Spring Security-自定义配置Filter

自定义配置Filter

一.最基础的配置

SecurityContextPersistenceFilter

用来建立 SecurityContext,而它被用来贯穿整个 request 过程以跟踪请求者的认证信息。

    <bean id="securityContextPersistenceFilter"
        class="org.springframework.security.web.context.SecurityContextPersistenceFilter/>

UsernamePasswordAuthenticationFilter

用来处理 form 交并检查认证存储是否为合法凭证

    <bean id="UsernamePasswordAuthenticationFilter"
        class="org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter">
        <property name="authenticationManager" ref="customAuthenticationManager"/>
        <!-- 高级配置 添加rememberMe-->
        <property name="rememberMeServices" ref="rememberMeServices"/>
    </bean>

AnonymousAuthenticationFilter

站点允许匿名访问。尽管对于比较特殊的条件 AnonymousAuthenticationFilter 并 不需要,但是通常情况下会使用它,因为只对请求添加了一点的预处理。

    <bean id="anonymousAuthenticationFilter"
        class="org.springframework.security.web.authentication.AnonymousAuthenticationFilter">
        <property name="userAttribute" value="anonymousUser,ROLE_ANONYMOUS"/>
        <property name="key" value="BF93JFJ091N00Q7HF"/>
    </bean>

FilterSecurityInterceptor

最终负责检查 Authentication，这个过滤器确定一个特定的请求最终是被拒绝还是被接受。

    <bean id="filterSecurityInterceptor"
        class="org.springframework.security.web.access.intercept.FilterSecurityInterceptor">
        <property name="authenticationManager" ref="customAuthenticationManager"/>
        <property name="accessDecisionManager" ref="affirmativeBased"/>
        <property name="securityMetadataSource">
            <security:filter-security-metadata-source>
                <security:intercept-url pattern="/login.do" access="IS_AUTHENTICATED_ANONYMOUSLY"/>
                <security:intercept-url pattern="/home.do" access="IS_AUTHENTICATED_ANONYMOUSLY"/>
                <security:intercept-url pattern="/account/*.do" access="ROLE_USER"/>
                <security:intercept-url pattern="/*" access="ROLE_USER"/>
            </security:filter-security-metadata-source>
        </property>
    </bean>

配置最少的支持对象集合

    <!--投票器配置-->
    <bean class="org.springframework.security.access.vote.AffirmativeBased" id="affirmativeBased">
        <property name="decisionVoters">
        <list>
            <ref bean="roleVoter"/>
            <ref bean="authenticatedVoter"/>
        </list>
        </property>
    </bean>
    <bean class="org.springframework.security.access.vote.RoleVoter" id="roleVoter"/>
    <bean class="org.springframework.security.access.vote.AuthenticatedVoter"id="authenticatedVoter"/>

    <!--customAuthenticationManager 配置 提供 Authentication信息-->
    <bean id="customAuthenticationManager"
        class="org.springframework .security.authentication.ProviderManager">
        <property name="providers">
        <list>
            <ref local="daoAuthenticationProvider"/>
            <ref local=”anonymousAuthenticationProvider”/>
            <!-- 此处为高级配置 添加rememberme-->
            <ref local="rememberMeAuthenticationProvider"/>
        </list>
        </property>
    </bean>

    <bean id="daoAuthenticationProvider"
        class="org.springframework .security.authentication.dao.DaoAuthenticationProvider">
        <property name="userDetailsService" ref="jdbcUserService"/>
    </bean>

    <bean id=”anonymousAuthenticationProvider”
        class=”org.springframework.security.authentication.AnonymousAuthenticationProvider”>
        <property name=”key” value=”BF93JFJ091N00Q7HF”/>
    </bean>

二 高级配置

Session 生命周期的调整元素

AbstractAuthenticationProcessingFilter (UsernamePasswordAuthenticationFilter 的父类)

属性:allowSessionCreation 默认值：true

如果为 true,当认证失败时创建一个 新的 session(存储异常)

UsernamePasswordAuthenticationFilter

属性:tearllowSessionCreation 默认值:true

如果为 true 的话, 这个特殊的过滤器将会创建一个 session 存储最后尝试的用户名。

SecurityContextLogoutHandler

属性:invalidateHttpSession 默认值:true

如果为 true, HttpSession 将会失效(参考 Servlet 规 范了解 session 失效 的细节)

SecurityContextPersistenceFilter

属性:forceEagerSessionCreation 默认值:false

如果为 true,该过 滤器将会在执行链中其它过滤器之前 创建一个 session。

HttpSessionSecurityContextRepository

属性:allowSessionCreation 默认值:true

如果为 true,如果 在请求结束时 session 中还没有 SecurityContext 的 话,SecurityContext 将存储到 session 中。

手动配置其它通用的服务

声明缺失的过滤器 添加三个我们还没有配置的服务。包含处理退出、 remember me 以及异常转换

    <bean id="springSecurityFilterChain" class="org.springframework.security.web.FilterChainProxy">
        <security:filter-chain-map path-type="ant">
            <security:filter-chain pattern="/**" filters=" securityContextPersistenceFilter, logoutFilter,
                usernamePasswordAuthenticationFilter, rememberMeAuthenticationFilter,
                anonymousAuthenticationFilter, exceptionTranslationFilter, filterSecurityInterceptor" />
        </security:filter-chain-map>
    </bean>

    <!--LogoutFilter-->
    <bean id="logoutFilter" class="org.springframework.security .web.authentication.logout.LogoutFilter">
    <!-- the post-logout destination -->
        <constructor-arg value="/"/>
        <constructor-arg>
            <array>
                <ref local="logoutHandler"/>
                <!--高级配置 添加 rememberMe-->
                <ref local="rememberMeServices"/>
            </array>
        </constructor-arg>
        <property name="filterProcessesUrl" value="/logout"/>
    </bean>

    <bean id="logoutHandler"
        class="org.springframework.security .web.authentication.logout.SecurityContextLogoutHandler"/>

        <!--RememberMeAuthenticationFilter-->
        <bean id="rememberMeAuthenticationFilter"
            class="org.springframework.security.web.authentication.rememberme.RememberMeAuthenticationFilter">
            <property name="rememberMeServices" ref="rememberMeServices"/>
            <property name="authenticationManager" ref="customAuthenticationManager" />
        </bean>

        <bean id="rememberMeServices"
            class="org.springframework.security.web.authentication.rememberme.PersistentTokenBasedRememberMeServices">
            <property name="key" value="jbcpPetStore"/>
            <property name="tokenValiditySeconds" value="3600"/>
            <property name="tokenRepository" ref="jdbcRememberMeTokenRepository"/>
            <property name="userDetailsService" ref="jdbcUserService"/>
        </bean>

        <bean id="jdbcRememberMeTokenRepository"
            class="org.springframework.security.web .authentication.rememberme.JdbcTokenRepositoryImpl">
            <property name="dataSource" ref="dataSource"/>
        </bean>

        <bean id="rememberMeAuthenticationProvider"
            class="org.springframework.security .authentication.RememberMeAuthenticationProvider">
            <property name="key" value="jbcpPetStore"/>
        </bean>

        <!--ExceptionTranslationFilter-->
        <bean id="exceptionTranslationFilter"
            class="org.springframework.security.web .access.ExceptionTranslationFilter">
            <property name="authenticationEntryPoint" ref="authenticationEntryPoint"/>
            <property name="accessDeniedHandler" ref="accessDeniedHandler"/>
        </bean>

        <bean id="authenticationEntryPoint"
            class="org.springframework.security.web .authentication.LoginUrlAuthenticationEntryPoint">
            <property name="loginFormUrl" value="/login.do"/>
        </bean>
        <bean id="accessDeniedHandler"
            class="org.springframework.security.web .access.AccessDeniedHandlerImpl">
            <property name="errorPage" value="/accessDenied.do"/>
        </bean>

    

明确配置 SpEL 表达式和投票器

    <!--重新配置了 affirmativeBased 该类会被AccessDecisionManager使用-->
    <bean class="org.springframework.security.access.vote.AffirmativeBased" id="affirmativeBased">
        <property name="decisionVoters">
            <list>
                <ref bean="expressionVoter"/>
            </list>
        </property>
    </bean>

    <bean class="org.springframework.security.web.access .expression.WebExpressionVoter" id="expressionVoter">
        <property name="expressionHandler" ref="expressionHandler"/>
    </bean>

    <bean class="org.springframework.security.web.access.expression.DefaultWebSecurityExpressionHandler"
        id="expressionHandler"/>