     http://www.springframework.org/schema/beans/spring-beans.xsd  
7.     http://www.springframework.org/schema/security  
8.     http://www.springframework.org/schema/security/spring-security.xsd">  
9.   
10.     <!-- entry-point-ref 配置自定义登录 -->  
11.     <http use-expressions="true" entry-point-ref="authenticationProcessingFilterEntryPoint">  
12.           
13.         <!-- 登出配置 -->  
14.         <logout logout-url="/j_spring_security_logout" logout-success-url="/login" />  
15.   
16.         <access-denied-handler error-page="/noPower" />  
17.           
18.         <!-- 过滤不被拦截的请求 -->  
19.         <intercept-url pattern="/login*" access="permitAll" />  
20.         <intercept-url pattern="/resources/**" access="permitAll" />  
21.           
22.         <!-- 只有权限才能访问的请求 -->  
23.         <intercept-url pattern="/admin/**" access="isAuthenticated()" />  
24.   
25.         <custom-filter ref="loginFilter" position="FORM_LOGIN_FILTER" />  
26.         <custom-filter ref="securityFilter" before="FILTER_SECURITY_INTERCEPTOR" />  
27.   
28.     </http>  
29.   
30.     <beans:bean id="loginFilter"  
31.         class="cn.com.abel.test.service.security.MyUsernamePasswordAuthenticationFilter">  
32.           
33.         <!-- 登录提交处理 -->  
34.         <beans:property name="filterProcessesUrl" value="/j_spring_security_check"></beans:property>  
35.           
36.         <!-- 登录成功跳转 -->  
37.         <beans:property name="authenticationSuccessHandler"  
38.             ref="loginLogAuthenticationSuccessHandler"></beans:property>  
39.           
40.         <!-- 设置登录失败的网址 -->  
41.         <beans:property name="authenticationFailureHandler"  
42.             ref="simpleUrlAuthenticationFailureHandler"></beans:property>  
43.           
44.         <!-- 用户拥有权限 -->     
45.         <beans:property name="authenticationManager" ref="myAuthenticationManager"></beans:property>  
46.     </beans:bean>  
47.   
48.     <beans:bean id="loginLogAuthenticationSuccessHandler"  
49.         class="org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler">  
50.         <beans:property name="defaultTargetUrl" value="/admin/index"></beans:property>  
51.     </beans:bean>  
52.     <beans:bean id="simpleUrlAuthenticationFailureHandler"  
53.         class="org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler">  
54.         <beans:property name="defaultFailureUrl" value="/login"></beans:property>  
55.     </beans:bean>  
56.   
57.     <authentication-manager alias="myAuthenticationManager">  
58.         <authentication-provider user-service-ref="myUserDetailServiceImpl">  
59.             <password-encoder ref="encoder" />  
60.         </authentication-provider>  
61.     </authentication-manager>  
62.   
63.     <beans:bean id="myUserDetailServiceImpl"  
64.         class="cn.com.abel.test.service.security.AdminUserDetailServiceImpl">  
65.     </beans:bean>  
66.   
67.     <beans:bean id="authenticationProcessingFilterEntryPoint"  
68.         class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint">  
69.         <beans:property name="loginFormUrl" value="/login"></beans:property>  
70.     </beans:bean>  
71.   
72.     <!-- 认证过滤器 -->  
73.     <beans:bean id="securityFilter"  
74.         class="cn.com.abel.test.service.security.MySecurityFilter">  
75.         <!-- 用户拥有的角色 -->  
76.         <beans:property name="authenticationManager" ref="myAuthenticationManager" />  
77.         <!-- 用户是否拥有所请求资源的权限 -->  
78.         <beans:property name="accessDecisionManager" ref="myAccessDecisionManager" />  
79.         <!-- 资源与角色的对应关系 -->  
80.         <beans:property name="securityMetadataSource" ref="mySecurityMetadataSource" />  
81.         <!-- <beans:property name="rejectPublicInvocations" value="true"/> -->  
82.   
83.     </beans:bean>  
84.       
85.     <beans:bean id="myAccessDecisionManager" class="myAccessDecisionManager"></beans:bean>  
86.       
87.     <beans:bean id="mySecurityMetadataSource"  
88.         class="cn.com.abel.test.service.security.MySecurityMetadataSource">  
89.         <beans:constructor-arg>  
90.             <beans:ref bean="resourceService" />  
91.         </beans:constructor-arg>  
92.     </beans:bean>  
93.   
94.     <beans:bean id="encoder" class="org.springframework.security.authentication.encoding.Md5PasswordEncoder"></beans:bean>  
95.     
96. </beans:beans>  

<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security"
  xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://www.springframework.org/schema/beans
  http://www.springframework.org/schema/beans/spring-beans.xsd
  http://www.springframework.org/schema/security
  http://www.springframework.org/schema/security/spring-security.xsd">
<!-- entry-point-ref 配置自定义登录 -->
<http use-expressions="true" entry-point-ref="authenticationProcessingFilterEntryPoint">

  <!-- 登出配置 -->
  <logout logout-url="/j_spring_security_logout" logout-success-url="/login" />

  <access-denied-handler error-page="/noPower" />

  <!-- 过滤不被拦截的请求 -->
  <intercept-url pattern="/login*" access="permitAll" />
  <intercept-url pattern="/resources/**" access="permitAll" />

  <!-- 只有权限才能访问的请求 -->
  <intercept-url pattern="/admin/**" access="isAuthenticated()" />

  <custom-filter ref="loginFilter" position="FORM_LOGIN_FILTER" />
  <custom-filter ref="securityFilter" before="FILTER_SECURITY_INTERCEPTOR" />

</http>

<beans:bean id="loginFilter"
  class="cn.com.abel.test.service.security.MyUsernamePasswordAuthenticationFilter">

  <!-- 登录提交处理 -->
  <beans:property name="filterProcessesUrl" value="/j_spring_security_check"></beans:property>

  <!-- 登录成功跳转 -->
  <beans:property name="authenticationSuccessHandler"
    ref="loginLogAuthenticationSuccessHandler"></beans:property>

  <!-- 设置登录失败的网址 -->
  <beans:property name="authenticationFailureHandler"
    ref="simpleUrlAuthenticationFailureHandler"></beans:property>

  <!-- 用户拥有权限 --> 
  <beans:property name="authenticationManager" ref="myAuthenticationManager"></beans:property>
</beans:bean>

<beans:bean id="loginLogAuthenticationSuccessHandler"
  class="org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler">
  <beans:property name="defaultTargetUrl" value="/admin/index"></beans:property>
</beans:bean>
<beans:bean id="simpleUrlAuthenticationFailureHandler"
  class="org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler">
  <beans:property name="defaultFailureUrl" value="/login"></beans:property>
</beans:bean>

<authentication-manager alias="myAuthenticationManager">
  <authentication-provider user-service-ref="myUserDetailServiceImpl">
    <password-encoder ref="encoder" />
  </authentication-provider>
</authentication-manager>

<beans:bean id="myUserDetailServiceImpl"
  class="cn.com.abel.test.service.security.AdminUserDetailServiceImpl">
</beans:bean>

<beans:bean id="authenticationProcessingFilterEntryPoint"
  class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint">
  <beans:property name="loginFormUrl" value="/login"></beans:property>
</beans:bean>

<!-- 认证过滤器 -->
<beans:bean id="securityFilter"
  class="cn.com.abel.test.service.security.MySecurityFilter">
  <!-- 用户拥有的角色 -->
  <beans:property name="authenticationManager" ref="myAuthenticationManager" />
  <!-- 用户是否拥有所请求资源的权限 -->
  <beans:property name="accessDecisionManager" ref="myAccessDecisionManager" />
  <!-- 资源与角色的对应关系 -->
  <beans:property name="securityMetadataSource" ref="mySecurityMetadataSource" />
  <!-- <beans:property name="rejectPublicInvocations" value="true"/> -->

</beans:bean>

<beans:bean id="myAccessDecisionManager" class="myAccessDecisionManager"></beans:bean>

<beans:bean id="mySecurityMetadataSource"
  class="cn.com.abel.test.service.security.MySecurityMetadataSource">
  <beans:constructor-arg>
    <beans:ref bean="resourceService" />
  </beans:constructor-arg>
</beans:bean>

<beans:bean id="encoder" class="org.springframework.security.authentication.encoding.Md5PasswordEncoder"></beans:bean>

</beans:beans>

3、MyUsernamePasswordAuthenticationFilter.java

​

2. package cn.com.abel.test.service.security;  
3.   
4. import javax.servlet.http.HttpServletRequest;  
5. import javax.servlet.http.HttpServletResponse;  
6.   
7. import org.springframework.security.authentication.AuthenticationServiceException;  
8. import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;  
9. import org.springframework.security.core.Authentication;  
10. import org.springframework.security.core.AuthenticationException;  
11. import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;  
12.   
13. public class MyUsernamePasswordAuthenticationFilter extends UsernamePasswordAuthenticationFilter{  
14.   
15.     @Override  
16.     public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException {  
17.   
18.         if (!request.getMethod().equals("POST")) {  
19.             throw new AuthenticationServiceException("Authentication method not supported: " + request.getMethod());  
20.         }  
21.   
22.         String username = obtainUsername(request);  
23.         String password = obtainPassword(request);  
24.   
25.         if (username == null) {  
26.             username = "";  
27.         }  
28.   
29.         if (password == null) {  
30.             password = "";  
31.         }  
32.   
33.         username = username.trim();  
34.   
35.         UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(username, password);  
36.   
37.         // Allow subclasses to set the "details" property  
38.         setDetails(request, authRequest);  
39.   
40. //      //登录验证码，如需要开启把下面注释去掉则可  
41. //      String authCode = StringUtils.defaultString(request.getParameter("authCode"));  
42. //      if(!AdwImageCaptchaServlet.validateResponse(request, authCode)){  
43. //          throw new AuthenticationServiceException("validCode.auth.fail");  
44. //      }  
45.   
46.         return this.getAuthenticationManager().authenticate(authRequest);  
47.     }  
48. }  

package cn.com.abel.test.service.security;
import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletResponse;
import org.springframework.security.authentication.AuthenticationServiceException;

import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;

import org.springframework.security.core.Authentication;

import org.springframework.security.core.AuthenticationException;

import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
public class MyUsernamePasswordAuthenticationFilter extends UsernamePasswordAuthenticationFilter{

@Override
public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException {

  if (!request.getMethod().equals("POST")) {
    throw new AuthenticationServiceException("Authentication method not supported: " + request.getMethod());
  }

  String username = obtainUsername(request);
  String password = obtainPassword(request);

  if (username == null) {
    username = "";
  }

  if (password == null) {
    password = "";
  }

  username = username.trim();

  UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(username, password);

  // Allow subclasses to set the "details" property
  setDetails(request, authRequest);

//    //登录验证码，如需要开启把下面注释去掉则可

//    String authCode = StringUtils.defaultString(request.getParameter("authCode"));

//    if(!AdwImageCaptchaServlet.validateResponse(request, authCode)){

//      throw new AuthenticationServiceException("validCode.auth.fail");

//    }

  return this.getAuthenticationManager().authenticate(authRequest);
}

}

4、MySecurityFilter.java

​

2. package cn.com.abel.test.service.security;  
3.   
4. import java.io.IOException;  
5.   
6. import javax.servlet.Filter;  
7. import javax.servlet.FilterChain;  
8. import javax.servlet.FilterConfig;  
9. import javax.servlet.ServletException;  
10. import javax.servlet.ServletRequest;  
11. import javax.servlet.ServletResponse;  
12.   
13. import org.springframework.security.access.SecurityMetadataSource;  
14. import org.springframework.security.access.intercept.AbstractSecurityInterceptor;  
15. import org.springframework.security.access.intercept.InterceptorStatusToken;  
16. import org.springframework.security.web.FilterInvocation;  
17. import org.springframework.security.web.access.intercept.FilterInvocationSecurityMetadataSource;  
18.   
19. public class MySecurityFilter extends AbstractSecurityInterceptor implements Filter {  
20.     //与applicationContext-security.xml里的myFilter的属性securityMetadataSource对应，  
21.     //其他的两个组件，已经在AbstractSecurityInterceptor定义  
22.     private FilterInvocationSecurityMetadataSource securityMetadataSource;  
23.   
24.     @Override  
25.     public SecurityMetadataSource obtainSecurityMetadataSource() {  
26.         return this.securityMetadataSource;  
27.     }  
28.   
29.     public void doFilter(ServletRequest request, ServletResponse response,  
30.             FilterChain chain) throws IOException, ServletException {  
31.         FilterInvocation fi = new FilterInvocation(request, response, chain);  
32.         invoke(fi);  
33.     }  
34.       
35.     private void invoke(FilterInvocation fi) throws IOException, ServletException {  
36.         // object为FilterInvocation对象  
37.         //1.获取请求资源的权限  
38.         //执行Collection<ConfigAttribute> attributes = SecurityMetadataSource.getAttributes(object);  
39.         //2.是否拥有权限  
40.         //获取安全主体，可以强制转换为UserDetails的实例  
41.         //1) UserDetails  
42.         // Authentication authenticated = authenticateIfRequired();  
43.         //this.accessDecisionManager.decide(authenticated, object, attributes);  
44.         //用户拥有的权限  
45.         //2) GrantedAuthority  
46.         //Collection<GrantedAuthority> authenticated.getAuthorities()  
47.         //System.out.println("用户发送请求！ ");  
48.         InterceptorStatusToken token = null;  
49.           
50.         token = super.beforeInvocation(fi);  
51.           
52.         try {  
53.             fi.getChain().doFilter(fi.getRequest(), fi.getResponse());  
54.         } finally {  
55.             super.afterInvocation(token, null);  
56.         }  
57.     }  
58.   
59.     public FilterInvocationSecurityMetadataSource getSecurityMetadataSource() {  
60.         return securityMetadataSource;  
61.     }  
62.   
63.     public void setSecurityMetadataSource(FilterInvocationSecurityMetadataSource securityMetadataSource) {  
64.         this.securityMetadataSource = securityMetadataSource;  
65.     }  
66.       
67.     public void init(FilterConfig arg0) throws ServletException {  
68.         // TODO Auto-generated method stub  
69.     }  
70.       
71.     public void destroy() {  
72.         // TODO Auto-generated method stub  
73.           
74.     }  
75.   
76.     @Override  
77.     public Class<? extends Object> getSecureObjectClass() {  
78.         //下面的MyAccessDecisionManager的supports方面必须放回true,否则会提醒类型错误  
79.         return FilterInvocation.class;  
80.     }  
81. }  

package cn.com.abel.test.service.security;
import java.io.IOException;
import javax.servlet.Filter;

import javax.servlet.FilterChain;

import javax.servlet.FilterConfig;

import javax.servlet.ServletException;

import javax.servlet.ServletRequest;

import javax.servlet.ServletResponse;
import org.springframework.security.access.SecurityMetadataSource;

import org.springframework.security.access.intercept.AbstractSecurityInterceptor;

import org.springframework.security.access.intercept.InterceptorStatusToken;

import org.springframework.security.web.FilterInvocation;

import org.springframework.security.web.access.intercept.FilterInvocationSecurityMetadataSource;
public class MySecurityFilter extends AbstractSecurityInterceptor implements Filter {
//与applicationContext-security.xml里的myFilter的属性securityMetadataSource对应，

//其他的两个组件，已经在AbstractSecurityInterceptor定义

private FilterInvocationSecurityMetadataSource securityMetadataSource;

@Override
public SecurityMetadataSource obtainSecurityMetadataSource() {
  return this.securityMetadataSource;
}

public void doFilter(ServletRequest request, ServletResponse response,
    FilterChain chain) throws IOException, ServletException {
  FilterInvocation fi = new FilterInvocation(request, response, chain);
  invoke(fi);
}

private void invoke(FilterInvocation fi) throws IOException, ServletException {
  // object为FilterInvocation对象
  //1.获取请求资源的权限
  //执行Collection<ConfigAttribute> attributes = SecurityMetadataSource.getAttributes(object);
  //2.是否拥有权限
  //获取安全主体，可以强制转换为UserDetails的实例
  //1) UserDetails
  // Authentication authenticated = authenticateIfRequired();
  //this.accessDecisionManager.decide(authenticated, object, attributes);
  //用户拥有的权限
  //2) GrantedAuthority
  //Collection<GrantedAuthority> authenticated.getAuthorities()
  //System.out.println("用户发送请求！ ");
  InterceptorStatusToken token = null;

  token = super.beforeInvocation(fi);

  try {
    fi.getChain().doFilter(fi.getRequest(), fi.getResponse());
  } finally {
    super.afterInvocation(token, null);
  }
}

public FilterInvocationSecurityMetadataSource getSecurityMetadataSource() {
  return securityMetadataSource;
}

public void setSecurityMetadataSource(FilterInvocationSecurityMetadataSource securityMetadataSource) {
  this.securityMetadataSource = securityMetadataSource;
}

public void init(FilterConfig arg0) throws ServletException {
  // TODO Auto-generated method stub
}

public void destroy() {
  // TODO Auto-generated method stub

}

@Override
public Class<? extends Object> getSecureObjectClass() {
  //下面的MyAccessDecisionManager的supports方面必须放回true,否则会提醒类型错误
  return FilterInvocation.class;
}

}

5、AdminUserDetailServiceImpl.java

​

2. package cn.com.abel.test.service.security;  
3.   
4. import java.util.HashSet;  
5. import java.util.List;  
6. import java.util.Set;  
7.   
8. import org.springframework.beans.factory.annotation.Autowired;  
9. import org.springframework.security.core.GrantedAuthority;  
10. import org.springframework.security.core.authority.SimpleGrantedAuthority;  
11. import org.springframework.security.core.userdetails.UserDetails;  
12. import org.springframework.security.core.userdetails.UserDetailsService;  
13. import org.springframework.security.core.userdetails.UsernameNotFoundException;  
14.   
15. import cn.com.abel.test.model.RoleModel;  
16. import cn.com.abel.test.model.MemberModel;  
17. import cn.com.abel.test.service.RoleService;  
18. import cn.com.abel.test.service.MemberService;  
19.   
20. public class AdminUserDetailServiceImpl implements UserDetailsService {  
21.     @Autowired  
22.     private MemberService memberService;  
23.     @Autowired  
24.     RoleService roleService;  
25.    
26.     //登录验证  
27.     public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {  
28.           
29.        
30.         MemberModel member = memberService.getUserDetailsByUserName(username);  
31.           
32.         if(member==null){  
33.             throw new UsernameNotFoundException("member "+username +" not found.");  
34.         }  
35.         Set<GrantedAuthority> grantedAuths = obtionGrantedAuthorities(member);  
36.   
37.                 //封装成spring security的user  
38.                 User userdetail = new User(user.getUserName(), user.getPassword(),  
39.                 true, // 账号状态 0 表示停用 1表示启用  
40.                 true, true, true, grantedAuths // 用户的权限  
41.                 );  
42.                 return userdetail;  
43.     }  
44.       
45.     //取得用户的权限  
46.     private Set<GrantedAuthority> obtionGrantedAuthorities(MemberModel member) {  
47.           
48.         Set<GrantedAuthority> authSet = new HashSet<GrantedAuthority>();  
49.           
50.         List<RoleModel> roles = roleService.getRoleByUser(member)<span style="font-family:Arial, Helvetica, sans-serif;">;</span>  
51.         if(roles!=null){  
52.             for(RoleModel role : roles) {  
53.                 authSet.add(new SimpleGrantedAuthority(role.getRoleCode().trim()));  
54.             }  
55.         }  
56.    
57.         return authSet;  
58.     }  
59.       
60. }  

package cn.com.abel.test.service.security;
import java.util.HashSet;

import java.util.List;

import java.util.Set;
import org.springframework.beans.factory.annotation.Autowired;

import org.springframework.security.core.GrantedAuthority;

import org.springframework.security.core.authority.SimpleGrantedAuthority;

import org.springframework.security.core.userdetails.UserDetails;

import org.springframework.security.core.userdetails.UserDetailsService;

import org.springframework.security.core.userdetails.UsernameNotFoundException;
import cn.com.abel.test.model.RoleModel;

import cn.com.abel.test.model.MemberModel;

import cn.com.abel.test.service.RoleService;

import cn.com.abel.test.service.MemberService;
public class AdminUserDetailServiceImpl implements UserDetailsService {

@Autowired

private MemberService memberService;

@Autowired

RoleService roleService;

//登录验证
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {


  MemberModel member = memberService.getUserDetailsByUserName(username);

  if(member==null){
    throw new UsernameNotFoundException("member "+username +" not found.");
  }
  Set<GrantedAuthority> grantedAuths = obtionGrantedAuthorities(member);

            //封装成spring security的user
            User userdetail = new User(user.getUserName(), user.getPassword(),
            true, // 账号状态 0 表示停用 1表示启用
            true, true, true, grantedAuths // 用户的权限
            );
            return userdetail;
}

//取得用户的权限
private Set<GrantedAuthority> obtionGrantedAuthorities(MemberModel member) {

  Set<GrantedAuthority> authSet = new HashSet<GrantedAuthority>();

  List<RoleModel> roles = roleService.getRoleByUser(member)<span style="font-family:Arial, Helvetica, sans-serif;">;</span>
  if(roles!=null){
    for(RoleModel role : roles) {
      authSet.add(new SimpleGrantedAuthority(role.getRoleCode().trim()));
    }
  }

  return authSet;
}

}

6、MyAccessDecisionManager.java

​

2. package cn.com.abel.test.service.security;  
3.   
4. import java.util.Collection;  
5. import java.util.Iterator;  
6.   
7. import org.springframework.security.access.AccessDecisionManager;  
8. import org.springframework.security.access.AccessDeniedException;  
9. import org.springframework.security.access.ConfigAttribute;  
10. import org.springframework.security.authentication.InsufficientAuthenticationException;  
11. import org.springframework.security.core.Authentication;  
12. import org.springframework.security.core.GrantedAuthority;  
13.   
14. public class MyAccessDecisionManager implements AccessDecisionManager {  
15.       
16.     public void decide(Authentication authentication, Object object, Collection<ConfigAttribute> configAttributes) throws AccessDeniedException, InsufficientAuthenticationException {  
17.         if(configAttributes == null) {  
18.             return;  
19.         }  
20.         //所请求的资源拥有的权限(一个资源对多个权限)  
21.         Iterator<ConfigAttribute> iterator = configAttributes.iterator();  
22.         while(iterator.hasNext()) {  
23.             ConfigAttribute configAttribute = iterator.next();  
24.             //访问所请求资源所需要的权限  
25.             String needPermission = configAttribute.getAttribute();  
26.             System.out.println("needPermission is " + needPermission);  
27.             //用户所拥有的权限authentication  
28.             for(GrantedAuthority ga : authentication.getAuthorities()) {  
29.                 if(needPermission.equals(ga.getAuthority())) {  
30.                     return;  
31.                 }  
32.             }  
33.         }  
34.         //没有权限让我们去捕捉  
35.         throw new AccessDeniedException(" 没有权限访问！");  
36.     }  
37.   
38.     public boolean supports(ConfigAttribute attribute) {  
39.         // TODO Auto-generated method stub  
40.         return true;  
41.     }  
42.   
43.     public boolean supports(Class<?> clazz) {  
44.         // TODO Auto-generated method stub  
45.         return true;  
46.     }  
47.       
48. }  

package cn.com.abel.test.service.security;
import java.util.Collection;

import java.util.Iterator;
import org.springframework.security.access.AccessDecisionManager;

import org.springframework.security.access.AccessDeniedException;

import org.springframework.security.access.ConfigAttribute;

import org.springframework.security.authentication.InsufficientAuthenticationException;

import org.springframework.security.core.Authentication;

import org.springframework.security.core.GrantedAuthority;
public class MyAccessDecisionManager implements AccessDecisionManager {

public void decide(Authentication authentication, Object object, Collection<ConfigAttribute> configAttributes) throws AccessDeniedException, InsufficientAuthenticationException {
  if(configAttributes == null) {
    return;
  }
  //所请求的资源拥有的权限(一个资源对多个权限)
  Iterator<ConfigAttribute> iterator = configAttributes.iterator();
  while(iterator.hasNext()) {
    ConfigAttribute configAttribute = iterator.next();
    //访问所请求资源所需要的权限
    String needPermission = configAttribute.getAttribute();
    System.out.println("needPermission is " + needPermission);
    //用户所拥有的权限authentication
    for(GrantedAuthority ga : authentication.getAuthorities()) {
      if(needPermission.equals(ga.getAuthority())) {
        return;
      }
    }
  }
  //没有权限让我们去捕捉
  throw new AccessDeniedException(" 没有权限访问！");
}

public boolean supports(ConfigAttribute attribute) {
  // TODO Auto-generated method stub
  return true;
}

public boolean supports(Class<?> clazz) {
  // TODO Auto-generated method stub
  return true;
}

}

7、MySecurityMetadataSource.java

​

2. package cn.com.abel.test.service.security;  
3.   
4. import java.util.ArrayList;  
5. import java.util.Collection;  
6. import java.util.HashSet;  
7. import java.util.Iterator;  
8. import java.util.List;  
9. import java.util.Map;  
10. import java.util.Map.Entry;  
11. import java.util.TreeMap;  
12. import java.util.concurrent.ConcurrentHashMap;  
13.   
14. import javax.servlet.http.HttpServletRequest;  
15.   
16. import org.apache.commons.lang.StringUtils;  
17. import org.springframework.beans.factory.InitializingBean;  
18. import org.springframework.security.access.ConfigAttribute;  
19. import org.springframework.security.access.SecurityConfig;  
20. import org.springframework.security.web.FilterInvocation;  
21. import org.springframework.security.web.access.intercept.FilterInvocationSecurityMetadataSource;  
22. import org.springframework.security.web.util.matcher.AntPathRequestMatcher;  
23. import org.springframework.security.web.util.matcher.RequestMatcher;  
24.   
25. import cn.com.abel.test.model.RoleModel;  
26. import cn.com.abel.test.service.ResourceService;  
27.   
28. public class MySecurityMetadataSource  implements FilterInvocationSecurityMetadataSource,InitializingBean {  
29.   
30.       
31.     private static final String AUTH_NO_ROLE =" __AUTH_NO_ROLE__";  
32.       
33.     private ResourceService resourceService;  
34.       
35.     public MySecurityMetadataSource(ResourceService resourceService) {  
36.         this.resourceService = resourceService;  
37.     }  
38.   
39.     private static Map<String, Collection<ConfigAttribute>> resourceMap = null;  
40.   
41.     public Collection<ConfigAttribute> getAllConfigAttributes() {  
42.         return null;  
43.     }  
44.   
45.     public boolean supports(Class<?> clazz) {  
46.         return true;  
47.     }  
48.     private void loadResourceDefine() {  
49.         if(resourceMap == null) {  
50.             resourceMap = new ConcurrentHashMap<String, Collection<ConfigAttribute>>();  
51.         }else{  
52.             resourceMap.clear();  
53.         }  
54.           
55.         Map<String,List<RoleModel>> resourceRoleMap = resourceService.getAllResourceRole();  
56.           
57.         for (Entry<String,List<RoleModel>> entry : resourceRoleMap.entrySet()) {  
58.             String url = entry.getKey();  
59.             List<RoleModel> values = entry.getValue();  
60.               
61.             Collection<ConfigAttribute> configAttributes = new ArrayList<ConfigAttribute>();  
62.             for(RoleModel secRoleModel : values){  
63.                 ConfigAttribute configAttribute = new SecurityConfig(StringUtils.defaultString(secRoleModel.getRoleCode(),AUTH_NO_ROLE));  
64.                 configAttributes.add(configAttribute);  
65.             }  
66.             resourceMap.put(url, configAttributes);  
67.         }  
68.     }  
69.     public Collection<ConfigAttribute> getAttributes(Object object) throws IllegalArgumentException {  
70.           
71.         HttpServletRequest request = ((FilterInvocation) object).getHttpRequest();    
72.    
73.         TreeMap<String, Collection<ConfigAttribute>> attrMap = new TreeMap<String, Collection<ConfigAttribute>>(resourceMap);  
74.           
75.         Iterator<String> ite = attrMap.keySet().iterator();    
76.           
77.         RequestMatcher urlMatcher = null;    
78.   
79.         Collection<ConfigAttribute> attrSet = new HashSet<ConfigAttribute>();  
80.         //match all of /admin/**  a/b/**  
81.         while (ite.hasNext()) {    
82.               
83.             String resURL = ite.next();    
84.             urlMatcher = new AntPathRequestMatcher(resURL);  
85.   
86.             if (urlMatcher.matches(request)||StringUtils.equals(request.getRequestURI(),resURL)) {    
87.                 attrSet.addAll(attrMap.get(resURL));    
88.             }    
89.         }    
90.   
91.         if(!attrSet.isEmpty()){  
92.             return attrSet;  
93.         }  
94.         return null;  
95.     }  
96.    
97.     @Override  
98.     public void afterPropertiesSet() throws Exception {  
99.         loadResourceDefine() ;  
100.     }  
101.       
102. }  

package cn.com.abel.test.service.security;
import java.util.ArrayList;

import java.util.Collection;

import java.util.HashSet;

import java.util.Iterator;

import java.util.List;

import java.util.Map;

import java.util.Map.Entry;

import java.util.TreeMap;

import java.util.concurrent.ConcurrentHashMap;
import javax.servlet.http.HttpServletRequest;
import org.apache.commons.lang.StringUtils;

import org.springframework.beans.factory.InitializingBean;

import org.springframework.security.access.ConfigAttribute;

import org.springframework.security.access.SecurityConfig;

import org.springframework.security.web.FilterInvocation;

import org.springframework.security.web.access.intercept.FilterInvocationSecurityMetadataSource;

import org.springframework.security.web.util.matcher.AntPathRequestMatcher;

import org.springframework.security.web.util.matcher.RequestMatcher;
import cn.com.abel.test.model.RoleModel;

import cn.com.abel.test.service.ResourceService;
public class MySecurityMetadataSource  implements FilterInvocationSecurityMetadataSource,InitializingBean {

private static final String AUTH_NO_ROLE =" __AUTH_NO_ROLE__";

private ResourceService resourceService;

public MySecurityMetadataSource(ResourceService resourceService) {
  this.resourceService = resourceService;
}

private static Map<String, Collection<ConfigAttribute>> resourceMap = null;

public Collection<ConfigAttribute> getAllConfigAttributes() {
  return null;
}

public boolean supports(Class<?> clazz) {
  return true;
}
private void loadResourceDefine() {
  if(resourceMap == null) {
    resourceMap = new ConcurrentHashMap<String, Collection<ConfigAttribute>>();
  }else{
    resourceMap.clear();
  }

  Map<String,List<RoleModel>> resourceRoleMap = resourceService.getAllResourceRole();

  for (Entry<String,List<RoleModel>> entry : resourceRoleMap.entrySet()) {
    String url = entry.getKey();
    List<RoleModel> values = entry.getValue();

    Collection<ConfigAttribute> configAttributes = new ArrayList<ConfigAttribute>();
    for(RoleModel secRoleModel : values){
      ConfigAttribute configAttribute = new SecurityConfig(StringUtils.defaultString(secRoleModel.getRoleCode(),AUTH_NO_ROLE));
      configAttributes.add(configAttribute);
    }
    resourceMap.put(url, configAttributes);
  }
}
public Collection<ConfigAttribute> getAttributes(Object object) throws IllegalArgumentException {

  HttpServletRequest request = ((FilterInvocation) object).getHttpRequest();  

  TreeMap<String, Collection<ConfigAttribute>> attrMap = new TreeMap<String, Collection<ConfigAttribute>>(resourceMap);

  Iterator<String> ite = attrMap.keySet().iterator();  

  RequestMatcher urlMatcher = null;  

  Collection<ConfigAttribute> attrSet = new HashSet<ConfigAttribute>();
  //match all of /admin/**  a/b/**
  while (ite.hasNext()) {  

    String resURL = ite.next();  
    urlMatcher = new AntPathRequestMatcher(resURL);

    if (urlMatcher.matches(request)||StringUtils.equals(request.getRequestURI(),resURL)) {  
      attrSet.addAll(attrMap.get(resURL));  
    }  
  }  

  if(!attrSet.isEmpty()){
    return attrSet;
  }
  return null;
}

@Override
public void afterPropertiesSet() throws Exception {
  loadResourceDefine() ;
}

}

8、ResourceService.java

此类是为从数据库获取系统中的资源所属的角色，根据自己的数据表自行编写。

​

2. package cn.com.abel.test.service;  
3.   
4. import java.util.ArrayList;  
5. import java.util.HashMap;  
6. import java.util.HashSet;  
7. import java.util.List;  
8. import java.util.Map;  
9.   
10. import org.apache.commons.collections.CollectionUtils;  
11. import org.springframework.beans.factory.annotation.Autowired;  
12. import org.springframework.stereotype.Service;  
13.   
14. import cn.com.abel.test.mapper.ResourceModelMapper;  
15. import cn.com.abel.test.mapper.RoleModelMapper;  
16. import cn.com.abel.test.mapper.RoleResourcetModelMapper;  
17. import cn.com.abel.test.model.ResourceModel;  
18. import cn.com.abel.test.model.ResourceModelCriteria;  
19. import cn.com.abel.test.model.RoleModel;  
20. import cn.com.abel.test.model.RoleModelCriteria;  
21. import cn.com.abel.test.model.RoleResourcetModel;  
22. import cn.com.abel.test.model.RoleResourcetModelCriteria;  
23.   
24. @Service  
25. public class ResourceService {  
26.       
27.     @Autowired  
28.     ResourceModelMapper resourceModelMapper;  
29.       
30.     @Autowired  
31.     RoleModelMapper roleMapper;  
32.       
33.     @Autowired  
34.     RoleResourcetModelMapper  roleResMapper;  
35.       
36.     /** 
37.      * 获取各个资源（url）对应的角色 
38.      * @return 
39.      */  
40.     public Map<String,List<RoleModel>> getAllResourceRole(){  
41.           
42.          Map<String,List<RoleModel>> resultMap = new HashMap<String,List<RoleModel>>();  
43.            
44.         ResourceModelCriteria secResourceModelExample = new ResourceModelCriteria();  
45.         List<ResourceModel> resourceList = resourceModelMapper.selectByExample(secResourceModelExample);  
46.           
47.         if(CollectionUtils.isNotEmpty(resourceList)){  
48.             for(ResourceModel secResourceModel : resourceList){  
49.                 RoleModelCriteria roleCriteria = new RoleModelCriteria();  
50.                 roleCriteria.createCriteria().andIdIn(getRoleIdsByResourceId(secResourceModel.getId()));  
51.                 List<RoleModel> roleList = roleMapper.selectByExample(roleCriteria);  
52.                 resultMap.put(secResourceModel.getValue(), roleList);  
53.                   
54.             }  
55.         }  
56.        
57.         return resultMap;  
58.     }  
59.       
60.     public List<Integer> getRoleIdsByResourceId(Integer resourceId){  
61.         List<Integer> roleIds = new ArrayList<Integer>();  
62.           
63.         RoleResourcetModelCriteria criteria = new RoleResourcetModelCriteria();  
64.         criteria.createCriteria().andResourceIdEqualTo(resourceId);  
65.         List<RoleResourcetModel> list = roleResMapper.selectByExample(criteria);  
66.         if(CollectionUtils.isNotEmpty(list)){  
67.             for(RoleResourcetModel model : list){  
68.                 roleIds.add(model.getRoleId());  
69.             }  
70.         }  
71.           
72.         HashSet<Integer> h  =   new  HashSet<Integer>(roleIds);       
73.         roleIds.clear();       
74.         roleIds.addAll(h);     
75.         return roleIds;  
76.     }  
77. }  

package cn.com.abel.test.service;
import java.util.ArrayList;

import java.util.HashMap;

import java.util.HashSet;

import java.util.List;

import java.util.Map;
import org.apache.commons.collections.CollectionUtils;

import org.springframework.beans.factory.annotation.Autowired;

import org.springframework.stereotype.Service;
import cn.com.abel.test.mapper.ResourceModelMapper;

import cn.com.abel.test.mapper.RoleModelMapper;

import cn.com.abel.test.mapper.RoleResourcetModelMapper;

import cn.com.abel.test.model.ResourceModel;

import cn.com.abel.test.model.ResourceModelCriteria;

import cn.com.abel.test.model.RoleModel;

import cn.com.abel.test.model.RoleModelCriteria;

import cn.com.abel.test.model.RoleResourcetModel;

import cn.com.abel.test.model.RoleResourcetModelCriteria;
@Service

public class ResourceService {

@Autowired
ResourceModelMapper resourceModelMapper;

@Autowired
RoleModelMapper roleMapper;

@Autowired
RoleResourcetModelMapper  roleResMapper;

/**
 * 获取各个资源（url）对应的角色
 * @return
 */
public Map<String,List<RoleModel>> getAllResourceRole(){

   Map<String,List<RoleModel>> resultMap = new HashMap<String,List<RoleModel>>();

  ResourceModelCriteria secResourceModelExample = new ResourceModelCriteria();
  List<ResourceModel> resourceList = resourceModelMapper.selectByExample(secResourceModelExample);

  if(CollectionUtils.isNotEmpty(resourceList)){
    for(ResourceModel secResourceModel : resourceList){
      RoleModelCriteria roleCriteria = new RoleModelCriteria();
      roleCriteria.createCriteria().andIdIn(getRoleIdsByResourceId(secResourceModel.getId()));
      List<RoleModel> roleList = roleMapper.selectByExample(roleCriteria);
      resultMap.put(secResourceModel.getValue(), roleList);

    }
  }

  return resultMap;
}

public List<Integer> getRoleIdsByResourceId(Integer resourceId){
  List<Integer> roleIds = new ArrayList<Integer>();

  RoleResourcetModelCriteria criteria = new RoleResourcetModelCriteria();
  criteria.createCriteria().andResourceIdEqualTo(resourceId);
  List<RoleResourcetModel> list = roleResMapper.selectByExample(criteria);
  if(CollectionUtils.isNotEmpty(list)){
    for(RoleResourcetModel model : list){
      roleIds.add(model.getRoleId());
    }
  }

  HashSet<Integer> h  =   new  HashSet<Integer>(roleIds);     
  roleIds.clear();     
  roleIds.addAll(h);   
  return roleIds;
}

}

​

2. CREATE TABLE `auth_resource` (  
3.     `id` INT(11) NOT NULL AUTO_INCREMENT,  
4.     `name` VARCHAR(100) NULL DEFAULT NULL COMMENT '资源名称',  
5.     `value` VARCHAR(100) NULL DEFAULT NULL COMMENT '资源值',  
6.     `summary` VARCHAR(1000) NULL DEFAULT NULL COMMENT '资源描述',  
7.     `updated_time` DATETIME NULL DEFAULT NULL,  
8.     `updated_user` VARCHAR(100) NULL DEFAULT NULL,  
9.     PRIMARY KEY (`id`)  
10. )  
11. COMMENT='资源访问表'  
12. COLLATE='utf8_general_ci'  
13. ENGINE=InnoDB;  
14.   
15. CREATE TABLE `auth_role` (  
16.     `id` INT(11) NOT NULL AUTO_INCREMENT,  
17.     `role_name` VARCHAR(100) NULL DEFAULT NULL COMMENT '角色名称',  
18.     `role_code` VARCHAR(100) NULL DEFAULT NULL COMMENT '角色代码',  
19.     `updated_time` DATETIME NULL DEFAULT NULL,  
20.     `updated_user` VARCHAR(100) NULL DEFAULT NULL,  
21.     PRIMARY KEY (`id`)  
22. )  
23. COMMENT='角色表'  
24. COLLATE='utf8_general_ci'  
25. ENGINE=InnoDB;  
26.   
27. CREATE TABLE `role_resource` (  
28.     `id` INT(11) NOT NULL AUTO_INCREMENT,  
29.     `role_id` INT(11) NOT NULL,  
30.     `resource_id` INT(11) NOT NULL,  
31.     PRIMARY KEY (`id`),  
32.     UNIQUE INDEX `role_id_resource_id` (`role_id`, `resource_id`)  
33. )  
34. COMMENT='资源角色关联表'  
35. COLLATE='utf8_general_ci'  
36. ENGINE=InnoDB;  
37.   
38. CREATE TABLE `member` (  
39.     `id` INT(11) NOT NULL AUTO_INCREMENT,  
40.     `user_name` VARCHAR(100) NULL DEFAULT NULL,  
41.     `nick` VARCHAR(100) NULL DEFAULT NULL,  
42.     `password` VARCHAR(100) NULL DEFAULT NULL,  
43.     `sex` INT(11) NULL DEFAULT NULL,  
44.     `birthday` DATE NULL DEFAULT NULL,  
45.     `mobile` VARCHAR(50) NULL DEFAULT NULL,  
46.     `email` VARCHAR(50) NULL DEFAULT NULL,  
47.     `address` VARCHAR(512) NULL DEFAULT NULL,  
48.     `regip` VARCHAR(100) NULL DEFAULT NULL,  
49.     `created_time` DATETIME NULL DEFAULT NULL,  
50.     PRIMARY KEY (`id`)  
51. )  
52. COMMENT='用户表'  
53. COLLATE='utf8_general_ci'  
54. ENGINE=InnoDB  
55. AUTO_INCREMENT=2;  
56.   
57. CREATE TABLE `member_role` (  
58.     `id` INT(11) NOT NULL AUTO_INCREMENT,  
59.     `member_id` INT(11) NOT NULL,  
60.     `role_id` INT(11) NOT NULL,  
61.     PRIMARY KEY (`id`),  
62.     UNIQUE INDEX `member_id_role_id` (`member_id`, `role_id`)  
63. )  
64. COMMENT='用户角色关联表'  
65. COLLATE='utf8_general_ci'  
66. ENGINE=InnoDB;  

CREATE TABLE `auth_resource` (
  `id` INT(11) NOT NULL AUTO_INCREMENT,
  `name` VARCHAR(100) NULL DEFAULT NULL COMMENT '资源名称',
  `value` VARCHAR(100) NULL DEFAULT NULL COMMENT '资源值',
  `summary` VARCHAR(1000) NULL DEFAULT NULL COMMENT '资源描述',
  `updated_time` DATETIME NULL DEFAULT NULL,
  `updated_user` VARCHAR(100) NULL DEFAULT NULL,
  PRIMARY KEY (`id`)
)
COMMENT='资源访问表'
COLLATE='utf8_general_ci'
ENGINE=InnoDB;
CREATE TABLE auth_role (
id INT(11) NOT NULL AUTO_INCREMENT,
role_name VARCHAR(100) NULL DEFAULT NULL COMMENT '角色名称',
role_code VARCHAR(100) NULL DEFAULT NULL COMMENT '角色代码',
updated_time DATETIME NULL DEFAULT NULL,
updated_user VARCHAR(100) NULL DEFAULT NULL,

PRIMARY KEY (id)

)

COMMENT='角色表'

COLLATE='utf8_general_ci'

ENGINE=InnoDB;
CREATE TABLE role_resource (
id INT(11) NOT NULL AUTO_INCREMENT,
role_id INT(11) NOT NULL,
resource_id INT(11) NOT NULL,

PRIMARY KEY (id),

UNIQUE INDEX role_id_resource_id (role_id, resource_id)

)

COMMENT='资源角色关联表'

COLLATE='utf8_general_ci'

ENGINE=InnoDB;
CREATE TABLE member (
id INT(11) NOT NULL AUTO_INCREMENT,
user_name VARCHAR(100) NULL DEFAULT NULL,
nick VARCHAR(100) NULL DEFAULT NULL,
password VARCHAR(100) NULL DEFAULT NULL,
sex INT(11) NULL DEFAULT NULL,
birthday DATE NULL DEFAULT NULL,
mobile VARCHAR(50) NULL DEFAULT NULL,
email VARCHAR(50) NULL DEFAULT NULL,
address VARCHAR(512) NULL DEFAULT NULL,
regip VARCHAR(100) NULL DEFAULT NULL,
created_time DATETIME NULL DEFAULT NULL,

PRIMARY KEY (id)

)

COMMENT='用户表'

COLLATE='utf8_general_ci'

ENGINE=InnoDB

AUTO_INCREMENT=2;
CREATE TABLE member_role (
id INT(11) NOT NULL AUTO_INCREMENT,
member_id INT(11) NOT NULL,
role_id INT(11) NOT NULL,

PRIMARY KEY (id),

UNIQUE INDEX member_id_role_id (member_id, role_id)

)

COMMENT='用户角色关联表'

COLLATE='utf8_general_ci'

ENGINE=InnoDB;

​