spring mvc+spring security实现自定义securtiy过虑器

落日映苍穹つ 2022-09-19 12:14 136阅读 0赞

理解不透彻，还在摸索中，写下来自己看

一、创建maven-web项目

web.xml配置

<?xml version="1.0" encoding="UTF-8"?>
    <web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    	xmlns="http://java.sun.com/xml/ns/javaee" xmlns:web="http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
    	xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
    	id="WebApp_ID" version="2.5">
    	
    	<context-param>
    		<param-name>webAppRootKey</param-name>
    		<param-value>spring.root</param-value>
    	</context-param>
    	
    	
    	<listener>
    		<listener-class>org.springframework.web.util.Log4jConfigListener</listener-class>
    	</listener>
    	
    	
    	<servlet>
    		<servlet-name>dispatcher</servlet-name>
    		<servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
    		<init-param>
    			<param-name>contextConfigLocation</param-name>
    			<param-value>classpath:spring-mvc.xml</param-value>
    		</init-param>
    		<load-on-startup>1</load-on-startup>
    	</servlet>
    	<servlet-mapping>
    		<servlet-name>dispatcher</servlet-name>
    		<url-pattern>/</url-pattern>
    	</servlet-mapping>
    	
    	
    	<context-param>
    		<param-name>contextConfigLocation</param-name>
    		<param-value>classpath:spring-core.xml</param-value>
    	</context-param>
    	
    	<listener>
    		<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
    	</listener>
    	
    	
    	<filter>
    		<filter-name>CharacterEncodingFilter</filter-name>
    		<filter-class>org.springframework.web.filter.CharacterEncodingFilter</filter-class>
    		<init-param>
    			<param-name>encoding</param-name>
    			<param-value>UTF-8</param-value>
    		</init-param>
    		<init-param>
    			<param-name>forceEncoding</param-name>
    			<param-value>true</param-value>
    		</init-param>
    	</filter>
    	<filter-mapping>
    		<filter-name>CharacterEncodingFilter</filter-name>
    		<url-pattern>/*</url-pattern>
    	</filter-mapping>
    	
    	
    	<filter>
    		<filter-name>springSecurityFilterChain</filter-name>
    		<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    	</filter>
    	<filter-mapping>
    		<filter-name>springSecurityFilterChain</filter-name>
    		<url-pattern>/*</url-pattern>
    	</filter-mapping>
    	
    	<listener id="Listener_Spring_Security_Session_Event_Publisher">
    		<listener-class>org.springframework.security.web.session.HttpSessionEventPublisher</listener-class>
    	</listener>
    
    	<welcome-file-list>
    		<welcome-file>index.jsp</welcome-file>
    	</welcome-file-list>
    	
    </web-app>

mvc.xml

<?xml version="1.0" encoding="UTF-8"?>
    <beans xmlns="http://www.springframework.org/schema/beans"
    	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:p="http://www.springframework.org/schema/p"
    	xmlns:context="http://www.springframework.org/schema/context"
    	xmlns:mvc="http://www.springframework.org/schema/mvc"
    	xsi:schemaLocation="
            http://www.springframework.org/schema/beans
            http://www.springframework.org/schema/beans/spring-beans.xsd
            http://www.springframework.org/schema/context
            http://www.springframework.org/schema/context/spring-context.xsd
            http://www.springframework.org/schema/mvc   
            http://www.springframework.org/schema/mvc/spring-mvc-3.0.xsd ">
    
    	<context:component-scan base-package="spring.controller" />
    
    	<bean class="org.springframework.web.servlet.view.InternalResourceViewResolver">
    		<property name="prefix" value="/WEB-INF/views/" />
    		<property name="suffix" value=".jsp" />
    	</bean>
    
    </beans>

security.xml

网上搜索了下security的验证流程：

springSecurity的登录验证是由org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter这个过滤器来完成的,在该类的父类AbstractAuthenticationProcessingFilter中有一个AuthenticationManager接口属性,验证工作主要是通过这个AuthenticationManager接口的实例来完成的。在默认情况下，springSecurity框架会把org.springframework.security.authentication.ProviderManager类的实例注入到该属性。

**UsernamePasswordAuthenticationFilter**的验证过程如下：

1. 首先过滤器会调用自身的attemptAuthentication方法，从request中取出authentication, authentication是在**org.springframework.security.web.context.SecurityContextPersistenceFilter**过滤器中通过捕获用户提交的登录表单中的内容生成的一个**org.springframework.security.core.Authentication**接口实例.

2. 拿到authentication对象后，过滤器会调用ProviderManager类的authenticate方法，并传入该对象

3.ProviderManager类的authenticate方法再调用自身的doAuthentication方法，在doAuthentication方法中会调用类中的List<AuthenticationProvider> providers集合中的各个AuthenticationProvider接口实现类中的authenticate(Authentication authentication)方法进行验证，由此可见，真正的验证逻辑是由各个各个AuthenticationProvider接口实现类来完成的,DaoAuthenticationProvider类是默认情况下注入的一个AuthenticationProvider接口实现类

4.AuthenticationProvider接口通过UserDetailsService来获取用户信息

**需要用的类**：user（用户） role（权限） userService userServiceImpl PwdAuthenticationProcessingFilter（过滤器）PwdAuthenticationToken

**userServiceImpl**

需要实现**AuthenticationProvider**接口，通过实现**AuthenticationProvider**接口实现类中的**authenticate**(Authentication authentication)方法进行验证，

boolean **supports**(Class<? extends Object> authentication) 方法来指定对哪个token进行操作，只有结果返回true才会执行**authenticate**(Authentication authentication)方法

**Role**要实现**GrantedAuthority**，**GrantedAuthority**接口中只有一个方法**getAuthority**，获取用户自定义的权限

**user**需要实现**authentication**，用来返回验证过后的用户（authentication）交给security验证权限；实现的方法，需要注意Collection<GrantedAuthority>**getAuthorities**()，此方法要返回实现**GrantedAuthority**接口的权限列表来验证用户权限。

**PwdAuthenticationProcessingFilter**继承**AbstractAuthenticationProcessingFilter**。实现**attemptAuthentication**方法，来进行登录的验证；还需要创建类构造方法，调用父类的构造设置访问此filter的路径（action的路径）；此外还可以重写父类的**afterPropertiesSet**方法，来自定义处理器，处理用户登录成功或失败后跳转到的页面

涉及到的其他类：

**PwdAuthenticationToken**，要自己创建一个token去继承**AbstractAuthenticationToken**，用来存取用户信息，该类主要用来，**AbstractAuthenticationProcessingFilter**的实现类调用this.getAuthenticationManager().authenticate(authentication)时传递给service进行验证

\-----------------------------------------------------------------------------------------------------------

**执行顺序：**

用户未登录时，访问/home/\*的路径时，页面会自动跳转到/portal/login页面，让用户进行登录操作。

输入登录信息提交后，根据action的访问路径来找相对应的filter中的构造方法设置的访问路径，如果一致则执行该filter中的**attemptAuthentication**方法，在方法中根据request获取到用户的信息存储到**PwdAuthenticationToken**中，然后调用this.getAuthenticationManager().authenticate(authentication)，authentication传入的是**PwdAuthenticationToken**

这时候会根据在security.xml中<security:authentication-manager alias="authenticationManager">中注入的<security:authentication-provider ref="userService">来进行判断（可以有多个authentication-provider）根据service中的supports方法来比较传入的对象**PwdAuthenticationToken**，如果返回值为true则执行该service中的**authentication**方法；在authentication方法中可以把该方法的参数转换成**PwdAuthenticationToken**来进行对用户名密码的校验，验证成功后获取用户的权限，注入到user中。成功后返回user验证获取权限成功，自动跳转到/home/index.jsp页面

附各类的代码

user.java

public class User implements Authentication {
    
    	/**
    	 * 
    	 */
    	private static final long serialVersionUID = 1L;
    
    	private String name;
    	
    	private String pwd;
    	
    	private String loginName;
    	
    	@Override
    	public String getName() {
    		return name;
    	}
    	//权限
    	private Set<GrantedAuthority> accesses;
    	
    	/**
    	 * 获取权限
    	 */
    	@Override
    	public Collection<GrantedAuthority> getAuthorities() {
    		return accesses;
    	}
    
    	@Override
    	public Object getCredentials() {
    		return null;
    	}
    
    	@Override
    	public Object getDetails() {
    		return null;
    	}
    
    	@Override
    	public Object getPrincipal() {
    		return this.loginName;
    	}
    	//判断是否验证
    	private boolean authenticated=false;
    
    	/**
    	 * 是否已验证
    	 */
    	@Override
    	public boolean isAuthenticated() {
    		return this.authenticated;
    	}
    
    	@Override
    	public void setAuthenticated(boolean arg0) throws IllegalArgumentException {
    		this.authenticated=arg0;
    	}
    
    	public String getLoginName() {
    		return loginName;
    	}
    
    	public void setLoginName(String loginName) {
    		this.loginName = loginName;
    	}
    
    	public Set<GrantedAuthority> getAccesses() {
    		return accesses;
    	}
    
    	public void setAccesses(Set<GrantedAuthority> accesses) {
    		this.accesses = accesses;
    	}
    
    	public String getPwd() {
    		return pwd;
    	}
    
    	public void setPwd(String pwd) {
    		this.pwd = pwd;
    	}
    
    	public void setName(String name) {
    		this.name = name;
    	}
    
    
    }

role.java

public class Role implements GrantedAuthority{
    
    	private static final long serialVersionUID = 1L;
    
    	public static String PREFIX="ROLE_";
    	/**
    	 * 获取权限
    	 */
    	@Override
    	public String getAuthority() {
    		return PREFIX+id;
    	}
    	/**
    	 * 初始化用户权限
    	 *@author baozhichao 2013-12-19下午5:46:36	
    	 * @return
    	 */
    	public static Role getRoleUser(){
    		Role ro = new Role();
    		ro.setId("USER");
    		ro.setName("普通用户");
    		return ro;
    	}
    	
    	private String id;
    	
    	private String name;
    	public String getId() {
    		return id;
    	}
    
    	public void setId(String id) {
    		this.id = id;
    	}
    
    	public String getName() {
    		return name;
    	}
    
    	public void setName(String name) {
    		this.name = name;
    	}
    	
    
    }

UserServiceImpl.java

public class UserServiceImpl implements UserService,AuthenticationProvider {
    
    	@Override
    	public Authentication authenticate(Authentication auth)
    			throws AuthenticationException {
    
    		PwdAuthenticationToken token = (PwdAuthenticationToken)auth;
    		
    		if(token.getUserName()!=null && token.getPassword()!=null){
    			if(!token.getUserName().equals("admin")){
    				token.setErrCode("1");
    				return null;
    			}
    			
    			if(!token.getPassword().equals("123456")){
    				token.setErrCode("2");
    				return null;
    			}
    			
    			User user = new User();
    			user.setName(token.getName());
    			user.setPwd(token.getPassword());
    			//认证成功
    			user.setAuthenticated(true);
    			
    			/**写入权限*/
    			Role role = Role.getRoleUser();
    			System.out.println(role.getAuthority());
    			Set<GrantedAuthority> accesses = new HashSet<GrantedAuthority>();
    			accesses.add(role);
    			
    			user.setAccesses(accesses);
    			
    			return user;
    		}
    		return null;
    	}
    
    	@Override
    	public boolean supports(Class<? extends Object> authentication) {
    		return authentication.equals(PwdAuthenticationToken.class);
    	}
    
    }

pwdAuthenticationToken.java

public class PwdAuthenticationToken extends AbstractAuthenticationToken{
    
    	public PwdAuthenticationToken() {
    		super(null);
    	}
    	
    	private String userName;
    	private String idCode;
    	private String password;
    	private String errCode;
    
    	private static final long serialVersionUID = 1L;
    
    	@Override
    	public Object getCredentials() {
    		return this.idCode+"_"+this.userName;
    	}
    
    	@Override
    	public Object getPrincipal() {
    		return this.password;
    	}
    
    	public String getUserName() {
    		return userName;
    	}
    
    	public void setUserName(String userName) {
    		this.userName = userName;
    	}
    
    	public String getIdCode() {
    		return idCode;
    	}
    
    	public void setIdCode(String idCode) {
    		this.idCode = idCode;
    	}
    
    	public String getPassword() {
    		return password;
    	}
    
    	public void setPassword(String password) {
    		this.password = password;
    	}
    
    	public String getErrCode() {
    		return errCode;
    	}
    
    	public void setErrCode(String errCode) {
    		this.errCode = errCode;
    	}
    
    }

pwdAuthenticationProcessingFilter.java

public class PwdAuthenticationProcessingFilter extends
    		AbstractAuthenticationProcessingFilter {
    
    	private String faildPage;
    	/**
    	 * 必须要实现无参构造
    	 * spring项目名称、loginCheck访问路径
    	 */
    	protected PwdAuthenticationProcessingFilter() {
    		super("/loginCheck");//设置访问路径
    	}
    
    	@Override
    	public Authentication attemptAuthentication(HttpServletRequest request,
    			HttpServletResponse response) throws AuthenticationException,
    			IOException, ServletException {
    
    		String id = request.getParameter("id");
    		String name = request.getParameter("user_name");
    		String pwd = request.getParameter("pass_word");
    		
    		PwdAuthenticationToken token = new PwdAuthenticationToken();
    		token.setIdCode(id);
    		token.setUserName(name);
    		token.setPassword(pwd);
    		
    		Authentication auth = null;
    		
    		try {
    			auth = this.getAuthenticationManager().authenticate(token);
    		} catch (AuthenticationException e) {
    			e.printStackTrace();
    		}
    		return auth;
    	}
    
    	@Override
    	public void afterPropertiesSet() {
    		super.afterPropertiesSet();
    		
    		AuthenticationFaildPage  faild = new AuthenticationFaildPage();
    		faild.setFaildPage(faildPage);
    		
    		this.setAuthenticationFailureHandler(faild);
    		
    	}
    
    	public String getFaildPage() {
    		return faildPage;
    	}
    
    	public void setFaildPage(String faildPage) {
    		this.faildPage = faildPage;
    	}
    
    	
    }

loginController.java

import org.springframework.stereotype.Controller;
    /**
     *@author baozhichao
     *2013-12-19 下午3:09:17
     */
    import org.springframework.web.bind.annotation.RequestMapping;
    import org.springframework.web.bind.annotation.RequestMethod;
    @Controller
    @RequestMapping("/portal")
    public class LoginController {
    
    	@RequestMapping(method=RequestMethod.GET,value="/login")
    	public String login(){
    		return "login/login";
    	}
    }