spring-security项目使用ldap认证方式

package com.case.config;

import java.util.Arrays;
import java.util.Collection;

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.ProviderManager;
import org.springframework.security.authentication.event.LoggerListener;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.ldap.authentication.ad.ActiveDirectoryLdapAuthenticationProvider;


@Configuration
@EnableWebSecurity  
//@EnableGlobalMethodSecurity(securedEnabled = true)  
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

	private static final Logger logger = LoggerFactory.getLogger(WebSecurityConfig.class);
	
	@Autowired
	MyLdapUserDetailsMapper whLdapUserDetailsMapper;
	
	//定义AD认证方法
	@Bean
    public ActiveDirectoryLdapAuthenticationProvider activeDirectoryLdapAuthenticationProvider() {
        
		final ActiveDirectoryLdapAuthenticationProvider provider = new ActiveDirectoryLdapAuthenticationProvider("case.com", "ldap://172.17.160.27:389");
        provider.setConvertSubErrorCodesToExceptions(true);
        provider.setUseAuthenticationRequestCredentials(true);
        //provider.setAuthoritiesMapper(myAuthoritiesMapper()); //see http://comdynamics.net/blog/544/spring-security-3-integration-with-active-directory-ldap/
        provider.setUseAuthenticationRequestCredentials(true);
        
        //设置角色权限
        provider.setUserDetailsContextMapper(whLdapUserDetailsMapper);
        return provider;
    }

	//引入登录监听类(成功/失败)，也可以重写这个类。
    @Bean
    public LoggerListener loggerListener() {
        return new LoggerListener();
    }

    
    //配置地址访问规则
    @Override
    protected void configure(HttpSecurity http) throws Exception {
    	http.authorizeRequests().antMatchers("/**").permitAll().anyRequest()
        .fullyAuthenticated().and().formLogin();
    } 

    /*
    
    //配置单个AuthenticationProvider（ActiveDirectoryLdapAuthenticationProvider）
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
    	//AuthenticationProvider是做验证工作的组件
        auth.authenticationProvider(activeDirectoryLdapAuthenticationProvider());
    }*/
    
    
    //配置多种认证方式，即多个AuthenticationProvider（用ProviderManager的Arrays.asList添加多个认证方法）
    @Override
    protected AuthenticationManager authenticationManager() throws Exception {
        ProviderManager authenticationManager = new ProviderManager(Arrays.asList(activeDirectoryLdapAuthenticationProvider()));
       //不擦除认证密码，擦除会导致TokenBasedRememberMeServices因为找不到Credentials再调用UserDetailsService而抛出UsernameNotFoundException
        authenticationManager.setEraseCredentialsAfterAuthentication(false);
        return authenticationManager;
    }
    
    
}

添加权限的类

package com.case.config;

import java.util.ArrayList;
import java.util.Collection;
import java.util.List;
 
import org.springframework.ldap.core.DirContextOperations;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.ldap.userdetails.LdapUserDetailsMapper;
import org.springframework.stereotype.Component;
 
@Component
public class MyLdapUserDetailsMapper extends LdapUserDetailsMapper {
 
	@Override
	public UserDetails mapUserFromContext(DirContextOperations ctx, String username, Collection<? extends GrantedAuthority> authorities) {
		List<SimpleGrantedAuthority> WhAuthorities = new ArrayList<>();
		// 新建N个角色
		WhAuthorities.add(new SimpleGrantedAuthority("ROLE_ADMIN"));
		WhAuthorities.add(new SimpleGrantedAuthority("ROLE_USER"));
		WhAuthorities.add(new SimpleGrantedAuthority("wh03"));
		return super.mapUserFromContext(ctx, username, WhAuthorities);
	}
}

启动类：

package com.mayocase;

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.boot.web.servlet.ServletComponentScan;
import org.springframework.test.context.ContextConfiguration;
import org.springframework.transaction.annotation.EnableTransactionManagement;

//@EnableTransactionManagement
/**
 * @author zhuyr
 *
 */
@ServletComponentScan
@SpringBootApplication
//@ContextConfiguration(locations={"classpath:spring-security-context.xml"})
public class HelloApplication {

	public static void main(String[] args) {
		SpringApplication.run(HelloApplication.class, args);
	}
}

用thymeleaf写的首页：

<!DOCTYPE html>
<html xmlns:th="http://www.thymeleaf.org" 
	  xmlns:sec="http://www.thymeleaf.org/thymeleaf-extras-springsecurity4">

<head lang="en" th:replace="fragments/header :: header">
</head>

<body>
<div>
	<!-- 顶部导航栏  -->
	
	
	<!-- 中  -->
	<div class="center">
	
		
		<!-- 右侧内容  -->
		<div class="right">
		     		<div class="starter-template">
		      			<h1 th:text="${msg.title}"></h1>
				
						<p class="bg-primary" th:text="${msg.content}"></p>
				
						<div sec:authorize="hasRole('ROLE_USER')"> <!-- 用户类型为ROLE_ADMIN 显示 -->
				 			<p class="bg-info" th:text="${msg.etraInfo}"></p>
						</div>
		          		<div sec:authorize="hasRole('ROLE_ADMIN')"> <!-- 用户类型为ROLE_ADMIN 显示 -->
		            	  	<p class="bg-info">恭喜您,您有 ROLE_ADMIN 权限 </p>
		          		</div>
		
						<!–匿名–>
		        		<div  sec:authorize="isAnonymous()">
		            			未登录，点击 <a th:href="@{/login}"  class="btn btn-primary">登录</a>
		        		</div>
		          		<form th:action="@{/logout}" method="post" sec:authorize="isAuthenticated()">
		            		<input type="submit" class="btn btn-primary" value="注销"/>
		        		</form>
					</div>
		</div>
	</div>
	
	<!-- 底部导航栏  -->
	
	
</div>
</body>
</html>

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
	<modelVersion>4.0.0</modelVersion>

	<groupId>com.case</groupId>
	<artifactId>spring-security-ldap</artifactId>
	<version>1.0</version>
	<packaging>jar</packaging>

	<name>spring-security-ldap</name>
	<description>Demo project for Spring Boot</description>

	<parent>
		<groupId>org.springframework.boot</groupId>
		<artifactId>spring-boot-starter-parent</artifactId>
		<version>2.0.0.RELEASE</version>
	</parent>

	<properties>
		<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
		<java.version>1.8</java.version>
	</properties>

	<dependencies>
		<dependency>
			<groupId>org.springframework.boot</groupId>
			<artifactId>spring-boot-starter-web</artifactId>
		</dependency>
		<dependency>
			<groupId>org.springframework.boot</groupId>
			<artifactId>spring-boot-starter-test</artifactId>
			<scope>test</scope>
		</dependency>

		<dependency>
			<groupId>org.springframework.boot</groupId>
			<artifactId>spring-boot-starter-security</artifactId>
		</dependency>


		<dependency>
			<groupId>org.springframework.boot</groupId>
			<artifactId>spring-boot-starter-thymeleaf</artifactId>
		</dependency>


		<dependency>
			<groupId>org.thymeleaf.extras</groupId>
			<artifactId>thymeleaf-extras-springsecurity4</artifactId>
		</dependency>
<!-- ldap -->
<dependency>
			<groupId>org.springframework.security</groupId>
			<artifactId>spring-security-ldap</artifactId>
		</dependency>
<dependency>
        <groupId>org.springframework.ldap</groupId>
        <artifactId>spring-ldap-core</artifactId>
    </dependency>


		<!-- org.apache.commons.io.FilenameUtils -->
		<dependency>
			<groupId>org.apache.directory.studio</groupId>
			<artifactId>org.apache.commons.io</artifactId>
			<version>2.4</version>
		</dependency>

		<!-- org.apache.commons.net.ftp.FTPClient -->
		<dependency>
			<groupId>commons-net</groupId>
			<artifactId>commons-net</artifactId>
			<version>1.4.1</version>
		</dependency>

		<!-- kaptcha验证码 -->
		<dependency>
			<groupId>com.github.penggle</groupId>
			<artifactId>kaptcha</artifactId>
			<version>2.3.2</version>
			<exclusions>
				<exclusion>
					<artifactId>javax.servlet-api</artifactId>
					<groupId>javax.servlet</groupId>
				</exclusion>
			</exclusions>
		</dependency>

		<!-- 前端freemarker -->
		<dependency>
			<groupId>org.springframework.boot</groupId>
			<artifactId>spring-boot-starter-freemarker</artifactId>
		</dependency>
		<dependency>
			<groupId>org.springframework.security</groupId>
			<artifactId>spring-security-taglibs</artifactId>
		</dependency>

		<dependency>
			<groupId>org.springframework.security</groupId>
			<artifactId>spring-security-config</artifactId>
		</dependency>
		<dependency>
			<groupId>javax.servlet.jsp</groupId>
			<artifactId>javax.servlet.jsp-api</artifactId>
			<version>2.3.3</version>
			<scope>provided</scope>
		</dependency>
		<dependency>
			<groupId>javax.servlet</groupId>
			<artifactId>jstl</artifactId>
			<scope>provided</scope>
		</dependency>

		<!-- mysql数据库连接 -->
		<dependency>
			<groupId>org.springframework.boot</groupId>
			<artifactId>spring-boot-starter-data-jpa</artifactId>
		</dependency>
		<dependency>
			<groupId>mysql</groupId>
			<artifactId>mysql-connector-java</artifactId>
		</dependency>

		<!-- <dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-jdbc</artifactId> 
			</dependency> -->
		<!-- 支持热部署 -->
		<dependency>
			<groupId>org.springframework.boot</groupId>
			<artifactId>spring-boot-devtools</artifactId>
			<optional>true</optional>
		</dependency>
	</dependencies>

	<build>
		<plugins>
			<plugin>
				<groupId>org.springframework.boot</groupId>
				<artifactId>spring-boot-maven-plugin</artifactId>
			</plugin>
			<plugin>
				<groupId>org.apache.maven.plugins</groupId>
				<artifactId>maven-compiler-plugin</artifactId>
				<configuration>
					<source>1.8</source>
					<target>1.8</target>
				</configuration>
			</plugin>
		</plugins>
	</build>


</project>

使用AD帐户密码登录，并初始授权为普通用户或管理员权限，然后打开首页，就可以看到相应的内容。

好不容易东找西找,了解了Securtiy + LDAP初步入门的知识，可是接下来要做什么呢？还得再研究下。

网上一堆用XML实现的方式，可是都是说了一半，我还是比较喜欢用代码实现的方式。

本项目用的是比较新的包。

spring-security项目使用ldap认证方式

猜你喜欢