springmvc挂载springSecuity

springSecurity的配置文件为spring-Secuity.xml spingmvc核心配置文件为spirngmvc.xml 

其原理是在web.xml中配置了监听器或DispatcherServlet控制器，由它们产生容器加载配置文件创建对象，

级别上，spring容器为父容器，springmvc容器为子容器，尤其需要注意的是，子容器可以调用父容器创建的对象，

但父容器无法调用子容器创建的对象，

关系如下：

所以，实际上我们也可以直接通过springmvc创建spring对象：

sping-security.xml配置：

<?xml version="1.0" encoding="UTF-8"?>
<beans:beans
        xmlns="http://www.springframework.org/schema/security"
        xmlns:beans="http://www.springframework.org/schema/beans"
        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xsi:schemaLocation="http://www.springframework.org/schema/beans
                        http://www.springframework.org/schema/beans/spring-beans.xsd
                        http://www.springframework.org/schema/security
                        http://www.springframework.org/schema/security/spring-security.xsd">
    <!-- 以下页面不被拦截 -->
    <!--**目录所有资源都会被拦截-->
    <http pattern="/shoplogin.html" security="none"></http>
    <http pattern="/shoplogin_error.html" security="none"></http>
    <http pattern="/register.html" security="none"></http>
    <http pattern="/css/**" security="none"></http>
    <http pattern="/img/**" security="none"></http>
    <http pattern="/js/**" security="none"></http>
    <http pattern="/plugins/**" security="none"></http>


    <!-- 页面拦截规则 -->
    <http use-expressions="false">
        <!--要求有当前登录人 并且要求当前登录人有一个 ROLE_ADMIN 角色  开头必须大写的ROLE_-->
        <intercept-url pattern="/**" access="ROLE_ADMIN"/>
        <form-login
                login-page="/shoplogin.html"
                default-target-url="/admin/index.html"
                authentication-failure-url="/shoplogin_error.html"
                always-use-default-target="true"/>
        <logout  logout-success-url="/shoplogin.html"></logout>
        <!--login-page登录页面-->
        <!--default-target-url登录成功后默认跳转的页面-->
        <!-- authentication-failure-url登录失败后默认跳转的页面-->
        <!--always-use-default-target：是否每次登录都跳转到default-target-url设置的页面-->
        <csrf disabled="true"/>
        <!--跨站请求伪造-->
        <!-- iframe策略 --><!--一个页面嵌套着另外一个页面-->
        <headers>
            <frame-options policy="SAMEORIGIN"/>
        </headers>
    </http>
    <!--自定义认证类-->
//加载自定用对象
    <beans:bean id="userdetailsService" class="com.pyg.shop.user.UserdetailsServiceImp">
        <!--<beans:property name="sellerService" ref="sellerService"></beans:property>-->
    </beans:bean>
    //因为在生成对象时有配置加密，所有在此加载加密器
    <beans:bean id="bCryptPasswordEncoder" class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder"/>
    <!-- 认证管理器 -->
    <authentication-manager>
//引用自定义用户对象
        <authentication-provider user-service-ref="userdetailsService">

             //引用加密器
            <password-encoder ref="bCryptPasswordEncoder"/>
            <!--<user-service>
                <user name="admin" password="123456" authorities="ROLE_ADMIN"/>
                <user name="sunwukong" password="dasheng" authorities="ROLE_ADMIN"/>
            </user-service>-->
        </authentication-provider>
    </authentication-manager>
</beans:beans>

 spingmvc.xml

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xmlns:context="http://www.springframework.org/schema/context"
       xmlns:mvc="http://www.springframework.org/schema/mvc" xmlns:dubbo="http://code.alibabatech.com/schema/dubbo"
       xsi:schemaLocation="http://www.springframework.org/schema/beans
        http://www.springframework.org/schema/beans/spring-beans.xsd
        http://www.springframework.org/schema/context
        http://www.springframework.org/schema/context/spring-context.xsd
        http://www.springframework.org/schema/mvc
        http://www.springframework.org/schema/mvc/spring-mvc.xsd http://code.alibabatech.com/schema/dubbo http://code.alibabatech.com/schema/dubbo/dubbo.xsd">
    <!--引用外部资源文件-->
    <context:property-placeholder location="classpath:config/application.properties"/>
    <mvc:annotation-driven>
        <mvc:message-converters>
            <bean class="com.alibaba.fastjson.support.spring.FastJsonHttpMessageConverter">
                <property name="supportedMediaTypes" value="application/json"/>
                <property name="features">
                    <array>
                        <value>WriteMapNullValue</value>
                        <value>WriteDateUseDateFormat</value>
                    </array>
                </property>
            </bean>
        </mvc:message-converters>
    </mvc:annotation-driven>
    <!--引用douub服务-->
    <dubbo:application name="pyg-shop-web"/>
    <dubbo:registry address="zookeeper://192.168.25.61:2181"/>
    
//注意更改包扫描的范围，因为是新增了UserDetailsServiImp对象
    <dubbo:annotation package="com.pyg.shop"/>
    <mvc:default-servlet-handler/>

</beans>

由于是用的自定义账号对象，所有，要从数据库中查找账号对象：package com.pyg.shop.user;

import com.alibaba.dubbo.config.annotation.Reference;
import com.pyg.pojo.TbSeller;
import com.pyg.sellergoods.service.SellerService;
import com.sun.org.apache.xerces.internal.impl.xs.util.StringListImpl;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;

import java.util.ArrayList;
import java.util.Collection;
import java.util.List;

public class UserdetailsServiceImp implements UserDetailsService {
//远程注入sellerService    @Reference
    private SellerService sellerService;

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
       //调用sellerService的findOne方法根据用户id查找对象        TbSeller seller = sellerService.findOne(username);
        //判断用户是否为空
        if (null == seller) {
            return null;
        } else {
        

UserDetails

web.xml配置为：

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns="http://java.sun.com/xml/ns/javaee"
    xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
    version="2.5">    
   <!-- 解决post乱码 -->
    <filter>
        <filter-name>CharacterEncodingFilter</filter-name>
        <filter-class>org.springframework.web.filter.CharacterEncodingFilter</filter-class>
        <init-param>
            <param-name>encoding</param-name>
            <param-value>utf-8</param-value>
        </init-param>
        <init-param>  
            <param-name>forceEncoding</param-name>  
            <param-value>true</param-value>  
        </init-param>  
    </filter>
    <filter-mapping>
        <filter-name>CharacterEncodingFilter</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>    
    
  <servlet>
      <servlet-name>springmvc</servlet-name>
      <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
      <!-- 指定加载的配置文件 ，通过参数contextConfigLocation加载-->
      <init-param>
          <param-name>contextConfigLocation</param-name>
          
          //加载资源spring目录下所有.xml格式的配置文件，目的是为了让DispatcherServlet加载springSecurity.xml文件
          <param-value>classpath:spring/*.xml</param-value>
      </init-param>
  </servlet>
  
  <servlet-mapping>
      <servlet-name>springmvc</servlet-name>
      <url-pattern>/</url-pattern>
  </servlet-mapping>
    
    
    <filter>
        <filter-name>springSecurityFilterChain</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    </filter>
    <filter-mapping>
        <filter-name>springSecurityFilterChain</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>
  //不加载监听器，使springSecurity.xml文件经由DispatcherServlet控制器加载
  <!--  <listener>
        <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
    </listener>
    <context-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>classpath:spring/spring-security.xml</param-value>
    </context-param> -->
    
</web-app>