Spring Acegi Security实例解析三

Spring Acegi Security实例解析三                                                   

1、新建一个Web工程，将以下Jar包导进工程：acegi-security-1.0.3.jar、commons-codec-1.3.jar、commons-logging-1.0.4.jar、MySQL-connector-Java-5.0.3-bin.jar和spring.jar。

2、在mysql中执行以下SQL语句：

[sql] view plain copy print?
  1. Drop TABLE IF EXISTS `test`.`student`;  
  2. Create TABLE `test`.`student` (  
  3. `name` varchar(40) NOT NULL,  
  4. `psw` varchar(10) NOT NULL,  
  5. `enabled` boolean  
  6. );  
  7. insert into student values("lanp","lanpiao",true);  
  8. insert into student values("ph","ph",true);  
  9. insert into student values("wxh","wxh",true);  
  10.   
  11. Drop TABLE IF EXISTS `test`.`user_privileges`;  
  12. Create TABLE `test`.`user_privileges` (  
  13. `name` varchar(40) NOT NULL,  
  14. `privilege` varchar(40) NOT NULL  
  15. );  
  16. insert into user_privileges values("lanp","ROLE_PRESIDENT");  
  17. insert into user_privileges values("ph","ROLE_SUPERVISOR");  
  18. insert into user_privileges values("wxh","ROLE_USER");  
Drop TABLE IF EXISTS `test`.`student`;
Create TABLE `test`.`student` (
`name` varchar(40) NOT NULL,
`psw` varchar(10) NOT NULL,
`enabled` boolean
);
insert into student values("lanp","lanpiao",true);
insert into student values("ph","ph",true);
insert into student values("wxh","wxh",true);

Drop TABLE IF EXISTS `test`.`user_privileges`;
Create TABLE `test`.`user_privileges` (
`name` varchar(40) NOT NULL,
`privilege` varchar(40) NOT NULL
);
insert into user_privileges values("lanp","ROLE_PRESIDENT");
insert into user_privileges values("ph","ROLE_SUPERVISOR");
insert into user_privileges values("wxh","ROLE_USER");

3、web.xml配置信息如下：

[html] view plain copy print?
  1. <?xml version="1.0" encoding="UTF-8"?>  
  2. <web-app id="WebApp_ID" version="2.4" xmlns="http://java.sun.com/xml/ns/j2ee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd">  
  3.     <display-name>MyAcegiProj</display-name>  
  4.     <!--  context-param  -->  
  5.     <context-param>  
  6.         <param-name>contextConfigLocation</param-name>  
  7.         <param-value>  
  8.             /WEB-INF/applicationContext-acegi-security.xml  
  9.         </param-value>  
  10.     </context-param>  
  11.       
  12.     <!--acegi 的filter链代理-->  
  13.     <filter>  
  14.         <filter-name>MyAcegiProjFilterChainProxy</filter-name>  
  15.         <filter-class>  
  16.             org.acegisecurity.util.FilterToBeanProxy  
  17.         </filter-class>  
  18.         <init-param>  
  19.             <param-name>targetClass</param-name>  
  20.             <param-value>  
  21.                 org.acegisecurity.util.FilterChainProxy  
  22.             </param-value>  
  23.         </init-param>  
  24.     </filter>  
  25.     <filter-mapping>  
  26.         <filter-name>MyAcegiProjFilterChainProxy</filter-name>  
  27.         <url-pattern>/*</url-pattern>  
  28.     </filter-mapping>  
  29.       
  30.     <!--  
  31.         装载应用软件的Spring上下文  
  32.         要由WebapplicationContextUtils.getWebApplicationnContext(servletContext)得到.  
  33.     -->  
  34.     <listener>  
  35.         <listener-class>  
  36.             org.springframework.web.context.ContextLoaderListener  
  37.         </listener-class>  
  38.     </listener>  
  39.       
  40.     <welcome-file-list>  
  41.         <welcome-file>index.jsp</welcome-file>  
  42.     </welcome-file-list>  
  43.       
  44. </web-app>  
<?xml version="1.0" encoding="UTF-8"?>
<web-app id="WebApp_ID" version="2.4" xmlns="http://java.sun.com/xml/ns/j2ee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd">
	<display-name>MyAcegiProj</display-name>
	<!--  context-param  -->
	<context-param>
		<param-name>contextConfigLocation</param-name>
		<param-value>
			/WEB-INF/applicationContext-acegi-security.xml
		</param-value>
	</context-param>
	
	<!--acegi 的filter链代理-->
	<filter>
		<filter-name>MyAcegiProjFilterChainProxy</filter-name>
		<filter-class>
			org.acegisecurity.util.FilterToBeanProxy
		</filter-class>
		<init-param>
			<param-name>targetClass</param-name>
			<param-value>
				org.acegisecurity.util.FilterChainProxy
			</param-value>
		</init-param>
	</filter>
	<filter-mapping>
		<filter-name>MyAcegiProjFilterChainProxy</filter-name>
		<url-pattern>/*</url-pattern>
	</filter-mapping>
	
	<!--
		装载应用软件的Spring上下文
		要由WebapplicationContextUtils.getWebApplicationnContext(servletContext)得到.
	-->
	<listener>
		<listener-class>
			org.springframework.web.context.ContextLoaderListener
		</listener-class>
	</listener>
	
	<welcome-file-list>
		<welcome-file>index.jsp</welcome-file>
	</welcome-file-list>
	
</web-app>

4、applicationContext-acegi-security.xml配置文件的信息如下：

[html] view plain copy print?
  1. <?xml version="1.0" encoding="UTF-8"?>  
  2. <beans xmlns="http://www.springframework.org/schema/beans"  
  3.        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"  
  4.        xmlns:aop="http://www.springframework.org/schema/aop"  
  5.        xmlns:tx="http://www.springframework.org/schema/tx"  
  6.        xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.0.xsd  
  7.            http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop-2.0.xsd  
  8.            http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx-2.0.xsd"  
  9.            default-autowire="byName" default-lazy-init="true">   
  10.       
  11.     <!-- ================================数据源配置===================================== -->  
  12.     <bean id="dataSource" class="org.springframework.jdbc.datasource.DriverManagerDataSource">  
  13.         <property name="driverClassName">  
  14.             <value>com.mysql.jdbc.Driver</value>  
  15.         </property>  
  16.         <property name="url">  
  17.             <value>jdbc:mysql://127.0.0.1:3306/test</value>  
  18.         </property>  
  19.         <property name="username">  
  20.             <value>root</value>  
  21.         </property>  
  22.         <property name="password">  
  23.             <value>157891</value>  
  24.         </property>  
  25.     </bean>  
  26.       
  27.      <!--   ========================  FILTER CHAIN  =======================   -->   
  28.      <bean id="filterChainProxy"   class="org.acegisecurity.util.FilterChainProxy" >   
  29.        <property name="filterInvocationDefinitionSource" >   
  30.           <value >   
  31.             CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON  
  32.             PATTERN_TYPE_APACHE_ANT  
  33.              /** =authenticationProcessingFilter,logoutFilter,rememberMeProcessingFilter,exceptionTranslationFilter  
  34.          </value>  
  35.       </property>  
  36.     </bean>     
  37.     <!-- ======================== 认证filter ======================= -->  
  38.      
  39.     <!-- 表单认证处理filter -->  
  40.     <bean id="authenticationProcessingFilter" class="org.acegisecurity.ui.webapp.AuthenticationProcessingFilter">  
  41.         <property name="authenticationManager" ref="authenticationManager"/>  
  42.         <property name="authenticationFailureUrl" value="/acegilogin.jsp?login_error=1"/>  
  43.         <property name="defaultTargetUrl" value="/userinfo.jsp"/>  
  44.         <property name="filterProcessesUrl" value="/j_acegi_security_check"/>  
  45.     </bean>  
  46.       
  47.     <!-- 利用cookie自动登陆filter -->  
  48.     <bean id="rememberMeProcessingFilter" class="org.acegisecurity.ui.rememberme.RememberMeProcessingFilter">  
  49.         <property name="authenticationManager" ref="authenticationManager"/>  
  50.         <property name="rememberMeServices" ref="rememberMeServices"/>  
  51.     </bean>      
  52.       
  53.     <bean id="rememberMeServices" class="org.acegisecurity.ui.rememberme.TokenBasedRememberMeServices">  
  54.         <property name="userDetailsService" ref="jdbcDaoImpl"/>  
  55.         <property name="key" value="javargb"/>  
  56.     </bean>    
  57.       
  58.     <bean id="rememberMeAuthenticationProvider" class="org.acegisecurity.providers.rememberme.RememberMeAuthenticationProvider">  
  59.         <property name="key" value="javargb"/>  
  60.     </bean>     
  61.       
  62.     <!-- 注销处理filter -->  
  63.     <bean id="logoutFilter" class="org.acegisecurity.ui.logout.LogoutFilter">  
  64.       <constructor-arg value="/acegilogin.jsp"/> <!-- URL redirected to after logout -->  
  65.       <constructor-arg>  
  66.          <list>  
  67.               <ref bean="rememberMeServices"/>  
  68.               <bean class="org.acegisecurity.ui.logout.SecurityContextLogoutHandler"/>  
  69.          </list>  
  70.       </constructor-arg>  
  71.    </bean>  
  72.       
  73.    <!-- 认证管理器 -->  
  74.    <bean id="authenticationManager" class="org.acegisecurity.providers.ProviderManager">  
  75.       <property name="providers"><!-- 可有多个认证提供器,其中一个证通过就可以了 -->  
  76.          <list>  
  77.             <ref local="daoAuthenticationProvider"/>  
  78.             <ref local="rememberMeAuthenticationProvider"/>  
  79.          </list>  
  80.       </property>  
  81.    </bean>     
  82.     <bean id="daoAuthenticationProvider" class="org.acegisecurity.providers.dao.DaoAuthenticationProvider">  
  83.         <property name="userDetailsService" ref="jdbcDaoImpl"/>          
  84.     </bean>      
  85.       
  86.      <bean id="jdbcDaoImpl" class="org.acegisecurity.userdetails.jdbc.JdbcDaoImpl">  
  87.         <property name="dataSource"><ref bean="dataSource"/></property>  
  88.         <property name="usersByUsernameQuery">  
  89.             <value>SELECT name, psw, enabled FROM student WHERE name=?</value>  
  90.         </property>  
  91.         <property name="authoritiesByUsernameQuery">  
  92.             <value>SELECT name, privilege FROM user_privileges where name=?</value>  
  93.         </property>  
  94.     </bean>  
  95.       
  96.     <!-- 异常处理filter -->  
  97.     <bean id="exceptionTranslationFilter" class="org.acegisecurity.ui.ExceptionTranslationFilter">  
  98.         <property name="authenticationEntryPoint">  
  99.             <bean class="org.acegisecurity.ui.webapp.AuthenticationProcessingFilterEntryPoint">  
  100.                 <property name="loginFormUrl" value="/acegilogin.jsp"/>  
  101.                 <property name="forceHttps" value="false"/>  
  102.             </bean>  
  103.         </property>  
  104.         <property name="accessDeniedHandler">  
  105.             <bean class="org.acegisecurity.ui.AccessDeniedHandlerImpl">  
  106.                 <property name="errorPage" value="/accessDenied.jsp"/>  
  107.             </bean>  
  108.         </property>  
  109.     </bean>      
  110. </beans>  
<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
	   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	   xmlns:aop="http://www.springframework.org/schema/aop"
	   xmlns:tx="http://www.springframework.org/schema/tx"
	   xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.0.xsd
           http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop-2.0.xsd
           http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx-2.0.xsd"
           default-autowire="byName" default-lazy-init="true"> 
    
    <!-- ================================数据源配置===================================== -->
    <bean id="dataSource" class="org.springframework.jdbc.datasource.DriverManagerDataSource">
        <property name="driverClassName">
            <value>com.mysql.jdbc.Driver</value>
        </property>
        <property name="url">
            <value>jdbc:mysql://127.0.0.1:3306/test</value>
        </property>
        <property name="username">
            <value>root</value>
        </property>
        <property name="password">
            <value>157891</value>
        </property>
    </bean>
    
     <!--   ========================  FILTER CHAIN  =======================   --> 
     <bean id="filterChainProxy"   class="org.acegisecurity.util.FilterChainProxy" > 
       <property name="filterInvocationDefinitionSource" > 
          <value > 
            CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON
            PATTERN_TYPE_APACHE_ANT
             /** =authenticationProcessingFilter,logoutFilter,rememberMeProcessingFilter,exceptionTranslationFilter
         </value>
      </property>
    </bean>   
    <!-- ======================== 认证filter ======================= -->
   
    <!-- 表单认证处理filter -->
    <bean id="authenticationProcessingFilter" class="org.acegisecurity.ui.webapp.AuthenticationProcessingFilter">
        <property name="authenticationManager" ref="authenticationManager"/>
        <property name="authenticationFailureUrl" value="/acegilogin.jsp?login_error=1"/>
        <property name="defaultTargetUrl" value="/userinfo.jsp"/>
        <property name="filterProcessesUrl" value="/j_acegi_security_check"/>
    </bean>
    
    <!-- 利用cookie自动登陆filter -->
    <bean id="rememberMeProcessingFilter" class="org.acegisecurity.ui.rememberme.RememberMeProcessingFilter">
        <property name="authenticationManager" ref="authenticationManager"/>
        <property name="rememberMeServices" ref="rememberMeServices"/>
    </bean>    
    
    <bean id="rememberMeServices" class="org.acegisecurity.ui.rememberme.TokenBasedRememberMeServices">
        <property name="userDetailsService" ref="jdbcDaoImpl"/>
        <property name="key" value="javargb"/>
    </bean>  
    
    <bean id="rememberMeAuthenticationProvider" class="org.acegisecurity.providers.rememberme.RememberMeAuthenticationProvider">
        <property name="key" value="javargb"/>
    </bean>   
    
    <!-- 注销处理filter -->
    <bean id="logoutFilter" class="org.acegisecurity.ui.logout.LogoutFilter">
      <constructor-arg value="/acegilogin.jsp"/> <!-- URL redirected to after logout -->
      <constructor-arg>
         <list>
              <ref bean="rememberMeServices"/>
              <bean class="org.acegisecurity.ui.logout.SecurityContextLogoutHandler"/>
         </list>
      </constructor-arg>
   </bean>
    
   <!-- 认证管理器 -->
   <bean id="authenticationManager" class="org.acegisecurity.providers.ProviderManager">
      <property name="providers"><!-- 可有多个认证提供器,其中一个证通过就可以了 -->
         <list>
            <ref local="daoAuthenticationProvider"/>
            <ref local="rememberMeAuthenticationProvider"/>
         </list>
      </property>
   </bean>   
    <bean id="daoAuthenticationProvider" class="org.acegisecurity.providers.dao.DaoAuthenticationProvider">
        <property name="userDetailsService" ref="jdbcDaoImpl"/>        
    </bean>    
    
     <bean id="jdbcDaoImpl" class="org.acegisecurity.userdetails.jdbc.JdbcDaoImpl">
	  	<property name="dataSource"><ref bean="dataSource"/></property>
	  	<property name="usersByUsernameQuery">
	    	<value>SELECT name, psw, enabled FROM student WHERE name=?</value>
	    </property>
	    <property name="authoritiesByUsernameQuery">
	    	<value>SELECT name, privilege FROM user_privileges where name=?</value>
	  	</property>
	</bean>
	
    <!-- 异常处理filter -->
    <bean id="exceptionTranslationFilter" class="org.acegisecurity.ui.ExceptionTranslationFilter">
        <property name="authenticationEntryPoint">
            <bean class="org.acegisecurity.ui.webapp.AuthenticationProcessingFilterEntryPoint">
                <property name="loginFormUrl" value="/acegilogin.jsp"/>
                <property name="forceHttps" value="false"/>
            </bean>
        </property>
        <property name="accessDeniedHandler">
            <bean class="org.acegisecurity.ui.AccessDeniedHandlerImpl">
                <property name="errorPage" value="/accessDenied.jsp"/>
            </bean>
        </property>
    </bean>    
</beans>

5、index.jsp页面代码如下：

[html] view plain copy print?
  1. <%@ page language="java" pageEncoding="UTF-8"%>  
  2. <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">  
  3. <html>  
  4. <head>  
  5.     <META HTTP-EQUIV="Refresh" CONTENT="0;URL=userinfo.jsp">  
  6. </head>  
  7.   
  8. <body>  
  9. <p>Loading ...</p>  
  10. </body>  
  11. </html>  
<%@ page language="java" pageEncoding="UTF-8"%>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<html>
<head>
    <META HTTP-EQUIV="Refresh" CONTENT="0;URL=userinfo.jsp">
</head>

<body>
<p>Loading ...</p>
</body>
</html>

6、acegilogin.jsp登陆页面信息如下：

[html] view plain copy print?
  1. <%@ page language="java" pageEncoding="UTF-8"%>  
  2. <%@ page import="org.acegisecurity.ui.AbstractProcessingFilter" %>  
  3. <%@ page import="org.acegisecurity.ui.webapp.AuthenticationProcessingFilter" %>  
  4. <%@ page import="org.acegisecurity.AuthenticationException" %>  
  5. <html>  
  6.   <head>  
  7.     <title>Login Page</title>  
  8.   </head>  
  9.   <body>  
  10.     <h1>Login</h1>  
  11.   
  12.     <%  
  13.         String strError = request.getParameter("login_error");        
  14.         if (null != strError){   
  15.      %>  
  16.       <font color="red">  
  17.         你的登陆失败,请重试。<BR><BR>  
  18.          原因: <%= ((AuthenticationException) session.getAttribute(AbstractProcessingFilter.ACEGI_SECURITY_LAST_EXCEPTION_KEY)).getMessage() %>  
  19.       </font>  
  20.       <%  
  21.         }//end if  
  22.       %>  
  23.   
  24.     <form action="j_acegi_security_check" method="POST">  
  25.       <table>  
  26.         <tr><td>User:</td><td><input type='text' name='j_username' value='<%= session.getAttribute(AuthenticationProcessingFilter.ACEGI_SECURITY_LAST_USERNAME_KEY) %>'></td></tr>  
  27.         <tr><td>Password:</td><td><input type='password' name='j_password'></td></tr>  
  28.         <tr><td><input type="checkbox" name="_acegi_security_remember_me"></td><td>2周内自动登录</td></tr>  
  29.   
  30.         <tr><td colspan='2'><input name="submit" type="submit"></td></tr>  
  31.         <tr><td colspan='2'><input name="reset" type="reset"></td></tr>  
  32.       </table>  
  33.     </form>  
  34.   
  35.   </body>  
  36. </html>  
<%@ page language="java" pageEncoding="UTF-8"%>
<%@ page import="org.acegisecurity.ui.AbstractProcessingFilter" %>
<%@ page import="org.acegisecurity.ui.webapp.AuthenticationProcessingFilter" %>
<%@ page import="org.acegisecurity.AuthenticationException" %>
<html>
  <head>
    <title>Login Page</title>
  </head>
  <body>
    <h1>Login</h1>

    <%
    	String strError = request.getParameter("login_error");    	
    	if (null != strError){ 
     %>
      <font color="red">
        你的登陆失败,请重试。<BR><BR>
         原因: <%= ((AuthenticationException) session.getAttribute(AbstractProcessingFilter.ACEGI_SECURITY_LAST_EXCEPTION_KEY)).getMessage() %>
      </font>
      <%
      	}//end if
      %>

    <form action="j_acegi_security_check" method="POST">
      <table>
        <tr><td>User:</td><td><input type='text' name='j_username' value='<%= session.getAttribute(AuthenticationProcessingFilter.ACEGI_SECURITY_LAST_USERNAME_KEY) %>'></td></tr>
        <tr><td>Password:</td><td><input type='password' name='j_password'></td></tr>
        <tr><td><input type="checkbox" name="_acegi_security_remember_me"></td><td>2周内自动登录</td></tr>

        <tr><td colspan='2'><input name="submit" type="submit"></td></tr>
        <tr><td colspan='2'><input name="reset" type="reset"></td></tr>
      </table>
    </form>

  </body>
</html>

7、userinfo.jsp用户信息页面代码如下：

[html] view plain copy print?
  1. <%@ page language="java" pageEncoding="UTF-8"%>  
  2. <%@ page import="org.acegisecurity.context.SecurityContextHolder"%>  
  3. <%@ page import="org.acegisecurity.userdetails.*"%>  
  4.   
  5. <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">  
  6. <html>  
  7.     <head>  
  8.         <title>User Info Page</title>  
  9.   
  10.         <meta http-equiv="pragma" content="no-cache">  
  11.         <meta http-equiv="cache-control" content="no-cache">  
  12.         <meta http-equiv="expires" content="0">  
  13.         <meta http-equiv="keywords" content="keyword1,keyword2,keyword3">  
  14.         <meta http-equiv="description" content="This is my page">  
  15.     </head>  
  16.   
  17.     <body>  
  18.         当前用户:  
  19.         <%  
  20.             Object obj = SecurityContextHolder.getContext().getAuthentication();          
  21.             if (null != obj){  
  22.                 Object userDetail = SecurityContextHolder.getContext().getAuthentication().getPrincipal();  
  23.                 String username = "";  
  24.                 if (userDetail instanceof UserDetails) {  
  25.                     username = ((UserDetails) userDetail).getUsername();  
  26.                 } else {  
  27.                     username = userDetail.toString();  
  28.                 }  
  29.                 out.print(username);  
  30.                 out.print("<br><a href=\"j_acegi_logout\">注销</a>");  
  31.             }else{  
  32.                 out.print("当前没有有效的用户");  
  33.                 out.print("<br><a href=\"acegilogin.jsp\">登陆</a>");  
  34.             }  
  35.         %>         
  36.     </body>  
  37. </html>  
<%@ page language="java" pageEncoding="UTF-8"%>
<%@ page import="org.acegisecurity.context.SecurityContextHolder"%>
<%@ page import="org.acegisecurity.userdetails.*"%>

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
	<head>
		<title>User Info Page</title>

		<meta http-equiv="pragma" content="no-cache">
		<meta http-equiv="cache-control" content="no-cache">
		<meta http-equiv="expires" content="0">
		<meta http-equiv="keywords" content="keyword1,keyword2,keyword3">
		<meta http-equiv="description" content="This is my page">
	</head>

	<body>
		当前用户:
		<%
			Object obj = SecurityContextHolder.getContext().getAuthentication();		
			if (null != obj){
				Object userDetail = SecurityContextHolder.getContext().getAuthentication().getPrincipal();
				String username = "";
				if (userDetail instanceof UserDetails) {
					username = ((UserDetails) userDetail).getUsername();
				} else {
					username = userDetail.toString();
				}
				out.print(username);
				out.print("<br><a href=\"j_acegi_logout\">注销</a>");
			}else{
				out.print("当前没有有效的用户");
				out.print("<br><a href=\"acegilogin.jsp\">登陆</a>");
			}
		%>		
	</body>
</html>

OK

posted @ 2017-07-24 08:54  sky20080101  阅读(220)  评论(1)    收藏  举报