简单说说Spring Security 使用（附加验证码登录，自定义认证）

先看官方文档：http://docs.spring.io/spring-security/site/docs/4.0.x/reference/htmlsingle/

spring security4已经加入了注解的方式，但是为了比较清晰了解，还是使用了配置的方式。

第一步：web.xml 加入拦截、

    <!-- 配置springSecurityFilter -->
    <filter>
      <filter-name>springSecurityFilterChain</filter-name>
      <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    </filter>
    <filter-mapping>
      <filter-name>springSecurityFilterChain</filter-name>
      <url-pattern>/*</url-pattern>
    </filter-mapping>    

第二步：编写配置文件：spring-security.xml

<beans:beans xmlns="http://www.springframework.org/schema/security"
    xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.springframework.org/schema/beans
           http://www.springframework.org/schema/beans/spring-beans-3.2.xsd
           http://www.springframework.org/schema/security
           http://www.springframework.org/schema/security/spring-security-3.2.xsd ">
    <http pattern="/common/**" security="none" />
    <http pattern="/login.jsp" security="none" />
    <http pattern="/user/login" security="none" />
    <http pattern="/index" security="none" />
    <http use-expressions="true">
        <intercept-url pattern="/**" access="isAuthenticated()" />
        <form-login login-page="/login.jsp"    authentication-failure-url="/login.jsp?error=1" />
         <logout invalidate-session="true" logout-url="/logout"  logout-success-url="/"  />
    </http>
    <authentication-manager alias="myAuthenticationManager">
        <authentication-provider user-service-ref="cwSysUserDetailsService">
            <password-encoder hash="md5"></password-encoder>
        </authentication-provider>
    </authentication-manager>

</beans:beans>

第三步：编写登录认证函数

package com.eshore.upsweb.service;

import java.util.ArrayList;
import java.util.HashSet;
import java.util.List;
import java.util.Set;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Service;

import com.eshore.upsweb.dao.CwSysUserDAO;
import com.eshore.upsweb.model.CwSysUser;
import com.eshore.upsweb.model.CwSysUserRole;

@Service(value="cwSysUserDetailsService")
public class CwSysUserDetailsService implements UserDetailsService{

    @Autowired
    CwSysUserDAO cwSysUserDAO;

    @Override
    public UserDetails loadUserByUsername(String username)
            throws UsernameNotFoundException {
         System.out.println("username is " + username);
        CwSysUser user = cwSysUserDAO.findUser(username);
        List<GrantedAuthority> authorities = buildUserAuthority(user.getUserRoles());
        return buildUserForAuthentication(user, authorities);
    }

    /**
     * 返回验证角色
     * @param userRoles
     * @return
     */
    private List<GrantedAuthority> buildUserAuthority(Set<CwSysUserRole> userRoles){
        Set<GrantedAuthority> setAuths = new HashSet<GrantedAuthority>();
        for(CwSysUserRole userRole:userRoles){
            setAuths.add(new SimpleGrantedAuthority(userRole.getRole().getRoleId().toString()));
        }
        List<GrantedAuthority> result = new ArrayList<GrantedAuthority>(setAuths);
        return result;
    }

    /**
     * 返回验证用户
     * @param user
     * @param authorities
     * @return
     */
    private User buildUserForAuthentication(CwSysUser user,List<GrantedAuthority> authorities){
        return new User(user.getUserNo(),user.getPassword(),true,true,true,true,authorities);
    }

    /**
     *
     */

}

第四步：编写登录controller

package com.eshore.upsweb.controller;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpSession;

import org.hibernate.criterion.DetachedCriteria;
import org.hibernate.criterion.Restrictions;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.ResponseBody;

import com.eshore.upsweb.model.CwSysUser;
import com.eshore.upsweb.model.LoginInfo;
import com.eshore.upsweb.service.CwSysUserService;

@Controller
@RequestMapping(value="/user")
public class CwSysUserController {
    @Autowired
    private CwSysUserService cwSysUserService;
    @Autowired
    private AuthenticationManager myAuthenticationManager;  // 这样就可以自动注入？oh ，mygod ,how can it do so?

    @RequestMapping(value="/login",method=RequestMethod.POST)
    @ResponseBody
    public LoginInfo login(@RequestParam(defaultValue="") String username,@RequestParam(defaultValue="") String password,HttpServletRequest request){
        if(!checkValidateCode(request)){
            return new LoginInfo().failed().msg("验证码错误！");
        }
        username = username.trim();
        UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(username, password);
/*        DetachedCriteria detachedCriteria = DetachedCriteria.forClass(CwSysUser.class,"cwSysUser");
        detachedCriteria.add(Restrictions.eq("userNo", username));
        if(cwSysUserService.countUser(detachedCriteria)==0){
            return new LoginInfo().failed().msg("用户名: "+username+" 不存在.");
        }
*/        try {
            Authentication authentication = myAuthenticationManager.authenticate(authRequest); //调用loadUserByUsername
            SecurityContextHolder.getContext().setAuthentication(authentication);
            HttpSession session = request.getSession();
            session.setAttribute("SPRING_SECURITY_CONTEXT", SecurityContextHolder.getContext()); // 这个非常重要，否则验证后将无法登陆
            return new LoginInfo().success().msg(authentication.getName());
        } catch (AuthenticationException ex) {
            return new LoginInfo().failed().msg("用户名或密码错误");
        }
    }

    /**
     * 验证码判断
     * @param request
     * @return
     */
    protected boolean checkValidateCode(HttpServletRequest request) {
        String result_verifyCode = request.getSession().getAttribute("verifyResult")
                .toString(); // 获取存于session的验证值
       // request.getSession().setAttribute("verifyResult", null);
        String user_verifyCode = request.getParameter("verifyCode");// 获取用户输入验证码
        if (null == user_verifyCode || !result_verifyCode.equalsIgnoreCase(user_verifyCode)) {
            return false;
        }
        return true;
    }

}

第五步：编写对应的登录jsp

<%@ page language="java" contentType="text/html; charset=UTF-8"
    pageEncoding="UTF-8"%>
    <%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core"%>
<!DOCTYPE html">
<html lang="en">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<title>Login</title>
 <link href="./common/bootstrap/css/bootstrap.min.css" rel="stylesheet">
<link href="./common/bootstrap/css/bootstrap-theme.min.css" rel="stylesheet">
  <link rel="stylesheet" type="text/css" href="./common/css/demo.css">
  <link rel="stylesheet" type="text/css" href="./common/css/style.css">
<link rel="stylesheet" type="text/css" href="./common/css/animate-custom.css">
<link rel="stylesheet" href="./common/bootstrap/css/bootstrap.css" type="text/css"></link>
<script type="text/javascript" src="./common/bootstrap/js/bootstrap.min.js"></script>
<script type="text/javascript" src="./common/jquery/jquery-2.1.1.min.js"></script>
<body>
        <div class="container">
            <header> </header>
                <div id="container_demo">
                    <div id="wrapper">
                        <div id="login" class="animate form">
               <!--             <form name='loginForm' action="<c:url value='j_spring_security_check' />" method='POST'> -->
                                <h1>电信融合支付平台</h1>
                              <form id='loginForm' method="POST">
                                <p>
                                    <label for="" class="uname" data-icon="u"> 用户名 </label>
                                    <input id="username" name="username" required="required" type="text" placeholder="myusername or mymail@mail.com">
                                </p>
                                <p>
                                    <label for="" class="youpasswd" data-icon="p"> 密码 </label>
                                    <input id="password" name="password" required="required" type="password" placeholder="eg. X8df!90EO">
                                </p>
                                 <p>
                                    <label for="verification" class="verification" data-icon="v"> 验证  </label>
                                     <img src="index" id="verify" align="middle" title="看不清，请点我"  style="cursor:hand;"/><br/>
                                     <input type="verification" id="verifyCode" name="verifyCode" placeholder="验证码" required="required">
                                </p>
                                <!--
                                <p class="keeplogin">
                                    <input type="checkbox" name="loginkeeping" id="loginkeeping" value="loginkeeping">
                                    <label for="loginkeeping">保持登录</label>
                                </p>
                                 -->
                                <p class="login button">
                                    <input type="submit" id="submitId" value="登录">
                                </p>
                            </form>
                        </div>
                     </div>
                     </div>
</body>

    <script type="text/javascript">
        $(function(){
            /////////////////登录提交////////////////////////////
            $("#loginForm").submit(function() {
                var username=$("#username").val();
                var password=$("#password").val();
                var verifyCode=$("#verifyCode").val();
                var data={username:username,password:password,verifyCode:verifyCode};
                var url="/upsweb/user/login";
                 $.ajax({
                        type: "POST",
                        url: url,
                        data: data,
                       // contentType: "application/json",
                        dataType: "json",
                        success:function (result) {
                            if(result.ok){
                                location.href="/upsweb";
                            }else{
                                $(".error").remove();
                                $("#loginForm").prepend("<div class='error'><font color='red'>"+result.msg+"</font></div>");
                                $("#verify").attr("src","/upsweb/index?timestamp="+new Date().getTime());  // 刷新验证码
                            }
                        },
                        error:function(XMLHttpRequest, textStatus, errorThrown){
                       //     alert(XMLHttpRequest.status);
                           //    alert(XMLHttpRequest.readyState);
                            //   alert(textStatus);
                               //alert(XMLHttpRequest.responseText);
                        alert('读取超时，请检查网络连接');
                        }
                    });
                 return false;
            });
            ///////////////////验证码更新/////////////
            $("#verify").click(function(){
                   $(this).attr("src","/upsweb/index?timestamp="+new Date().getTime());
            });      

        });

        $(function ()
            { $("#dd").popover();
        });
    </script>
</html>