acegi 用户登录成功后记录用户登录日志

最近整理了一下开发工作,在开发过程中,对用户的登录日志进行记录,是每个系统最基础的工作,faceye使用了acegi作为基础安全框架,也需要对用户登录日志进行记录,查阅了一下网上的资料,有提到使用Spring的ApplicationEvent来做的,主要是做一个ApplicationListener,判断event类型,如果是用户登录成功event,就做日志记录.

看了一下,不太喜欢,于是,打开acegi的源码来看了一下,顺便说一下,这里的源码指的是acegi2.0.

当前使用到的用户登录,主要有两种类型,一种输入用户名密码登录,另一种是根据cookie记录进行登录,所以,要针对这两个Filter进行修改.

通常,我们使用的登录验证器是这个:AuthenticationProcessingFilter

所做的配置为:

....

</bean>

那么,在这里,就需要对这个类进行一下重载

在这个类中,要看其父类中的:AbstractProcessingFilter 的doFilterHttp方法

整体方法如下:

public void doFilterHttp(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws IOException, 
           ServletException { 
       if (requiresAuthentication(request, response)) { 
           if (logger.isDebugEnabled()) { 
               logger.debug("Request is to process authentication"); 
           } 
           Authentication authResult; 
           try { 
               onPreAuthentication(request, response); 
               authResult = attemptAuthentication(request); 
           } 
           catch (AuthenticationException failed) { 
               // Authentication failed 
               unsuccessfulAuthentication(request, response, failed); 
               return; 
           } 
           // Authentication success 
           if (continueChainBeforeSuccessfulAuthentication) { 
               chain.doFilter(request, response); 
           } 
           successfulAuthentication(request, response, authResult); 
           return; 
       } 
       chain.doFilter(request, response); 
   }

在这里,acegi已经给我们预留了登录成功后置事件接口,successfulAuthentication(...)

在这个方法里面,调用了一个空方法:

onSuccessfulAuthentication(request, response, authResult);

这个方法,在acegi的代码中,是一个懒汉型的,它只会在用户登录成功后被调用,如果用户登录失败,会相应的调用方法:

unsuccessfulAuthentication(HttpServletRequest request, HttpServletResponse response,AuthenticationException failed)

其中对应的后置方法为:

onUnsuccessfulAuthentication(request, response, failed);

这两个方法,都为懒汉型的,要对用户的登录动作(成功,失败)进行记录,只需要重载这两个方法即可.

所以,进行如下实现:

/** 
 *  
 *  
 * @author:haipeng 
 * @Copy Right:www.faceye.com 
 * @System:www.faceye.com 
 * @Create 2009-7-20 
 * @Package com.faceye.components.security.intercept 
 * @Description: 
 */
public class UserAuthenticationProcessingFilter extends AuthenticationProcessingFilter 
{ 
    private IUserService userService = null; 
    private IUserLoginLogService userLoginLogService=null; 
    public IUserLoginLogService getUserLoginLogService() 
    { 
        return userLoginLogService; 
    } 
  
    public void setUserLoginLogService(IUserLoginLogService userLoginLogService) 
    { 
        this.userLoginLogService = userLoginLogService; 
    } 
    public IUserService getUserService() 
    { 
        return userService; 
    } 
  
    public void setUserService(IUserService userService) 
    { 
        this.userService = userService; 
    } 
  
    protected void onSuccessfulAuthentication(HttpServletRequest request, HttpServletResponse response, Authentication authResult) throws IOException 
    { 
        if (null != authResult) 
        { 
            String username=null; 
            Object obj=authResult.getPrincipal(); 
            if (obj instanceof UserDetails) { 
                username = ((UserDetails) obj).getUsername(); 
            } else { 
                username = obj.toString(); 
            } 
            WebAuthenticationDetails webDetails = (WebAuthenticationDetails) authResult.getDetails(); 
            String ip = webDetails.getRemoteAddress(); 
            if (StringUtils.isNotEmpty(username)) 
            { 
                User user = (User) ((UserDetailsService) this.getUserService()).loadUserByUsername(username); 
                if (null != user) 
                { 
                    UserLoginLog entity = new UserLoginLog(); 
                    entity.setUser(user); 
                    entity.setIp(ip); 
                    this.getUserLoginLogService().save(entity); 
                } 
            } 
        } 
    } 
}

以此来记录用户的登录日志,当然,还可以实现相应的:

onUnsuccessfulAuthentication(request, response, failed);

与上述代码类似.

同时,用户还可能通过RemeberMe功能进行自动登录,这时,就需要对另外一个进行重载,代码如下:

/** 
 *  
 *  
 * @author:haipeng 
 * @Copy Right:www.faceye.com 
 * @System:www.faceye.com 
 * @Create 2009-7-20 
 * @Package com.faceye.components.security.intercept 
 * @Description: 
 */
public class UserRememberMeProcessingFilter extends RememberMeProcessingFilter 
{ 
    private IUserService userService = null; 
    private IUserLoginLogService userLoginLogService=null; 
       public IUserService getUserService() 
    { 
        return userService; 
    } 
    public void setUserService(IUserService userService) 
    { 
        this.userService = userService; 
    } 
    public IUserLoginLogService getUserLoginLogService() 
    { 
        return userLoginLogService; 
    } 
    public void setUserLoginLogService(IUserLoginLogService userLoginLogService) 
    { 
        this.userLoginLogService = userLoginLogService; 
    } 
    protected void onSuccessfulAuthentication(HttpServletRequest request, HttpServletResponse response, 
                Authentication authResult) { 
  
            if (null != authResult) 
            { 
                String username=null; 
                Object obj=authResult.getPrincipal(); 
                if (obj instanceof UserDetails) { 
                    username = ((UserDetails) obj).getUsername(); 
                } else { 
                    username = obj.toString(); 
                } 
                WebAuthenticationDetails webDetails = (WebAuthenticationDetails) authResult.getDetails(); 
                String ip = webDetails.getRemoteAddress(); 
                if (StringUtils.isNotEmpty(username)) 
                { 
                    User user = (User) ((UserDetailsService) this.getUserService()).loadUserByUsername(username); 
                    if (null != user) 
                    { 
                        UserLoginLog entity = new UserLoginLog(); 
                        entity.setUser(user); 
                        entity.setIp(ip); 
                        this.getUserLoginLogService().save(entity); 
                    } 
                } 
            } 
        } 
}

至此,便可以完整的记录用户的登录日志了.

posted on 2009-07-22 09:05 海鹏阅读(3843) 评论(0) 收藏举报

刷新页面返回顶部

acegi 用户登录成功后记录用户登录日志

公告