spring-security4.1.2的学习

时间:2023-11-24 15:49:50

            spring security教程

spring security是什么?

Spring Security是一个能够为基于Spring的企业应用系统提供声明式的安全访问控制解决方案的安全框架。它提供了一组可以在Spring应用上下文中配置的Bean,充分利用了Spring IoC,DI(控制反转Inversion of Control ,DI:Dependency Injection 依赖注入)和AOP(面向切面编程)功能,为应用系统提供声明式的安全访问控制功能,减少了为企业系统安全控制编写大量重复代码的工作。

spring security所需jar包

     

<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-web</artifactId>
<version>4.1.2.RELEASE</version>
</dependency>
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-config</artifactId>
<version>4.1.2.RELEASE</version>
</dependency>
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-taglibs</artifactId>
<version>4.1.2.RELEASE</version>
</dependency>

spring security在web.xml中的配置

<!-- Spring Secutiry4.1的过滤器链配置 -->
<filter>
<filter-name>springSecurityFilterChain</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
<filter-name>springSecurityFilterChain</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>

spring security的配置文件内容如下

<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security"
xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans.xsd
http://www.springframework.org/schema/security
http://www.springframework.org/schema/security/spring-security.xsd">

<debug />
<http security="none" pattern="/login.jsp" />
<http security="none" pattern="/static/**" />
<http use-expressions="true" auto-config="true">
<intercept-url pattern="/**" access="hasRole('ROLE_USER')" />

<!-- 同一时间内允许同一账号保持4个在线,error-if-maximum-exceeded="true"表示第第四个以后的登不进去 -->
<session-management>
<concurrency-control max-sessions="4"
error-if-maximum-exceeded="true" />
</session-management>
<csrf disabled="true"/>
<form-login login-page="/login.jsp"
authentication-failure-handler-ref="authenticationFailureHandlerImpl"
authentication-success-handler-ref="authenticationSuccessHandlerImpl" />
<logout logout-success-url="/logout.jsp" logout-url="logout"
invalidate-session="true" delete-cookies="JSESSIONID" />
</http>

<authentication-manager>
<!-- <authentication-provider> -->
<!-- <user-service> -->
<!-- <user name="admin" password="123" authorities="ROLE_USER"/> -->
<!-- </user-service> -->
<!-- </authentication-provider> -->
<authentication-provider user-service-ref="userService">
<password-encoder hash="bcrypt" />
</authentication-provider>
</authentication-manager>

<beans:bean id="userService" class="com.**.user.service.impl.UserServiceImpl" />

<!-- 认证成功调用  主要实现AuthenticationSuccessHandler这个类的onAuthenticationSuccess方法-->
<beans:bean id="authenticationSuccessHandlerImpl"
class="com.**.utils.springsecurity.AuthenticationSuccessHandlerImpl">
<beans:property name="url" value="/welcome.jsp" />
</beans:bean>

<!-- 认证失败调用 主要实现AuthenticationFailureHandler类的onAuthenticationFailure-- >
<beans:bean id="authenticationFailureHandlerImpl"
class="com.**.utils.springsecurity.AuthenticationFailureHandlerImpl">
<beans:property name="errorUrl" value="/error.jsp" />
</beans:bean>

</beans:beans>

com.**.user.service.impl.UserServiceImp.java

public class UserServiceImpl implements UserDetailsService{

  @Autowired
  private UserDao userDao;

  public UserDetails loadUserByUsername(String username) {
    UserDetails details = null;
    try {
      // 用户名,密码,是否激活,accountnonexpired如果帐户没有过期设置为true
      // credentialsnonexpired如果证书没有过期设置为true
      // accountnonlocked如果帐户不锁定设置为true
      com.aoyu.user.entity.User u = this.getUser(username);

      //目前是把角色给写死了
      details = new org.springframework.security.core.userdetails.User(u.getUsername(), u.getPassword(),             u.isEnabled(),u.isAccountNonExpired(),u.isCredentialsNonExpired(),u.isAccountNonLocked(),AuthorityUtils.createAuthorityList("ROLE_USER"));

    } catch (UsernameNotFoundException usernameNotFoundException) {
      usernameNotFoundException.printStackTrace();
    } catch (Exception e) {
      e.printStackTrace();
    }
    return details;

  }
}

tips:你的只有自己动手敲代码,你才可也学得更快,最后分享几个spring-security的学习网站希望对大家有帮助   

    http://www.mossle.com/docs/springsecurity3/html/springsecurity.html

    https://vincentmi.gitbooks.io/spring-security-reference-zh/content/1_introduction.html

    http://wiki.jikexueyuan.com/project/spring-security/log-in.html