spring-security3.2.5实现中国式安全管理(转)

最近公司要做开发平台，对安全要求比较高；SPRING SECURTIY框架刚好对所有安全问题都有涉及，框架的作者最近还做了spring-session项目实现分布式会话管理，还有他的另一个开源项目spring-security-oauth2。           关于spring-security的配置方法，网上有非常多的介绍，大都是基于XML配置，配置项目非常多，阅读和扩展都不方便。其实spring-security也有基于java的配置方式，今天就讲讲如何通过java配置方式，扩展spring-security实现权限配置全部从表中读取。 
    直接上代码： 
application.properties配置文件

1. privilesByUsernameQuery= select  authority from user_authorities  where username = ?
2. allUrlAuthoritiesQuery=SELECT authority_id , url   FROM Url_Authorities

javaconfig

1. /**
2. *
3. */
4. package com.sivalabs.springapp.config;
5. import java.util.List;
6. import javax.annotation.Resource;
7. import org.springframework.beans.factory.annotation.Autowired;
8. import org.springframework.context.annotation.Bean;
9. import org.springframework.context.annotation.Configuration;
10. import org.springframework.core.env.Environment;
11. import org.springframework.jdbc.core.JdbcTemplate;
12. import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
13. //import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
14. import org.springframework.security.config.annotation.web.builders.HttpSecurity;
15. import org.springframework.security.config.annotation.web.builders.WebSecurity;
16. import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
17. import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
18. import org.springframework.util.StringUtils;
19. import com.sivalabs.springapp.entities.UrlAuthority;
20. import com.sivalabs.springapp.repositories.UserRepository;
21. /**
22. * @author tony
23. *
24. */
25. @Configuration
26. @EnableWebSecurity(debug = true)
27. // @EnableGlobalMethodSecurity(prePostEnabled = true)
28. // @ImportResource("classpath:applicationContext-security.xml")
29. public class SecurityConfig extends WebSecurityConfigurerAdapter {
30. @Autowired
31. JdbcTemplate jdbcTemplate ;
32. @Autowired
33. private Environment env;
34. @Bean
35. CustomUserDetailsService customUserDetailsService() {
36. //==================application.properties文件中配置2个SQL=============
37. //privilesByUsernameQuery= select  authority from user_authorities  where username = ?
38. //allUrlAuthoritiesQuery=SELECT authority_id , url   FROM Url_Authorities
39. String privilesByUsernameQuery = env.getProperty("privilesByUsernameQuery");
40. String allUrlAuthoritiesQuery = env.getProperty("allUrlAuthoritiesQuery");
41. CustomUserDetailsService customUserDetailsService = new CustomUserDetailsService();
42. customUserDetailsService.setJdbcTemplate(jdbcTemplate);
43. customUserDetailsService.setEnableGroups(false);
44. //根据登录ID，查登录用户的所有权限
45. if(StringUtils.hasLength(privilesByUsernameQuery))
46. customUserDetailsService.setAuthoritiesByUsernameQuery(privilesByUsernameQuery);
47. //所有URL与权限的对应关系
48. if(StringUtils.hasLength(privilesByUsernameQuery))
49. customUserDetailsService.setAllUrlAuthoritiesQuery(allUrlAuthoritiesQuery);
50. return customUserDetailsService;
51. }
52. @Resource(name = "userRepository")
53. private UserRepository userRepository;
54. @Override
55. protected void configure(AuthenticationManagerBuilder registry)
56. throws Exception {
57. /*
58. * registry .inMemoryAuthentication() .withUser("siva") // #1
59. * .password("siva") .roles("USER") .and() .withUser("admin") // #2
60. * .password("admin") .roles("ADMIN","USER");
61. */
62. // registry.jdbcAuthentication().dataSource(dataSource);
63. registry.userDetailsService(customUserDetailsService());
64. }
65. @Override
66. public void configure(WebSecurity web) throws Exception {
67. web.ignoring().antMatchers("/resources/**"); // #3web
68. }
69. // AntPathRequestMatcher --> AntPathRequestMatcher --->AntPathMatcher
70. @Override
71. protected void configure(HttpSecurity http) throws Exception {
72. //1.登录注册等URL不要身份验证
73. http.csrf().disable().authorizeRequests()
74. .antMatchers("/login", "/login/form**", "/register", "/logout")
75. .permitAll() // #4
76. .antMatchers("/admin", "/admin/**").hasRole("ADMIN"); // #6
77. //2. 从数据库中读取所有需要权限控制的URL资源，注意当新增URL控制时，需要重启服务
78. List<UrlAuthority> urlAuthorities = customUserDetailsService().loadUrlAuthorities();
79. for (UrlAuthority urlAuthority : urlAuthorities) {
80. http.authorizeRequests().antMatchers(urlAuthority.getUrl()).hasAuthority(String.valueOf(urlAuthority.getId()));
81. }
82. //3. 除1，2两个步骤验证之外的URL资源，只要身份认证即可访问
83. http.authorizeRequests().anyRequest().authenticated() // 7
84. .and().formLogin() // #8
85. .loginPage("/login/form") // #9
86. .loginProcessingUrl("/login").defaultSuccessUrl("/welcome") // #defaultSuccessUrl
87. .failureUrl("/login/form?error").permitAll(); // #5
88. }
89. }

1.读取数据库中的URL资源对应的权限列表  2.读取登录用户拥有的权限列表

1. /**
2. *
3. */
4. package com.sivalabs.springapp.config;
5. import java.sql.ResultSet;
6. import java.sql.SQLException;
7. import java.util.List;
8. import org.springframework.jdbc.core.RowMapper;
9. import org.springframework.security.core.GrantedAuthority;
10. import org.springframework.security.core.authority.SimpleGrantedAuthority;
11. import org.springframework.security.core.userdetails.jdbc.JdbcDaoImpl;
12. import com.sivalabs.springapp.entities.UrlAuthority;
13. /**
14. * @author tony
15. *
16. */
17. public class CustomUserDetailsService extends JdbcDaoImpl{
18. private String allUrlAuthoritiesQuery ;
19. /**
20. * 从数据库中读取所有需要权限控制的URL资源，注意当新增URL控制时，需要重启服务
21. */
22. public List<UrlAuthority> loadUrlAuthorities( ) {
23. return getJdbcTemplate().query(allUrlAuthoritiesQuery,  new RowMapper<UrlAuthority>() {
24. public UrlAuthority mapRow(ResultSet rs, int rowNum) throws SQLException {
25. return new UrlAuthority (rs.getInt(1),rs.getString(2));
26. }
27. });
28. }
29. /**
30. *  从数据库中读取用户权限
31. * Loads authorities by executing the SQL from <tt>authoritiesByUsernameQuery</tt>.
32. * @return a list of GrantedAuthority objects for the user
33. */
34. protected List<GrantedAuthority> loadUserAuthorities(String username) {
35. return getJdbcTemplate().query(super.getAuthoritiesByUsernameQuery(), new String[] {username}, new RowMapper<GrantedAuthority>() {
36. public GrantedAuthority mapRow(ResultSet rs, int rowNum) throws SQLException {
37. String roleName =  rs.getString(1);
38. return new SimpleGrantedAuthority(roleName);
39. }
40. });
41. }
42. public void setAllUrlAuthoritiesQuery(String allUrlAuthoritiesQuery) {
43. this.allUrlAuthoritiesQuery = allUrlAuthoritiesQuery;
44. }
45. }

测试数据及案例见  http://note.youdao.com/share/?id=c20e348d9a08504cd3ac1c7c58d1026e&type=note 
spring-security-oauth2  http://www.mvnrepository.com/artifact/org.springframework.security.oauth/spring-security-oauth2 
Maven Repository: org.springframework.session » spring-session  http://www.mvnrepository.com/artifact/org.springframework.session/spring-session

• springmvc-datajpa-security-demo.zip (964.9 KB)

http://json20080301.iteye.com/blog/2190711