SpringSecurity Security Framework

1 Spring Security Profile

Spring Security is able to provide a secure access control declarative security framework Spring-based solutions for enterprise applications. It provides a set can be configured in the Spring Bean application context, full use Spring IoC, DI (Inversion of Control Inversion of Control, DI: Dependency Injection dependency injection) and the AOP (Aspect Oriented Programming) function

2 Use Spring Security were a total of five steps

Detail steps are as follows

　　a, create liJun_springSecurity project (war)　

　　b, the import coordinates SpringSecurity (the pom.xml)

　　c, arranged spring-security.xml

　　d, web.xml configuration

　　e, test

Detail steps are as follows:

　  a, create liJun_springSecurity project (war)　

　　b, the import coordinates SpringSecurity (the pom.xml)

 

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
  <modelVersion>4.0.0</modelVersion>
​
  <groupId>com.itheima</groupId>
  <artifactId>itheima_springsecurity</artifactId>
  <version>1.0-SNAPSHOT</version>
  <packaging>war</packaging>
​
  <properties>
    <spring.version>5.0.2.RELEASE</spring.version>
    <spring.security.version>5.0.1.RELEASE</spring.security.version>
  </properties>
  <dependencies>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-core</artifactId>
      <version>${spring.version}</version>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-web</artifactId>
      <version>${spring.version}</version>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-webmvc</artifactId>
      <version>${spring.version}</version>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-context-support</artifactId>
      <version>${spring.version}</version>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-test</artifactId>
      <version>${spring.version}</version>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-jdbc</artifactId>
      <version>${spring.version}</version>
    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-web</artifactId>
      <version>${spring.security.version}</version>
    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-config</artifactId>
      <version>${spring.security.version}</version>
    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-taglibs</artifactId>
      <version>${spring.security.version}</version>
    </dependency>
    <dependency>
      <groupId>javax.servlet</groupId>
      <artifactId>javax.servlet-api</artifactId>
      <version>3.1.0</version>
      <scope>provided</scope>
    </dependency>
  </dependencies>
  <build>
    <plugins>
      <!-- java编译插件 -->
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-compiler-plugin</artifactId>
        <version>3.2</version>
        <configuration>
          <source>1.8</source>
          <target>1.8</target>
          <encoding>UTF-8</encoding>
        </configuration>
      </plugin>
      <plugin>
        <groupId>org.apache.tomcat.maven</groupId>
        <artifactId>tomcat7-maven-plugin</artifactId>
        <configuration>
          <!-- 指定端口 -->
          <port>8080</port>
          <!-- 请求路径 -->
          <path>/</path>
        </configuration>
      </plugin>
    </plugins>
  </build>
</project>

c, arranged spring-security.xml

Create a spring-security.xml in the class loader configuration file path resources, configure authentication and authorization information

<? XML Version = "1.0" encoding = "UTF-. 8"?> 
< Beans xmlns = "http://www.springframework.org/schema/beans" xmlns: Security = "http://www.springframework.org / Schema / Security " xmlns: xsi = " http://www.w3.org/2001/XMLSchema-instance " xsi: schemaLocation = " http://www.springframework.org/schema/beans HTTP: // the WWW. springframework.org/schema/beans/spring-beans.xsd http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd " > <! - configure intercepted rule auto-config = "page using the built-in" use-expressions = "spel whether to use the expression"If using the expression: the hasRole ( 'users with the ROLE_USER') -> <
       
       
       
    
    
    

    
        
        
        
    
    Security: HTTP Auto-config = "to true" use-Expressions = "false" > ! <- Configuration intercepted request address, address any request must have permission ROLE_USER -> < Security: Intercept url- pattern = "/ ** " Access = " ROLE_USER " /> </ Security: HTTP > <- configure the authentication information ->! < Security: authentication-Manager > < Security: authentication-Provider > < Security: the User-Service > < Security: User name = "ADMIN" password = "{} ADMIN NOOP" Authorities = "ROLE_USER"/></
        
        
    
    
    
    
        
            
                
            security:user-service>
        </security:authentication-provider>
    </security:authentication-manager>
​
</beans>

d, web.xml configuration

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd"
         version="3.1">
​
  <!--Spring监听器指定配置文件位置-->
  <context-param>
    <param-name>contextConfigLocation</param-name>
    <param-value>classpath:spring-security.xml</param-value>
  </context-param>
  <listener>
    <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
  </listener>
​
  <!--配置委派代理过滤器： filter-name必须是：springSecurityFilterChain -->
  <filter>
    <filter-name>springSecurityFilterChain</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
  </filter>
  <filter-mapping>
    <filter-name>springSecurityFilterChain</filter-name>
    <url-pattern>/*</url-pattern>
  </filter-mapping>
​
</web-app>

e, test

Access index.jsp page, if the current user is not logged certification, then jump to SpringSecurity built-in login page