Spring Security

Spring Security是一种基于Spring AOP和Servlet过滤器的安全框架，在web请求级和方法调用级处理身份的授权和认证，

在spring framework基础上，Spring Security充分运用的依赖注入和面向切面编程。

spring Security的配置：

pom.xml

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
  <modelVersion>4.0.0</modelVersion>
  <groupId>xidian</groupId>
  <artifactId>SpringSecurity</artifactId>
  <packaging>war</packaging>
  <version>0.0.1-SNAPSHOT</version>
  <name>SpringSecurity Maven Webapp</name>
  <url>http://maven.apache.org</url>
  
  <!-- 指定Maven仓库 -->
    <repositories>
        <repository>
            <id>maven</id>
            <name>Maven Repository Switchboard</name>
            <layout>default</layout>
            <url>http://repo1.maven.org/maven2</url>
            <snapshots>
                <enabled>false</enabled>
            </snapshots>
        </repository>
        <repository>
            <id>alibaba-opensource</id>
            <name>alibaba-opensource</name>
            <url>http://code.alibabatech.com/mvn/releases/</url>
            <layout>default</layout>
        </repository>
        <repository>
            <id>alibaba-opensource-snapshot</id>
            <name>alibaba-opensource-snapshot</name>
            <url>http://code.alibabatech.com/mvn/snapshots/</url>
            <layout>default</layout>
        </repository>
    </repositories>
 
  <properties>
    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
  </properties>
  
  <dependencies>
        <!-- servlet -->
    <dependency>
        <groupId>javax.servlet</groupId>
        <artifactId>servlet-api</artifactId>
        <version>2.5</version>
        <scope>provided</scope>
    </dependency>
    <!-- log4j -->
    <dependency>
        <groupId>log4j</groupId>
        <artifactId>log4j</artifactId>
        <version>1.2.17</version>    
    </dependency>
    <!-- spring3 -->
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-core</artifactId>
            <version>3.1.2.RELEASE</version>
        </dependency>
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-context</artifactId>
            <version>3.1.2.RELEASE</version>
        </dependency>
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-jdbc</artifactId>
            <version>3.1.2.RELEASE</version>
        </dependency>
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-beans</artifactId>
            <version>3.1.2.RELEASE</version>
        </dependency>
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-web</artifactId>
            <version>3.1.2.RELEASE</version>
        </dependency>
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-expression</artifactId>
            <version>3.1.2.RELEASE</version>
        </dependency>
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-orm</artifactId>
            <version>3.1.2.RELEASE</version>
        </dependency>
       
    <!-- spring事务切面 -->
    <dependency>
        <groupId>org.aspectj</groupId>
        <artifactId>aspectjweaver</artifactId>
        <version>1.7.4</version>
    </dependency>
     <!-- spring security  -->
   <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-config</artifactId>
      <version>3.2.4.RELEASE</version>
      <scope>compile</scope>
    </dependency>
  
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-web</artifactId>
      <version>3.2.4.RELEASE</version>
      <scope>compile</scope>
    </dependency>
  
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-core</artifactId>
      <version>3.2.4.RELEASE</version>
      <scope>compile</scope>
    </dependency>
      
   <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-webmvc</artifactId>
      <version>3.2.8.RELEASE</version>
      <scope>compile</scope>
    </dependency>
  
    <!-- 
    org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.springframework.security.filterChains': Initialization of bean failed; nested exception is java.lang.NoClassDefFoundError: org/springframework/web/context/request/async/CallableProcessingInterceptor
     -->
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-web</artifactId>
      <version>3.2.8.RELEASE</version>
      <scope>compile</scope>
    </dependency>
  
    <dependency>
      <groupId>commons-logging</groupId>
      <artifactId>commons-logging</artifactId>
      <version>1.1.1</version>
      <scope>compile</scope>
      <optional>true</optional>
    </dependency>    
    
    <!-- 注解事务引入的包      -->    
    <dependency>
       <groupId>cglib</groupId>
       <artifactId>cglib</artifactId>
       <version>2.2</version>
    </dependency>

    <dependency>
        <groupId>commons-logging</groupId>
        <artifactId>commons-logging-api</artifactId>
        <version>1.1</version>
    </dependency>
  
    <dependency>
         <groupId>junit</groupId>
         <artifactId>junit</artifactId>
         <version>3.8.1</version>
         <scope>test</scope>
    </dependency>
  </dependencies>
  
 <build>
    <finalName>SpringSecurity</finalName>
     <plugins>
      <plugin>
        <artifactId>maven-war-plugin</artifactId>
      </plugin>
      <plugin>
        <artifactId>maven-compiler-plugin</artifactId>
        <configuration>
          <source>1.6</source>
          <target>1.6</target>
        </configuration>
      </plugin>
    </plugins>
  </build>
</project>

web.xml

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://java.sun.com/xml/ns/javaee" xmlns:web="http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd" version="3.0">
  <!-- spring配置文件位置 -->
    <context-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>classpath:spring.xml,classpath:applicationContext-security.xml</param-value>
    </context-param> 
    
       <!-- spring监听器 -->
   <listener>
        <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
   </listener>    
    
  <!-- Spring Secutiry4.1的过滤器链配置 -->
    <filter>
    <filter-name>springSecurityFilterChain</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    </filter>
    <filter-mapping>
    <filter-name>springSecurityFilterChain</filter-name>
    <url-pattern>/*</url-pattern>
    </filter-mapping>
</web-app>

applicationContext-security.xml

<beans:beans xmlns="http://www.springframework.org/schema/security"
  xmlns:beans="http://www.springframework.org/schema/beans"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://www.springframework.org/schema/beans
           http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
           http://www.springframework.org/schema/security
           http://www.springframework.org/schema/security/spring-security.xsd">
     
<!-- 配置保护资源 -->
<!-- 自动配置过滤器链 -->
<http auto-config="true"> 

<!-- access设置角色  角色和用户是多对多的关系-->
<intercept-url pattern="/index.jsp" access="ROLE_user,ROLE_admin"/>
</http>    

<!--配置用户 ，可以放在配置文件中或者数据库中 -->
<authentication-manager>
    <authentication-provider>
        <user-service>
        <user name="tom" authorities="ROLE_user,ROLE_tom" password="tom"/>
        <user name="xkj" authorities="ROLE_manager" password="xkj"/>
        </user-service>
    </authentication-provider>
</authentication-manager>
  
</beans:beans>

Spring Security的作用：
1.在访问一个安全资源之前提示用户登录

2.经过检查安全（密码），对用户进行身份验证

3.检查经过身份验证的用户是否具有访问某个安全资源的特权

4.将成功进行身份验证和授权的用户重定向到锁清秋的安全资源

5.对不具备访问安全资源特权的用户显示Access Denid页面

6.在服务器上记录成功进行身份验证的用户，并在用户的的客户机上设置安全cookie。使用该cookie执行下一次身份验证，而无需要求用户登录。

<!-- 配置保护资源 -->
<!-- 自动配置过滤器链 -->
<http auto-config="true"> 
<!-- access设置角色  角色和用户是多对多的关系-->
<intercept-url pattern="/index.jsp" access="ROLE_user,ROLE_admin"/>
</http>    

<!--配置用户 ，可以放在配置文件中或者数据库中 -->
<authentication-manager>
    <authentication-provider>
        <user-service>
        <user name="tom" authorities="ROLE_user,ROLE_tom" password="tom"/>
        <user name="mike" authorities="ROLE_manager" password="mike"/>
        </user-service>
    </authentication-provider>
</authentication-manager>
  

配置好之后访问站点：

用户tom是可以访问被保护的资源index.jsp的，但是Mike没有授权，即使登录用户名和密码正确依然会显示access denied。

修改applicationContext-security.xml文件，更改默认的保护登录页面：

<!-- 配置保护资源 -->
<!-- 自动配置过滤器链 -->
<http auto-config="true"> 
<!-- 修改保护登录页面为login.jsp 同时设置验证失败后的页面也是login.jsp 验证成功的页面为sec.jsp -->
<form-login login-page="/login.jsp" authentication-failure-url="/login.jsp" default-target-url="/sec.jsp" /> 
<!-- access设置角色  角色和用户是多对多的关系-->
<intercept-url pattern="/index.jsp" access="ROLE_user,ROLE_admin"/>
</http>