SpringSecurity相关配置【SpringSecurityConfig】

SpringSecurity的配置相对来说有些复杂，如果是完整的bean配置，则需要配置大量的bean，所以xml配置时使用了命名空间来简化配置，同样，spring为我们提供了一个抽象类WebSecurityConfigurerAdapter和一个注解@EnableWebMvcSecurity，达到同样减少bean配置的目的，如下：

applicationContext-SpringSecurityConfig.xml

1. <http security="none" pattern="/static/**" />
2. <http security="none" pattern="/**/*.jsp" />
3. <http auto-config='true' access-decision-manager-ref="accessDecisionManager" access-denied-page="/login"
4. use-expressions="true">
5. <logout logout-url="/logout" invalidate-session="true"
6. logout-success-url="/login" />
7. <form-login login-page="/login" authentication-failure-url="/login?error=1"
8. login-processing-url="/j_spring_security_check" password-parameter="j_password"
9. username-parameter="j_username" />
10. <intercept-url pattern="/**/*.do*" access="hasRole('ROLE_USER')" />
11. <intercept-url pattern="/**/*.htm" access="hasRole('ROLE_ADMIN')" />
12. <session-management session-fixation-protection="changeSessionId">
13. <concurrency-control max-sessions="1"
14. expired-url="/access/sameLogin.do" />
15. </session-management>
16. <remember-me key="webmvc#FD637E6D9C0F1A5A67082AF56CE32485"
17. remember-me-parameter="remember-me" />
18. </http>
19. <!-- 启用表达式 为了后面的投票器做准备 -->
20. <beans:bean
21. class="org.springframework.security.web.access.expression.DefaultWebSecurityExpressionHandler"
22. id="expressionHandler" />
23. <beans:bean
24. class="org.springframework.security.web.access.expression.WebExpressionVoter"
25. id="expressionVoter">
26. <beans:property name="expressionHandler" ref="expressionHandler" />
27. </beans:bean>
28. <!-- Automatically receives AuthenticationEvent messages -->
29. <beans:bean id="loggerListener"
30. class="org.springframework.security.authentication.event.LoggerListener" />
31. <beans:bean id="authorizationListener"
32. class="org.springframework.security.access.event.LoggerListener" />
33. <!-- 认证管理器，使用自定义的UserDetailsService，并对密码采用md5加密 -->
34. <authentication-manager>
35. <authentication-provider user-service-ref="userService">
36. <password-encoder hash="md5" />
37. </authentication-provider>
38. </authentication-manager>
39. <beans:bean id="userService" class="web.security.CP_UserDetailsService" />
40. <beans:bean id="accessDecisionManager"
41. class="org.springframework.security.access.vote.AffirmativeBased">
42. <beans:property name="decisionVoters">
43. <beans:list>
44. <beans:bean class="org.springframework.security.access.vote.RoleVoter" />
45. <beans:bean
46. class="org.springframework.security.access.vote.AuthenticatedVoter" />
47. <beans:ref bean="expressionVoter" />
48. </beans:list>
49. </beans:property>
50. </beans:bean>

SpringSecurityConfig.java

1. @Configuration
2. @EnableWebMvcSecurity
3. public class SpringSecurityConfig extends WebSecurityConfigurerAdapter {
4. private static final Logger logger = Logger
5. .getLogger(SpringSecurityConfig.class);
6. @Override
7. public void configure(WebSecurity web) throws Exception {
8. // 设置不拦截规则
9. web.ignoring().antMatchers("/static/**", "/**/*.jsp");
10. }
11. @Override
12. protected void configure(HttpSecurity http) throws Exception {
13. // 设置拦截规则
14. // 自定义accessDecisionManager访问控制器,并开启表达式语言
15. http.authorizeRequests().accessDecisionManager(accessDecisionManager())
16. .expressionHandler(webSecurityExpressionHandler())
17. .antMatchers("/**/*.do*").hasRole("USER")
18. .antMatchers("/**/*.htm").hasRole("ADMIN").and()
19. .exceptionHandling().accessDeniedPage("/login");
20. // 开启默认登录页面
21. // http.formLogin();
22. // 自定义登录页面
23. http.csrf().disable().formLogin().loginPage("/login")
24. .failureUrl("/login?error=1")
25. .loginProcessingUrl("/j_spring_security_check")
26. .usernameParameter("j_username")
27. .passwordParameter("j_password").permitAll();
28. // 自定义注销
29. http.logout().logoutUrl("/logout").logoutSuccessUrl("/login")
30. .invalidateHttpSession(true);
31. // session管理
32. http.sessionManagement().sessionFixation().changeSessionId()
33. .maximumSessions(1).expiredUrl("/");
34. // RemeberMe
35. http.rememberMe().key("webmvc#FD637E6D9C0F1A5A67082AF56CE32485");
36. }
37. @Override
38. protected void configure(AuthenticationManagerBuilder auth)
39. throws Exception {
40. // 自定义UserDetailsService
41. auth.userDetailsService(userDetailsService()).passwordEncoder(
42. new Md5PasswordEncoder());
43. }
44. @Bean
45. public CP_UserDetailsService userDetailsService() {
46. logger.info("CP_UserDetailsService");
47. CP_UserDetailsService userDetailsService = new CP_UserDetailsService();
48. return userDetailsService;
49. }
50. @Bean
51. public LoggerListener loggerListener() {
52. logger.info("org.springframework.security.authentication.event.LoggerListener");
53. LoggerListener loggerListener = new LoggerListener();
54. return loggerListener;
55. }
56. @Bean
57. public org.springframework.security.access.event.LoggerListener eventLoggerListener() {
58. logger.info("org.springframework.security.access.event.LoggerListener");
59. org.springframework.security.access.event.LoggerListener eventLoggerListener = new org.springframework.security.access.event.LoggerListener();
60. return eventLoggerListener;
61. }
62. /*
63. *
64. * 这里可以增加自定义的投票器
65. */
66. @SuppressWarnings("rawtypes")
67. @Bean(name = "accessDecisionManager")
68. public AccessDecisionManager accessDecisionManager() {
69. logger.info("AccessDecisionManager");
70. List<AccessDecisionVoter> decisionVoters = new ArrayList<AccessDecisionVoter>();
71. decisionVoters.add(new RoleVoter());
72. decisionVoters.add(new AuthenticatedVoter());
73. decisionVoters.add(webExpressionVoter());// 启用表达式投票器
74. AffirmativeBased accessDecisionManager = new AffirmativeBased(
75. decisionVoters);
76. return accessDecisionManager;
77. }
78. /*
79. * 表达式控制器
80. */
81. @Bean(name = "expressionHandler")
82. public DefaultWebSecurityExpressionHandler webSecurityExpressionHandler() {
83. logger.info("DefaultWebSecurityExpressionHandler");
84. DefaultWebSecurityExpressionHandler webSecurityExpressionHandler = new DefaultWebSecurityExpressionHandler();
85. return webSecurityExpressionHandler;
86. }
87. /*
88. * 表达式投票器
89. */
90. @Bean(name = "expressionVoter")
91. public WebExpressionVoter webExpressionVoter() {
92. logger.info("WebExpressionVoter");
93. WebExpressionVoter webExpressionVoter = new WebExpressionVoter();
94. webExpressionVoter.setExpressionHandler(webSecurityExpressionHandler());
95. return webExpressionVoter;
96. }
97. }