单独启用spring-security配置和spring-security集成cas配置

待我称王封你为后i 2022-01-27 04:05 456阅读 0赞

一：单独启用配置思路：  
spring-security.xml:  
1.配置路径对应的权限  
2.配置用户权限授权

web.xml:  
1.配置spring-security过滤器  
2.配置spring-security监听器，防止session固话攻击和session并发控制

二：spring-security集成cas配置思路：  
spring-security-cas.xml:  
1.配置路径对应的权限  
2.把cas的认证配置集成到这里来（即登录认证路径、认证成功回调地址、ticket校验路径、登出session监听、登出路径，登出成功回调路径等，不在web.xml配置了）  
3.角色授权，即用户授权

web.xml不变

--------------------

一：单独启用配置

<?xml version="1.0" encoding="UTF-8"?>
    <beans:beans xmlns="http://www.springframework.org/schema/security"
                 xmlns:beans="http://www.springframework.org/schema/beans"
                 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                 xsi:schemaLocation="http://www.springframework.org/schema/beans
          http://www.springframework.org/schema/beans/spring-beans.xsd
          http://www.springframework.org/schema/security
          http://www.springframework.org/schema/security/spring-security-4.2.xsd ">
    
        
        <http pattern="/images/**" security="none"/>
    
        
        <http auto-config="true" use-expressions="true">
    
            
            <csrf />
    
            
            <intercept-url pattern="/admin/**" access="hasRole('ROLE_ADMIN')"/>
            <intercept-url pattern="/" access="hasRole('ROLE_ADMIN')"/>
            <intercept-url pattern="/index.jsp" access="hasRole('ROLE_ADMIN')"/>
    
            
            <form-login login-page="/login"
                        login-processing-url="/j_spring_security_check"
                        default-target-url="/admin/welcome"
                        authentication-failure-url="/login?error"
                        username-parameter="username"
                        password-parameter="password"/>
    
            
            <logout logout-success-url="/login?logout"
                    logout-url="/j_spring_security_logout" />
    
    
        </http>
    
        
        <authentication-manager>
            
    
            
            <authentication-provider user-service-ref="loginValidation"/>
    
    
        </authentication-manager>
    
        <beans:bean class="cn.test.security.LoginValidation" id="loginValidation" />
    
    </beans:beans>

根据需要，放开注释部分。

/**
     * spring-security自定义登录校验器，必须实现UserDetailsService
     */
    public class LoginValidation implements UserDetailsService {
    
        @Autowired
        private UserService userService;
    
        @Override
        public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
    
            cn.test.model.User user = userService.getUserByUsername(username);
    
            List<SimpleGrantedAuthority> authorities = new ArrayList<SimpleGrantedAuthority>();
            authorities.add(new SimpleGrantedAuthority("ROLE_ADMIN"));
    
            User user1 = new User(user.getUsername(), user.getPassword(),authorities);
            return user1;
    
            //集成cas后
            /*List<GrantedAuthority> authorities = new ArrayList<GrantedAuthority>();
            authorities.add(new SimpleGrantedAuthority("ROLE_USER"));
    
            return new User(username,"",authorities);*/
        }
    }

web.xml添加：

<filter>
        <filter-name>springSecurityFilterChain</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
      </filter>
      <filter-mapping>
        <filter-name>springSecurityFilterChain</filter-name>
        <url-pattern>/*</url-pattern>
      </filter-mapping>
    
      
      <listener>
        <listener-class>org.springframework.security.web.session.HttpSessionEventPublisher</listener-class>
      </listener>

二：spring-security集成cas配置

上面的spring-security.xml全删除，改为spring-security-cas.xml

<?xml version="1.0" encoding="UTF-8"?>
    <beans:beans xmlns="http://www.springframework.org/schema/security"
                 xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                 xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
                      http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd">
    
        
        <http pattern="/images/**" security="none"></http>
    
        
        <http use-expressions="false" entry-point-ref="casProcessingFilterEntryPoint">
            <intercept-url pattern="/**" access="ROLE_USER"/>
            <csrf disabled="true"/>
            
            <custom-filter ref="casAuthenticationFilter"  position="CAS_FILTER" />
            <custom-filter ref="requestSingleLogoutFilter" before="LOGOUT_FILTER"/>
            <custom-filter ref="singleLogoutFilter" before="CAS_FILTER"/>
        </http>
    
        
        <beans:bean id="casProcessingFilterEntryPoint" class="org.springframework.security.cas.web.CasAuthenticationEntryPoint">
            
            <beans:property name="loginUrl" value="https://www.sso.com:8443/cas/login"/>
            <beans:property name="serviceProperties" ref="serviceProperties"/>
        </beans:bean>
        <beans:bean id="serviceProperties" class="org.springframework.security.cas.ServiceProperties">
            
            <beans:property name="service" value="/login/cas"/>
        </beans:bean>
        
    
    
        
        <beans:bean id="casAuthenticationFilter" class="org.springframework.security.cas.web.CasAuthenticationFilter">
            <beans:property name="authenticationManager" ref="authenticationManager"/>
        </beans:bean>
        
        <authentication-manager alias="authenticationManager">
            <authentication-provider  ref="casAuthenticationProvider">
            </authentication-provider>
        </authentication-manager>
        
        <beans:bean id="casAuthenticationProvider"     class="org.springframework.security.cas.authentication.CasAuthenticationProvider">
            <beans:property name="authenticationUserDetailsService">
                <beans:bean class="org.springframework.security.core.userdetails.UserDetailsByNameServiceWrapper">
                    <beans:constructor-arg ref="userDetailsService" />
                </beans:bean>
            </beans:property>
            <beans:property name="serviceProperties" ref="serviceProperties"/>
            
            <beans:property name="ticketValidator">
                <beans:bean class="org.jasig.cas.client.validation.Cas20ServiceTicketValidator">
                    <beans:constructor-arg index="0" value="https://www.sso.com:8443/cas"/>
                </beans:bean>
            </beans:property>
            <beans:property name="key" value="an_id_for_this_auth_provider_only"/>
        </beans:bean>
        
        <beans:bean id="userDetailsService" class="cn.test.security.LoginValidation"/>
    
        
    
    
        
    
        
        <beans:bean id="singleLogoutFilter" class="org.jasig.cas.client.session.SingleSignOutFilter"/>
        
        <beans:bean id="requestSingleLogoutFilter" class="org.springframework.security.web.authentication.logout.LogoutFilter">
            <beans:constructor-arg value="https://www.sso.com:8443/cas/logout?service=http://localhost:8080/images/2.jpeg"/>
            <beans:constructor-arg>
                <beans:bean class="org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler"/>
            </beans:constructor-arg>
            
            <beans:property name="filterProcessesUrl" value="/logout/cas"/>
        </beans:bean>
        
    
    </beans:beans>

/**
     * spring-security自定义登录校验器，必须实现UserDetailsService
     */
    public class LoginValidation implements UserDetailsService {
    
        @Autowired
        private UserService userService;
    
        @Override
        public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
    
            /*cn.test.model.User user = userService.getUserByUsername(username);
    
            List<SimpleGrantedAuthority> authorities = new ArrayList<SimpleGrantedAuthority>();
            authorities.add(new SimpleGrantedAuthority("ROLE_ADMIN"));
    
            User user1 = new User(user.getUsername(), user.getPassword(),authorities);
            return user1;*/
    
            //集成cas后
            List<GrantedAuthority> authorities = new ArrayList<GrantedAuthority>();
            authorities.add(new SimpleGrantedAuthority("ROLE_USER"));
    
            return new User(username,"",authorities);
        }
    }

补充：访问数据库授权---添加SQL表

CREATE TABLE `users` (
      `username` varchar(50) NOT NULL,
      `password` varchar(50) NOT NULL,
      `enabled` varchar(50) NOT NULL,
      PRIMARY KEY (`username`)
    ) ENGINE=InnoDB DEFAULT CHARSET=utf8;
    
    
    CREATE TABLE `authorities` (
      `username` varchar(50) NOT NULL,
      `authority` varchar(50) NOT NULL,
      UNIQUE KEY `ix_auth_username` (`username`,`authority`),
      CONSTRAINT `fk_authorities_users` FOREIGN KEY (`username`) REFERENCES `users` (`username`)
    ) ENGINE=InnoDB DEFAULT CHARSET=utf8;

这里是简单使用配置。