spring security 3.0 实现认证与授权

先看一下spring security 官方对以下几个类或接口的解释，因为这个几个类在程序中会使用到；
ConfigAttribute：Stores a security system related configuration attribute.
SecurityConfig：ConfigAttribute的实现类。
GrantedAuthority：Represents an authority granted to an Authentication object.
GrantedAuthorityImpl：GrantedAuthority的实现类。
UserDetails：Provides core user information.
Authentication：Represents the token for an authentication request or for an authenticated principal once the request has been processed by the AuthenticationManager.authenticate(Authentication) method.
UserDetailsService：Core interface which loads user-specific data.
FilterInvocationSecurityMetadataSource：Marker interface for SecurityMetadataSource implementations that are designed to perform lookups keyed on FilterInvocations.
AccessDecisionManager：Makes a final access control (authorization) decision.

定义四张表：用户表、角色表、资源表、组织机构表（可选）

首先需要在web.xml文件中添加以下配置：

<filter>
	<filter-name>springSecurityFilterChain</filter-name>
	<filter-class>
		org.springframework.web.filter.DelegatingFilterProxy
	</filter-class>
</filter>
<filter-mapping>
	<filter-name>springSecurityFilterChain</filter-name>
	<url-pattern>/*</url-pattern>
</filter-mapping>

接着配置spring security的配置文件：

<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security"
	xmlns:beans="http://www.springframework.org/schema/beans"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xsi:schemaLocation="http://www.springframework.org/schema/beans
           http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
           http://www.springframework.org/schema/security
           http://www.springframework.org/schema/security/spring-security-3.0.xsd">

	<!-- access-denied-page：定义没有权限时跳转的页面 ；use-expressions：true表示使用表达式定义忽略拦截资源列表-->
	<http auto-config="true" access-denied-page="/accessDenied.do" use-expressions="true">
		<!-- 忽略拦截资源定义 -->
		<intercept-url pattern="/showLogin.do*" filters="none" />
		<intercept-url pattern="/scripts/**" filters="none" />
		<intercept-url pattern="/images/**" filters="none" />
		<intercept-url pattern="/styles/**" filters="none" />
		<intercept-url pattern="/dwr/**" filters="none" />
		<!-- isAuthenticated()表示只有通过验证的用户才能访问 -->
		<intercept-url pattern="/**" access="isAuthenticated()" />
		<intercept-url pattern="/main.do*" access="isAuthenticated()" />
		
		<!-- max-sessions=1：禁止2次登陆；ession-fixation-protection="none"：防止伪造sessionid攻击，用户登录成功后会销毁用户当前的session，-->
		<!-- 创建新的session并把用户信息复制到新session中 ；invalid-session-url：定义session超时跳转页面 -->
		 <session-management invalid-session-url="/timeout.jsp" session-fixation-protection="none">
            <concurrency-control max-sessions="1" />  
        </session-management>
        
		<!-- 表单验证 -->
		<form-login login-page="/showLogin.do" authentication-failure-url="/showLogin.do?error=true" always-use-default-target="true" default-target-url="/login.do?error=false" />
		<!-- 退出系统跳转页面 -->	
		<logout invalidate-session="true" logout-success-url="/showLogin.do" />
		<!-- 免登陆验证 -->
		<remember-me />
		<!-- 自定义拦截器（这里和spring security2的配置有点不同） -->
		<custom-filter before="FILTER_SECURITY_INTERCEPTOR" ref="securityFilter" />
	</http>
	
	<beans:bean id="securityFilter" class="xxx.xxx.xxx.commons.permissionengine.web.security.FilterSecurityInterceptor">
		<beans:property name="authenticationManager" ref="authenticationManager" />
		<beans:property name="accessDecisionManager" ref="securityAccessDecisionManager" />
		<beans:property name="securityMetadataSource" ref="securityMetadataSource" />
	</beans:bean>
	
	<authentication-manager alias="authenticationManager">
		<authentication-provider user-service-ref="securityUserDetailService">
			<!-- 密码采用MD5算法加密 -->
			<password-encoder hash="md5" />
		</authentication-provider>
	</authentication-manager>
	
	<!-- 用户拥有的权限 -->
	<beans:bean id="securityUserDetailService" class="xxx.xxx.xxx.commons.permissionengine.web.security.SecurityUserDetailService" />
	<!-- 用户是否拥有所请求资源的权限 -->
	<beans:bean id="securityAccessDecisionManager" class="xxx.xxx.xxx.commons.permissionengine.web.security.SecurityAccessDecisionManager" />
	<!-- 资源与权限对应关系 -->
	<beans:bean id="securityMetadataSource" class="xxx.xxx.xxx.commons.permissionengine.web.security.SecurityMetadataSource" />
</beans:beans>

接着需要写一个类实现UserDetails接口，这个并不是我们系统的用户，它只是一个VO，
用于保存从spring security上下文环境中获取到登录用户，因为从spring security上下文环境中获取登录用户的返回值就是UserDetails的实现类：

package xxx.xxx.xxx.commons.permissionengine.entity;

import java.util.Collection;

import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.userdetails.UserDetails;

public class UserDetailInfo implements UserDetails {

	private static final long serialVersionUID = 6137804370301413132L;
	
	private String userName;
	
	private String password;
	
	private Collection<GrantedAuthority> authorities;
	
	public UserDetailInfo() {}

	@Override
	public Collection<GrantedAuthority> getAuthorities() {
		return authorities;
	}

	@Override
	public String getPassword() {
		return password;
	}

	@Override
	public String getUsername() {
		return userName;
	}

	@Override
	public boolean isAccountNonExpired() {
		return true;
	}

	@Override
	public boolean isAccountNonLocked() {
		return true;
	}

	@Override
	public boolean isCredentialsNonExpired() {
		return true;
	}

	@Override
	public boolean isEnabled() {
		return true;
	}

	public String getUserName() {
		return userName;
	}

	public void setUserName(String userName) {
		this.userName = userName;
	}

	public void setPassword(String password) {
		this.password = password;
	}

	public void setAuthorities(Collection<GrantedAuthority> authorities) {
		this.authorities = authorities;
	}
}

接着自定义一个继承了AbstractSecurityInterceptor的filter：

package xxx.xxx.xxx.commons.permissionengine.web.security;

import java.io.IOException;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;

import org.springframework.security.access.SecurityMetadataSource;
import org.springframework.security.access.intercept.AbstractSecurityInterceptor;
import org.springframework.security.access.intercept.InterceptorStatusToken;
import org.springframework.security.web.FilterInvocation;
import org.springframework.security.web.access.intercept.FilterInvocationSecurityMetadataSource;

public class FilterSecurityInterceptor extends AbstractSecurityInterceptor implements Filter {
	
	private FilterInvocationSecurityMetadataSource securityMetadataSource;

	@Override
	public void destroy() {
		// TODO Auto-generated method stub
	}

	@Override
	public void doFilter(ServletRequest request, ServletResponse response, FilterChain filterChain) throws IOException, ServletException {
		FilterInvocation invocation = new FilterInvocation(request, response, filterChain);
		invoke(invocation);
	}
	
	public void invoke(FilterInvocation filterInvocation) throws IOException, ServletException {
		InterceptorStatusToken token = super.beforeInvocation(filterInvocation);
		try {
			filterInvocation.getChain().doFilter(filterInvocation.getRequest(), filterInvocation.getResponse());
		} finally {
			super.afterInvocation(token, null);
		}
	}

	@Override
	public void init(FilterConfig arg0) throws ServletException {
		// TODO Auto-generated method stub
	}

	@Override
	public Class<? extends Object> getSecureObjectClass() {
		return FilterInvocation.class;
	}

	@Override
	public SecurityMetadataSource obtainSecurityMetadataSource() {
		return this.securityMetadataSource;
	}

	public void setSecurityMetadataSource(FilterInvocationSecurityMetadataSource securityMetadataSource) {
		this.securityMetadataSource = securityMetadataSource;
	}

	public FilterInvocationSecurityMetadataSource getSecurityMetadataSource() {
		return this.securityMetadataSource;
	}
}

接着定义一个类，实现了UserDetailsService接口，主要用于获取登录用户信息和用户所具有的角色

package xxx.xxx.xxx.commons.permissionengine.web.security;


import java.util.ArrayList;
import java.util.Collection;
import java.util.Set;

import javax.annotation.Resource;

import org.springframework.dao.DataAccessException;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.GrantedAuthorityImpl;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;

import xxx.xxx.xxx.commons.permissionengine.entity.Role;
import xxx.xxx.xxx.commons.permissionengine.entity.User;
import xxx.xxx.xxx.commons.permissionengine.entity.UserDetailInfo;
import xxx.xxx.xxx.commons.permissionengine.service.IUserService;

public class SecurityUserDetailService implements UserDetailsService {

	private IUserService userService;
	
	/**
	 * 获取登录用户信息并添加到security上下文环境
	 */
	@Override
	public UserDetails loadUserByUsername(String name)throws UsernameNotFoundException, DataAccessException {
		//定义存放用户角色信息的集合
		Collection<GrantedAuthority> authorities = new ArrayList<GrantedAuthority>();
		//通过已经经过验证的登录用户的用户名查找登录用户信息
		User user = userService.findUserByProperty("name", name);
		//定义一个userDetailInfo对象，该类实现了spring security UserDetails接口，因为已经经过验证的登录用户会保持在
		//spring security上下文环境中，通过该上下文环境获取登录用户信息返回的是UserDetails类型，因此需要定义一个类实现该接口
		UserDetailInfo userDetailInfo = null;
		if(user != null) {
			//获取登录用户信息的角色列表
			Set<Role> roles = user.getRoles();
			for(Role role : roles) {
				//利用角色用户具有的角色的编号构造一个GrantedAuthority对象，并把该对象添加到集合中
				GrantedAuthorityImpl grantedAuthorityImpl = new GrantedAuthorityImpl("ROLE_"+role.getNo());
				authorities.add(grantedAuthorityImpl);
			}
			userDetailInfo = new UserDetailInfo();
			userDetailInfo.setUserName(user.getName());
			userDetailInfo.setPassword(user.getPassword());
			//把角色信息添加到userDetailInfo对象中
			userDetailInfo.setAuthorities(authorities);
		}
		return userDetailInfo;
	}
	
	@Resource(name = "userService")
	public void setUserService(IUserService userService) {
		this.userService = userService;
	}
}

再接着定义一个实现了FilterInvocationSecurityMetadataSource的类：

package xxx.xxx.xxx.commons.permissionengine.web.security;

import java.util.ArrayList;
import java.util.Collection;
import java.util.HashMap;
import java.util.Iterator;
import java.util.Map;

import javax.annotation.Resource;

import org.springframework.security.access.ConfigAttribute;
import org.springframework.security.access.SecurityConfig;
import org.springframework.security.web.FilterInvocation;
import org.springframework.security.web.access.intercept.FilterInvocationSecurityMetadataSource;
import org.springframework.security.web.util.AntUrlPathMatcher;
import org.springframework.security.web.util.UrlMatcher;

import xxx.xxx.xxx.commons.permissionengine.service.IMenuService;

/**
 * 资源源数据管理器
 * @author Keven
 *
 */
public class SecurityMetadataSource implements FilterInvocationSecurityMetadataSource {
	
	private IMenuService menuService;
	//定义一个url匹配工具类
	private UrlMatcher urlMatcher = new AntUrlPathMatcher();
	
	private static Map<String, Collection<ConfigAttribute>> menuMap = null;
	
	//该构造方法由spring容器调用
	public SecurityMetadataSource() {
		loadMenuDefine();
	}
	
	private void loadMenuDefine() {
		menuMap = new HashMap<String, Collection<ConfigAttribute>>();
		//初始化匿名用户所拥有的权限
		Collection<ConfigAttribute> guestAtts = new ArrayList<ConfigAttribute>();
		ConfigAttribute guestAttribute = new SecurityConfig("ROLE_Guest");
		guestAtts.add(guestAttribute);
		menuMap.put("/showLogin.do*", guestAtts);
	}

	@Override
	public Collection<ConfigAttribute> getAllConfigAttributes() {
		return null;
	}

	@Override
	public Collection<ConfigAttribute> getAttributes(Object object) throws IllegalArgumentException {
		//获取请求url
		String url = ((FilterInvocation)object).getRequestUrl();
		//从数据库获取资源与角色的对应关系，并设置初始化的资源_角色到该Map
		menuService.setMenuMap(menuMap);
		//获取资源列表
		Iterator<String> iter = menuMap.keySet().iterator();
		while(iter.hasNext()) {
			String menuUrl = iter.next();
			//防止把null值加入到map，报空指针异常
			if(menuUrl != null) {
				//请求url与角色所拥有的权限做匹配
				if(urlMatcher.pathMatchesUrl(menuUrl, url))
					return menuMap.get(menuUrl);
			}
		}
		return null;
	}

	@Override
	public boolean supports(Class<?> clazz) {
		return true;
	}

	@Resource(name = "menuService")
	public void setMenuService(IMenuService menuService) {
		this.menuService = menuService;
	}
}

再接着定义一个实现了AccessDecisionManager的类：

package xxx.xxx.xxx.commons.permissionengine.web.security;

import java.util.Collection;
import java.util.Iterator;

import org.springframework.security.access.AccessDecisionManager;
import org.springframework.security.access.AccessDeniedException;
import org.springframework.security.access.ConfigAttribute;
import org.springframework.security.access.SecurityConfig;
import org.springframework.security.authentication.InsufficientAuthenticationException;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.GrantedAuthority;

/**
 * 决策管理器，用于判断用户需要访问的资源与用户所拥有的角色是否匹配
 * @author Keven
 *
 */
public class SecurityAccessDecisionManager implements AccessDecisionManager {

	@Override
	public void decide(Authentication authentication, Object object, Collection<ConfigAttribute> configAttributes) throws AccessDeniedException, InsufficientAuthenticationException {
		if(configAttributes == null)
			return;
		//获取资源与角色对应关系列表
		Iterator<ConfigAttribute> iter = configAttributes.iterator();
		while(iter.hasNext()) {
			ConfigAttribute configAttribute = iter.next();
			//获取访问该资源需要的角色
			String needRole = ((SecurityConfig)configAttribute).getAttribute();
			//从上下文环境获取用户所具有的角色
			for(GrantedAuthority grantedAuthority : authentication.getAuthorities()) {
				//判断用户拥有的角色是否与访问该资源所需要的角色匹配
				if(needRole.equals(grantedAuthority.getAuthority()))
					return;
			}
		}
		throw new AccessDeniedException("权限不足！");
	}

	@Override
	public boolean supports(ConfigAttribute arg0) {
		return true;
	}

	@Override
	public boolean supports(Class<?> arg0) {
		return true;
	}
}

 spring security的基本的登录认证和授权就这样完成了，有关spring security的方法和领域对象的权限控制、单点登录和分布式登录请看下集。