Spring Security 从配置入门 学习讲解。刽子手------------securityConfig.xml

不知道我的web.xml 大家都理解了没。  废话确实有点多，可能很多知识点，大家都知道，可是我学的时候，压根什么都不懂啊....

这篇我们要讲刽子手  securityConfig。 为什么要说他是刽子手呢？  因为他是无良掌柜的小工，直接的操盘手......

<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security"
    xmlns:beans="http://www.springframework.org/schema/beans"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.springframework.org/schema/beans
           http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
           http://www.springframework.org/schema/security
           http://www.springframework.org/schema/security/spring-security-3.0.xsd">
    <http access-denied-page = "/accessDenied.jsp">        <!-- 访问拒绝页面 -->
        <form-login login-page="/login.jsp"/>   <!-- 定义登陆界面 -->
        <intercept-url pattern="/login.jsp" filters="none"/>
        <session-management>
            <concurrency-control max-sessions="1" error-if-maximum-exceeded="true"/>  <!-- 用户最大登录数设置为1 ，超过则引发异常 -->
        </session-management>
        <custom-filter ref="myFilter" before="FILTER_SECURITY_INTERCEPTOR"/>  <!-- 自定义FILTER ,FilterSecurityInterceptor 负责授权-->
    </http>
    <!-- myFilter -->
    <beans:bean id = "myFilter" class = "com.qbt.spring.security.MyFilterSecurityInterceptor">
            <beans:property name="authenticationManager" ref ="authenticationManager"></beans:property>  <!-- 登陆验证 ，验证你的用户名密码噼里啪啦-->
            <beans:property name="securityMetadataSource" ref = "securityMetadataSource"></beans:property>  <!-- 资源数据源的定义 ，神马权限对应神马资源 噼里啪啦-->
             <beans:property name="accessDecisionManager" ref="myAccessDecisionManagerBean"></beans:property>  <!-- 访问决策 有没有权限访问资源 噼里啪啦-->
    </beans:bean>                                                 

    <!-- 验证配置，认证管理器，实现UserDetailService接口 -->
    <!-- authenticationManager 可以有多个provider提供信息，我们用myUserDetailService获取信息 -->
    <!-- Spring Security中进行身份验证的是AuthenticationManager接口，ProviderManager是它的一个默认实现，
        但它并不用来处理身份认证，而是委托给配置好的AuthenticationProvider，每个AuthenticationProvider会轮流检查身份认证。
        检查后或者返回Authentication对象或者抛出异常 -->
    <authentication-manager alias="authenticationManager">
        <authentication-provider user-service-ref="myUserDetailService"></authentication-provider>
    </authentication-manager>

    <!-- 获取user数据，可以从数据库中获取用户密码，角色等！ -->
    <beans:bean id = "myUserDetailService" class = "com.qbt.spring.security.MyUserDetailService"></beans:bean>

    <!-- 访问决策器，决定用户的角色，访问的权限 -->
    <beans:bean id = "myAccessDecisionManagerBean" class = "com.qbt.spring.security.MyAccessDecisionManager"></beans:bean>

    <!-- 资源数据源的定义 什么资源对应什么权限，或者什么资源能被什么角色访问-->
    <beans:bean id = "securityMetadataSource" class = "com.qbt.spring.security.MyInvocationSecurityMetadataSource"></beans:bean>

</beans:beans>

可以看出来，这里的核心过滤器是我们自己实现的MyFilterSecurityInterceptor

//下面，贴出他的代码

package com.qbt.spring.security;

import java.io.IOException;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import org.springframework.security.access.SecurityMetadataSource;
import org.springframework.security.access.intercept.AbstractSecurityInterceptor;
import org.springframework.security.access.intercept.InterceptorStatusToken;
import org.springframework.security.web.FilterInvocation;
import org.springframework.security.web.access.intercept.FilterInvocationSecurityMetadataSource;

/**
 *登陆后，每次访问资源都会访问这个拦截器 ，执行doFilter， 调用invoke，
 *super.beforeInvocation() 会调用SecurityMetadataSource 的getAttributes方法获取fi对应的所有权限，再调用decide的方法，判断是否有权限
 *然后调用下一个拦截器。
 *
 */
public class MyFilterSecurityInterceptor extends AbstractSecurityInterceptor implements Filter{

    //配置文件注入
    private FilterInvocationSecurityMetadataSource securityMetadataSource;

    //登陆后，每次访问资源都通过这个拦截器拦截
    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
        FilterInvocation fi = new FilterInvocation(request, response, chain);
        invoke(fi);
    }

    private void invoke(FilterInvocation fi) throws IOException, ServletException {
        //fi 封装了request，response，chain
        //里面调用MyInvocationSecurityMetadataSource的getAttributes(Object object)这个方法获取fi对应的所有权限
        //再调用MyAccessDecisionManager的decide方法来校验用户的权限是否足够

        InterceptorStatusToken token = super.beforeInvocation(fi);

        //这里的token里面到底是什么呢？  八一八 来！
        /**
         * 源码---
         *  protected InterceptorStatusToken beforeInvocation(Object object)
            {
                Assert.notNull(object, "Object was null");   //预言
                //省略
                Collection attributes = obtainSecurityMetadataSource().getAttributes(object);
                //调用MyInvocationSecurityMetadataSource的getAttributes(Object object)这个方法获取fi对应的所有权限
                if(attributes == null)
                {
                    //抛异常省略
                    return null;
                }
                //省略
                //判断是否需要对认证实体重新认证，默认为否
                Authentication authenticated = authenticateIfRequired();
                try
                {//decide方法来校验用户的权限是否足够
                    accessDecisionManager.decide(authenticated, object, attributes);
                }
                catch(AccessDeniedException accessDeniedException)
                {//抛异常
                    publishEvent(new AuthorizationFailureEvent(object, attributes, authenticated, accessDeniedException));
                    throw accessDeniedException;
                }
                //省略
                return new InterceptorStatusToken(authenticated, true, attributes, object);
            }
         *
         */
        try{
            fi.getChain().doFilter(fi.getRequest(), fi.getResponse());
        } finally{
            super.afterInvocation(token, null);
        }
    }

    @Override
    public void init(FilterConfig arg0) throws ServletException {

    }
    //相对应的MyAccessDecisionManager的supports方法必须放回true,否则会提醒类型错误
    @Override
    public Class<? extends Object> getSecureObjectClass() {
        return FilterInvocation.class;
    }

    @Override
    public SecurityMetadataSource obtainSecurityMetadataSource() {
        return this.securityMetadataSource;
    }

    public void setSecurityMetadataSource(FilterInvocationSecurityMetadataSource  newSource  ){
        this.securityMetadataSource = newSource;
    }

    @Override
    public void destroy() {

    }
}

//累啊...

然后我们来看看 authenticationManager

package com.qbt.spring.security;

import java.util.ArrayList;
import java.util.Collection;

import org.springframework.dao.DataAccessException;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.GrantedAuthorityImpl;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;

public class MyUserDetailService implements UserDetailsService{

    /**
     * 获取用户信息，返回User放到Spring的全局缓存SecurityContentHolder中，让其他过滤器使用
     */
    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException, DataAccessException {
        UserDetails user = null;
        Collection<GrantedAuthority> auths=new ArrayList<GrantedAuthority>(); //定义一个权限集合
        GrantedAuthorityImpl auth1 = new GrantedAuthorityImpl("ROLE_ADMIN");  //定义一个管理员权限
        GrantedAuthorityImpl auth2 = new GrantedAuthorityImpl("ROLE_USER");   //定义一个用户权限
        System.out.println("**********MyUserDetailService登陆验证，通过用户名获取权限************");
        if(username.equals("admin")){
            auths.add(auth2);
            auths.add(auth1);
        }else{
            auths.add(auth2);
        }
        // username, password, enable， accountNonExpired， credentialsNonExpired, accountNonLocked, authorities
        user = new User(username, "admin", true, true, true, true, auths);
        return user;
    }

}

然后再看看MyInvocationSecurityMetadataSource

package com.qbt.spring.security;

import java.util.ArrayList;
import java.util.Collection;
import java.util.HashMap;
import java.util.Iterator;
import java.util.Map;

import org.springframework.security.access.ConfigAttribute;
import org.springframework.security.access.SecurityConfig;
import org.springframework.security.web.FilterInvocation;
import org.springframework.security.web.access.intercept.FilterInvocationSecurityMetadataSource;
import org.springframework.security.web.util.AntUrlPathMatcher;
import org.springframework.security.web.util.UrlMatcher;

/**
 * @author ORC
 * FilterInvocationSecurityMetadataSource  继承于 SecurityMetadataSource
 *
 */

public class MyInvocationSecurityMetadataSource implements FilterInvocationSecurityMetadataSource {

    private UrlMatcher urlMatcher = new AntUrlPathMatcher();
    public static Map<String,Collection<ConfigAttribute>> resourceMap = null;

    public MyInvocationSecurityMetadataSource () {
        loadResourceDefine();
    }

    /**
     * 获取角色和资源的相对应的关系，在tomcat启动时加载。
     * 因为是在tomcat启动时就要加载，所以如果权限对应关系改变的话，就需要重新获取
     * 如果要调用Dao的话，但是在启动的时候，这个Dao可能还没有加载
     * 所以如果要在这里调用数据库的话，要自己写sessionfaction，sql/hql
     * 还有一种方法就是，在getAttributes方法里调用Dao，因为这个方法是在tomcat启动之后才调用的
     */
    private void loadResourceDefine() {
        resourceMap  = new HashMap<String,Collection<ConfigAttribute>>();
        Collection<ConfigAttribute> atts = new ArrayList<ConfigAttribute>();
        ConfigAttribute ca = new SecurityConfig("ROLE_USER");
        atts.add(ca);
        resourceMap.put("/index.jsp", atts);
        Collection<ConfigAttribute> attsNo = new ArrayList<ConfigAttribute>();
        ConfigAttribute no = new SecurityConfig("ROLE_NO");
        attsNo.add(no);
        resourceMap.put("/other.jsp", attsNo);

        System.out.println("*************MyInvocationSecurityMetadataSource 调用，获取角色和资源对应值*******************");
    }

    @Override
    public Collection<ConfigAttribute> getAttributes(Object obj) throws IllegalArgumentException {
        String url = ((FilterInvocation)obj).getRequestUrl();
        System.out.println("*************MyInvocationSecurityMetadataSource getAttribute调用，获取资源所对应的角色集合*******************");
        Iterator<String>ite = resourceMap.keySet().iterator();
        while(ite.hasNext()){
            String resUrl = ite.next();
            if(urlMatcher.pathMatchesUrl(resUrl, url)) {
                return resourceMap.get(resUrl);
            }
        }
        return null;
    }

    @Override
    public Collection<ConfigAttribute> getAllConfigAttributes() {
        return null;
    }

    @Override
    public boolean supports(Class<?> class1) {
        return true;
    }

}

再看MyAccessDecisionManager

package com.qbt.spring.security;

import java.util.Collection;
import java.util.Iterator;

import org.springframework.security.access.AccessDecisionManager;
import org.springframework.security.access.AccessDeniedException;
import org.springframework.security.access.ConfigAttribute;
import org.springframework.security.access.SecurityConfig;
import org.springframework.security.authentication.InsufficientAuthenticationException;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.GrantedAuthority;

public class MyAccessDecisionManager implements AccessDecisionManager{

    @Override
    public void decide(Authentication authentication, Object obj, Collection<ConfigAttribute> configAttributes) throws AccessDeniedException, InsufficientAuthenticationException {
        if(configAttributes == null) {
            return;
        }
        System.out.println("*************MyAccessDecesionManager 判断用户是否有权限**************");
        Iterator<ConfigAttribute> itr = configAttributes.iterator();
        while(itr.hasNext()){
            ConfigAttribute ca = itr.next();
            String needRole = ((SecurityConfig)ca).getAttribute();
            for(GrantedAuthority ga : authentication.getAuthorities()){
                if(needRole.equals(ga.getAuthority())){
                    return;
                }
            }
        }
        throw new AccessDeniedException("No Right");
    }

    //这个 supports(ConfigAttribute) 方法在启动的时候被
    //AbstractSecurityInterceptor调用，来决定AccessDecisionManager
    //是否可以执行传递ConfigAttribute
    @Override
    public boolean supports(ConfigAttribute configattribute) {
        return false;
    }
    //supports(Class)方法被安全拦截器实现调用，
    //包含安全拦截器将显示的AccessDecisionManager支持安全对象的类型。
    @Override
    public boolean supports(Class<?> class1) {
        return true;
    }

}