Spring Security学习笔记(一)——入门篇

谁借莪１个温暖的怀抱￠ 2021-09-26 01:36 333阅读 0赞

最近刚接触maven(60%的程序员都会使用,公司项目一般都用),所以建立在maven项目基础之上学习了Spring Security

先推荐一下spring security的资料:

[点击打开链接][Link 1]

[点击打开链接][Link 2]

一.首先建立maven的web项目

可以参考该博客 [http://blog.csdn.net/gwd1154978352/article/details/53019163][http_blog.csdn.net_gwd1154978352_article_details_53019163]

二.配置pom.xml,在里面加入Spring security的配置文件

<dependency>  
            <groupId>org.springframework.security</groupId>  
            <artifactId>spring-security-web</artifactId>  
            <version>3.2.0.RELEASE</version>  
        </dependency>  
        <dependency>  
            <groupId>org.springframework.security</groupId>  
            <artifactId>spring-security-config</artifactId>  
            <version>3.2.0.RELEASE</version>  
        </dependency>  
        
        <dependency>
    	    <groupId>commons-logging</groupId>
    	    <artifactId>commons-logging</artifactId>
    	    <version>1.2</version>
    	</dependency>

三.配置web.xml文件

context-param>  
        <param-name>contextConfigLocation</param-name>  
        <param-value>  
       
            classpath:applicationContext-security.xml  
        </param-value>  
    </context-param>  
      
      
    <filter>   
        <filter-name>springSecurityFilterChain</filter-name>    
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>    
    </filter>  
    <filter-mapping>  
        <filter-name>springSecurityFilterChain</filter-name>  
        <url-pattern>/*</url-pattern>    
    </filter-mapping>
    
    
    	<listener>
    		<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
    	</listener>
    	<listener>
        	<listener-class>org.springframework.web.context.request.RequestContextListener</listener-class>
       	</listener>
       	<listener>
       		<listener-class>org.springframework.security.web.session.HttpSessionEventPublisher</listener-class>
       	</listener>

四.配置applicationContext-security.xml文件

官方有两种配置:  
第一种:命名空间用security开头，但是在配置中一直需要用<security:\*>来配置。

第二种:命名空间用bean开头，在配置中不需要security前缀，但是bean的配置需要用<beans:bean>配置。

<beans:beans xmlns="http://www.springframework.org/schema/security"  
       xmlns:beans="http://www.springframework.org/schema/beans"  
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"  
       xsi:schemaLocation="http://www.springframework.org/schema/beans  
                http://www.springframework.org/schema/beans/spring-beans-3.0.xsd  
                http://www.springframework.org/schema/security  
                http://www.springframework.org/schema/security/spring-security.xsd">  
       ...  
    </beans:beans>

这里使用第一种

<?xml version="1.0" encoding="UTF-8"?>  
    <beans xmlns="http://www.springframework.org/schema/beans"
      xmlns:sec="http://www.springframework.org/schema/security"
      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xsi:schemaLocation="http://www.springframework.org/schema/beans
              http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
              http://www.springframework.org/schema/security
              http://www.springframework.org/schema/security/spring-security.xsd">
              
              
    
    
            <sec:http pattern="/login.jsp" security="none"></sec:http>   
              
            
            <sec:http auto-config="true" >
                
                
                
                
            <sec:form-login login-page="/login.jsp" authentication-failure-url="/login.jsp" default-target-url="/index.jsp"/>
           
            
            <sec:intercept-url pattern="/index.jsp" access="ROLE_user"/>
    
    
            
            <sec:access-denied-handler error-page="/error.jsp"/>
            </sec:http>
    
    
            <sec:authentication-manager>
            <sec:authentication-provider>
            
            <sec:user-service>
            <sec:user name="TOM" authorities="ROLE_user" password="TOM"/>
            <sec:user name="jack" authorities="ROLE_Manger" password="jack"/>
            </sec:user-service>
            </sec:authentication-provider>
            </sec:authentication-manager>
    </beans>

五.自定义界面的编写

注意:action,name是固定的,更改后Spring将无法识别

那么有人要问了,在jsp页面如何引入用户名呢?

首先引入taglib

<%@ taglib prefix="sec" uri="http://www.springframework.org/security/tags" %>

通过<sec:authentication property="name"/>该方法即可获得用户名

六.运行maven,输入jetty:run即可

[Link 1]: http://www.blogjava.net/SpartaYew/archive/2011/06/15/350630.html
[Link 2]: http://www.mossle.com/docs/auth/html/index.html
[http_blog.csdn.net_gwd1154978352_article_details_53019163]: http://blog.csdn.net/gwd1154978352/article/details/53019163