使用spring security 2.0 和extjs 3.0实现web登录

使用spring security 2.0 和extjs 3.0实现web登录

1开发环境说明

本例使用MyEclipse 6.5作为开发工具，jdk1.5作为编译工具，tomcat6.0作为web运行服务器。

2开发步骤

2.1搭建web项目

关于搭建web项目相关的文档网上有很多，在此略过。搭建成功后项目结构如下图

项目依赖的jar包如下图

2.2编辑登录页面

2.2.1 index.jsp源码

本项目中把index.jsp作为登录页面。代码如下：

<%@ taglib prefix='c' uri='http://java.sun.com/jstl/core_rt' %>

<%@ page import="org.springframework.security.ui.AbstractProcessingFilter" %>

<%@ page import="org.springframework.security.ui.webapp.AuthenticationProcessingFilter" %>

<%@ page import="org.springframework.security.AuthenticationException" %>

<c:set var="ctx" value="${pageContext.request.contextPath}"/>

String path = request.getContextPath();

String basePath = request.getScheme() + "://"

+ request.getServerName() + ":" + request.getServerPort()

+ path + "/";

String strLocale = request.getParameter("locale");

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">

<html>

<head>

<title>Spring Security + ExtJS Login</title>

</head>

<body>

</center>

</body>

</html>

2.2.2 index.jsp源码说明

在Index.jsp文件中，代码“<link rel="stylesheet" type="text/css" href="${ctx}/ext-3.0.0/resources/css/ext-all.css" />”是引用extjs的样式。代码“<script src="${ctx}/ext-3.0.0/adapter/ext/ext-base.js"></script>”是加载extjs基本包。

代码“<script src="${ctx}/ext-3.0.0/ext-all.js"></script>”是加载extjs核心包。

代码“<script src="${ctx}/js/login.js"></script>”extjs登录表单。关于login.js的内容，将会在后面小节中介绍。

2.2.3 login.js源码

Ext.onReady(function(){

Ext.QuickTips.init();

var login = new Ext.FormPanel({

labelWidth:80,

url:'j_spring_security_check',

frame:true,

title:'Please Login',

defaultType:'textfield',

width:300,

height:150,

monitorValid:true,

items:[{

fieldLabel:'Username',

name:'j_username',

allowBlank:false

},{

fieldLabel:'Password',

name:'j_password',

inputType:'password',

allowBlank:false

}],

buttons:[{

text:'Login',

formBind: true,

handler:function(){

method:'POST',

success:function(){

Ext.Msg.alert('Status', 'Login Successful!', function(btn, text){

if (btn == 'ok'){

window.location = 'main.action';

}

});

failure:function(form, action){

if(action.failureType == 'server'){

obj = Ext.util.JSON.decode(action.response.responseText);

Ext.Msg.alert('Login Failed!', obj.errors.reason);

}else{

Ext.Msg.alert('Warning!', 'Authentication server is unreachable : ' + action.response.responseText);

}

});

}

}]

});

2.2.4 index.js源码说明

在index.js中定义了一个login表单，url：'j_spring_security_check'对应spring security的登录验证地址。表单里放了两个输入域'j_username'、'j_password'，分别对应用户名和密码。表单中还有一个登录按钮'Login'，点击按钮提交到后台执行登录验证。验证成功跳转到'main.action'，验证失败则提示失败信息。'main.action'是在spring mvc中定义访问地址。具体见2.3节，配置spring mvc.

2.3配置spring mvc

本项目中的spring mvc用到2个文件，src目录下com.loiane.controller.MainController.java和WEB-INF目录下的spring-security-extjs-login-servlet.xml。

2.3.1 spring-security-extjs-login-servlet.xml源码

<?xml version="1.0" encoding="UTF-8"?>

<beans xmlns="http://www.springframework.org/schema/beans"

xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

xsi:schemaLocation="http://www.springframework.org/schema/beans

http://www.springframework.org/schema/beans/spring-beans-2.5.xsd">

</bean>

</beans>

2.3.2 spring-security-extjs-login-servlet.xml源码说明

spring-security-extjs-login-servlet.xml用于URL地址映射，把类似"/*.action"的请求地址映射到com.loiane.controller.MainController.java控制器类做进一步处理，文件中有一句代码：“<bean name="/*.action" class="com.loiane.controller.MainController"></bean>”。

2.3.3 com.loiane.controller.MainController.java源码

package com.loiane.controller;

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletResponse;

import org.springframework.web.servlet.ModelAndView;

import org.springframework.web.servlet.mvc.multiaction.MultiActionController;

public class MainController extends MultiActionController {

public ModelAndView main(HttpServletRequest request,

HttpServletResponse response) throws Exception {

return new ModelAndView("main.jsp");

}

2.3.4 com.loiane.controller.MainController.java源码说明

com.loiane.controller.MainController.java继承

org.springframework.web.servlet.mvc.multiaction.MultiActionController.java类，跳转到main.jsp。

2.3.5 main.jsp源码

<%@ page language="java" contentType="text/html; charset=ISO-8859-1"

pageEncoding="ISO-8859-1"%>

<html>

<head>

<title>Spring Security + ExtJS Login</title>

</head>

<body>

<h1>You are successfully authenticated!</h1>

</body>

</html>

2.4配置spring security

本项目中的spring security用到2个文件，src目录下com.loiane.security.MyAuthenticationProcessingFilter.java和WEB-INF目录下的applicationContext-security.xml。

2.4.1 applicationContext-security.xml源码

<?xml version="1.0" encoding="UTF-8"?>

<beans xmlns="http://www.springframework.org/schema/beans"

xmlns:security="http://www.springframework.org/schema/security"

xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.0.xsd

http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-2.0.xsd">

<security:global-method-security />

<security:http auto-config="false" entry-point-ref="authenticationProcessingFilterEntryPoint">

<security:intercept-url pattern="/index.jsp" filters="none" />

<security:intercept-url pattern="/*.action" access="ROLE_USER" />

</security:http>

<security:custom-filter position="AUTHENTICATION_PROCESSING_FILTER" />

</bean>

<security:authentication-manager alias="authenticationManager" />

<bean id="authenticationProcessingFilterEntryPoint"

class="org.springframework.security.ui.webapp.AuthenticationProcessingFilterEntryPoint">

</bean>

<!--

Usernames/Passwords are

admin/111111

dianne/111111

scott/111111

peter/111111

These passwords are from spring security app example

-->

<security:authentication-provider>

<security:password-encoder hash="md5"/>

<security:user-service>

<security:user name=" admin " password="96e79218965eb72c92a549dd5a330112" authorities="ROLE_SUPERVISOR, ROLE_USER, ROLE_TELLER" />

<security:user name="dianne" password="96e79218965eb72c92a549dd5a330112" authorities="ROLE_USER,ROLE_TELLER" />

<security:user name="scott" password="96e79218965eb72c92a549dd5a330112" authorities="ROLE_USER" />

<security:user name="peter" password="96e79218965eb72c92a549dd5a330112" authorities="ROLE_USER" />

</security:user-service>

</security:authentication-provider>

</beans>

2.4.2 applicationContext-security.xml源码说明

在applicationContext-security.xml文件中配置登录权限验证。

<security:http auto-config="false" entry-point-ref="authenticationProcessingFilterEntryPoint">

<security:intercept-url pattern="/index.jsp" filters="none" />

<security:intercept-url pattern="/*.action" access="ROLE_USER" />

</security:http>

这段配置表示：我们要保护应用程序中的/*.action的URL，只有拥有ROLE_USER角色的用户才能访问。任何角色的用户都可以访问/index.jsp。你可以使用多个<intercept-url>元素为不同URL的集合定义不同的访问需求，它们会被归入一个有序队列中，每次取出最先匹配的一个元素使用。所以你必须把期望使用的匹配条件放到最上边。entry-point-ref="authenticationProcessingFilterEntryPoint"表示定义一个权限验证的入口authenticationProcessingFilterEntryPoint。

<security:custom-filter position="AUTHENTICATION_PROCESSING_FILTER" />

</bean>

这段配置定义自定义权限处理过滤器com.loiane.security.MyAuthenticationProcessingFilter，defaultTargetUrl指定验证成功或失败后转向的页面，authenticationManager引用权限管理器。

</bean>

这段配置定义权限验证入口，指定登录页面为/index.jsp，不使用https协议。

<security:authentication-provider>

<security:password-encoder hash="md5"/>

<security:user-service>

<security:user name="admin" password="96e79218965eb72c92a549dd5a330112" authorities="ROLE_SUPERVISOR, ROLE_USER, ROLE_TELLER" />

<security:user name="dianne" password="96e79218965eb72c92a549dd5a330112" authorities="ROLE_USER,ROLE_TELLER" />

<security:user name="scott" password="96e79218965eb72c92a549dd5a330112" authorities="ROLE_USER" />

<security:user name="peter" password="96e79218965eb72c92a549dd5a330112" authorities="ROLE_USER" />

</security:user-service>

</security:authentication-provider>

</beans>

这段配置定义了4个用户，密码使用md5加密，admin密码为111111拥有ROLE_SUPERVISOR, ROLE_USER, ROLE_TELLER三个角色、dianne密码为111111拥有ROLE_USER,ROLE_TELLER两个角色、scott密码为111111拥有ROLE_USER角色、peter密码为111111拥有ROLE_USER角色。

2.4.3 com.loiane.security.MyAuthenticationProcessingFilter.java源码

package com.loiane.security;

import java.io.IOException;

import java.io.Writer;

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletResponse;

import javax.servlet.http.HttpServletResponseWrapper;

import org.springframework.security.Authentication;

import org.springframework.security.AuthenticationException;

import org.springframework.security.ui.webapp.AuthenticationProcessingFilter;

public class MyAuthenticationProcessingFilter extends AuthenticationProcessingFilter {

protected void onSuccessfulAuthentication(HttpServletRequest request,

HttpServletResponse response, Authentication authResult)

throws IOException {

super.onSuccessfulAuthentication(request, response, authResult);

HttpServletResponseWrapper responseWrapper = new HttpServletResponseWrapper(response);

Writer out = responseWrapper.getWriter();

String targetUrl = determineTargetUrl( request );

out.write("{success:true, targetUrl : \'" + targetUrl + "\'}");

out.close();

}

protected void onUnsuccessfulAuthentication( HttpServletRequest request,

HttpServletResponse response, AuthenticationException failed )

throws IOException {

HttpServletResponseWrapper responseWrapper = new HttpServletResponseWrapper(response);

Writer out = responseWrapper.getWriter();

out.write("{ success: false, errors: { reason: 'Login failed. Try again.' }}");

out.close();

}

2.4.4 com.loiane.security.MyAuthenticationProcessingFilter.java源码说明

com.loiane.security.MyAuthenticationProcessingFilter.java继承于

org.springframework.security.ui.webapp.AuthenticationProcessingFilter.java类，重写了

onSuccessfulAuthentication(HttpServletRequest request, HttpServletResponse response, Authentication authResult)和onUnsuccessfulAuthentication( HttpServletRequest request, HttpServletResponse response, AuthenticationException failed )方法。在onSuccessfulAuthentication()方法中返回验证成功后的跳转地址，在onUnsuccessfulAuthentication()方法中返回验证失败的信息。

2.5配置web.xml

2.5.1 web.xml源码

<?xml version="1.0" encoding="UTF-8"?>

<web-app id="WebApp_ID" version="2.4" xmlns="http://java.sun.com/xml/ns/j2ee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd">

<display-name>spring-security-extjs-login</display-name>

<context-param>

<param-name>contextConfigLocation</param-name>

<param-value>

/WEB-INF/spring-security-extjs-login-servlet.xml

/WEB-INF/applicationContext-security.xml

</param-value>

</context-param>

<filter-name>springSecurityFilterChain</filter-name>

<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>

</filter>

<filter-mapping>

<filter-name>springSecurityFilterChain</filter-name>

<url-pattern>/*</url-pattern>

</filter-mapping>

<listener> <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>

</listener>

<servlet-name>spring-security-extjs-login</servlet-name>

<servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>

<load-on-startup>1</load-on-startup>

</servlet>

<servlet-mapping>

<servlet-name>spring-security-extjs-login</servlet-name>

<url-pattern>*.action</url-pattern>

</servlet-mapping>

<welcome-file-list>

<welcome-file>index.jsp</welcome-file>

</welcome-file-list>

</web-app>

2.5.1 web.xml源码说明

<context-param>

<param-name>contextConfigLocation</param-name>

<param-value>

/WEB-INF/spring-security-extjs-login-servlet.xml

/WEB-INF/applicationContext-security.xml

</param-value>

</context-param>

这段代码配置spring使用的相关配置文件。/WEB-INF/spring-security-extjs-login-servlet.xml是关于spring mvc的相关配置。/WEB-INF/applicationContext-security.xml是关于登录权限验证相关的配置。

<filter-name>springSecurityFilterChain</filter-name>

<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>

</filter>

<filter-mapping>

<filter-name>springSecurityFilterChain</filter-name>

<url-pattern>/*</url-pattern>

</filter-mapping>

这段代码配置spring过滤链。处理所有URL地址。

<listener> <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>

</listener>

这段代码注册spring监听器。

<servlet-name>spring-security-extjs-login</servlet-name>

<servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>

<load-on-startup>1</load-on-startup>

</servlet>

<servlet-mapping>

<servlet-name>spring-security-extjs-login</servlet-name>

<url-pattern>*.action</url-pattern>

</servlet-mapping>

这段代码注册spring mvc，处理*.action的请求。

2.6运行效果

登录页面

登录页面-验证成功提示

登录页面-验证成功后跳转到main.jsp页面

登录页面-验证失败提示

3参考文档

http://loianegroner.com/2010/02/integrating-spring-security-with-extjs-login-page/#comments