spring security 原理探索

喜欢ヅ旅行 2022-05-17 02:54 186阅读 0赞

1. 环境搭建

web.xml 配置 spring security过滤器：

<filter>
        <filter-name>springSecurityFilterChain</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
      </filter>
      <filter-mapping>
        <filter-name>springSecurityFilterChain</filter-name>
        <url-pattern>/*</url-pattern>
      </filter-mapping>

spring security配置文件：

<security:http auto-config="true" use-expressions="true">
    		<security:intercept-url pattern="/index.jsp" access="permitAll"/>
    		<security:intercept-url pattern="/admin.jsp" access="hasRole('ROLE_ADMIN')"/>
    	</security:http>
    	
            
    	<security:authentication-manager>
    		<security:authentication-provider>
    			<security:user-service>
    				<security:user name="admin" password="admin" authorities="ROLE_USER, ROLE_ADMIN"></security:user>
    				<security:user name="user" password="user" authorities="ROLE_USER"></security:user>
    			</security:user-service>
    		</security:authentication-provider>
    	</security:authentication-manager>

2. 测试与分析

<1> 访问 [http://localhost/admin.jsp][http_localhost_admin.jsp]

spring Security 过滤器链：

![70][]

FilterSecurityInterceptor 抛出 AccessDeniedException，ExceptionTransitionFilter进行异常处理，LoginUrlAuthenticationEntryPoint 把请求重定向到登录页面：

![70 1][]

<2> 用户 user/user 登录：

FilterSecurityInterceptor 抛出 AccessDeniedException，ExceptionTransitionFilter进行异常处理，AccessDeniedHandler 转发到403。

![70 2][]

<3> 用户 admin/admin 登录，访问成功。

![70 3][]

<4> 访问 [http://localhost/index.jsp][http_localhost_admin.jsp]

![70 4][]

3. 自定义页面

自定义登录页面 index.jsp：

<a href="/logout">Logout</a>

spring-security.xml

<security:form-login login-page="/login.jsp"
    		     username-parameter="username"
    		     password-parameter="password"
    		     always-use-default-target="true"
    		     default-target-url="/index.jsp"
    		     authentication-failure-url="/failure.jsp"
    		     login-processing-url="/spring_security_login"></security:form-login>
    
    
    <security:logout logout-url="/logout"
    		 logout-success-url="/index.jsp"
    		 invalidate-session="true"></security:logout>

4. 退出操作

LogoutFilter 调用 SecurityContextLogoutHandler 注销session，

SimpleUrlLogoutSuccessHandler 请求重定向到 index.jsp

5. 若是需要从数据读取用户角色 和 接口的访问权限，则需要自定义策略

用户角色：

<bean id="myUserDetailService" class="com.dtdream.dmall.security.service.MyUserDetailService"></bean>

<security:authentication-manager>
    		<security:authentication-provider user-service-ref="myUserDetailService" >
    
    			
    				
    				
    			
    
    		</security:authentication-provider>
    	</security:authentication-manager>

public class MyUserDetailService implements UserDetailsService {
        public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
            User user;
            Set<GrantedAuthority> authorities = new HashSet<GrantedAuthority>();
            authorities.add(new SimpleGrantedAuthority("ROLE_USER"));
    
            user = new User(username, "", true, true,
                    true, true, authorities);
    
            return user;
        }
    }

接口的访问权限：

public class MySecurityMetadataSource extends DefaultFilterInvocationSecurityMetadataSource {
    
        public MySecurityMetadataSource(LinkedHashMap<RequestMatcher, Collection<ConfigAttribute>> requestMap) {
            super(requestMap);
        }
    }

定义工厂bean，向 MySecurityMetadataSource 注入 requestMap，

public class SecurityMetadataSourceFactoryBean implements FactoryBean<MySecurityMetadataSource> {
        
        public MySecurityMetadataSource getObject() throws Exception {
    
            LinkedHashMap<RequestMatcher, Collection<ConfigAttribute>> requestMap = new LinkedHashMap();
    
            RequestMatcher requestMatcher = new AntPathRequestMatcher("/index.jsp");
            Collection<ConfigAttribute> configAttributes = new HashSet<ConfigAttribute>();
            configAttributes.add(new SecurityConfig("ROLE_USER"));
    
            requestMap.put(requestMatcher, configAttributes);
    
            requestMatcher = new AntPathRequestMatcher("/admin.jsp");
            configAttributes = new HashSet<ConfigAttribute>();
            configAttributes.add(new SecurityConfig("ROLE_ADMIN"));
    
            requestMap.put(requestMatcher, configAttributes);
    
            MySecurityMetadataSource mySecurityMetadataSource = new MySecurityMetadataSource(requestMap); 
    
            return mySecurityMetadataSource;
        }
    
        public Class<MySecurityMetadataSource> getObjectType() {
            return null;
        }
    
        public boolean isSingleton() {
            return false;
        }
    }

spring-security.xml 配置：

<bean id="securityMetadataSource"
    		  class="com.dtdream.dmall.security.factorfy.SecurityMetadataSourceFactoryBean"></bean>

在IOC容器中把 securityMetadataSource 设置到 FilterSecurityInterceptor 中

web.xml 配置操作IOC容器的listener：

<listener>
        <listener-class>com.dtdream.dmall.security.listener.SpringSecurityListener</listener-class>
      </listener>

public class SpringSecurityListener implements ServletContextListener {
    
        public void contextInitialized(ServletContextEvent servletContextEvent) {
    
            // 获取IOC容器
            ApplicationContext applicationContext = WebApplicationContextUtils.getRequiredWebApplicationContext(servletContextEvent.getServletContext());
    
            // 获取 securityMetadataSource 实例
            MySecurityMetadataSource mySecurityMetadataSource = (MySecurityMetadataSource) applicationContext.getBean("securityMetadataSource");
    
            // 获取 FilterSecurityInterceptor 实例
            FilterSecurityInterceptor filterSecurityInterceptor = applicationContext.getBean(FilterSecurityInterceptor.class);
    
            // 设置属性
            filterSecurityInterceptor.setSecurityMetadataSource(mySecurityMetadataSource);
    
        }
    
        public void contextDestroyed(ServletContextEvent servletContextEvent) {
    
        }
    }

springSecurity 集成 cas时，就是 需要配置 登录地址、ticket验证地址、登出地址，结合springSecurity的原理，需要对 LoginUrlAuthenticationEntryPoint 和 LogoutFilter 进行修改即可。

[http_localhost_admin.jsp]: http://localhost
[70]: /images/20220517/b12e0188add9452abf4637a12821d3e2.png
[70 1]: /images/20220517/b311ddf4401f4d1db03465c95ca06144.png
[70 2]: /images/20220517/15710995f2cd4c3fb0c74444c28864a1.png
[70 3]: /images/20220517/6b6e0a89b74d4f62a726ba091059df8d.png
[70 4]: /images/20220517/0e189e76122a446a9fa5a8c4f7a8d6bf.png