spring3.0 MVC初步4-集成spring security.ppt

1、spring3.0 MVC初步-4,集成spring security 3.1,下载spring security，集成下列jar包,spring-security-config-3.1.3.RELEASE.jar spring-security-core-3.1.3.RELEASE.jar spring-security-taglibs-3.1.3.RELEASE.jar spring-security-web-3.1.3.RELEASE.jar,配置web.xml中的filter, springSecurityFilterChain org.springframework.web.filt

2、er.DelegatingFilterProXy springSecurityFilterChain /* 一定要写上filer-mapping，因为忘写filter-mapping程序根本不触发spring security的任何东西，也不报错，就是不干security的活。,修改perties增加下面行,.springframework.security=DEBUG 以观察security的执行情况,在src下创建security.xml, 把它加到context路径中,启动tomcat,报错： No bean named org.spri

3、ngframework.security.authenticationManager is defined: Did you forget to add a gobal element to your configuration (with child elements)? Alternatively you can use the authentication-manager-ref attribute on your and elements. 因为没有配置用户库,配置最简单的内存用户库,在上面security.xml中添加： 注意角色名称一定要有ROLE_前缀，不用这个前缀需要改配置。,

4、访问,运行起来，访问http:/t18:3000/s4/home，出现spring security自带的登陆界面；输入habuma letmein，登陆成功！,配置jdbc访问数据库用户,去掉上面5中的内容，加上： ,注意sql语句的写法,-取用户：select logname,password,1 from users where logName=?一定要有1（SQLServer，其他数据库可取能为true）； -取角色：select b.logName username,rolename from users_roles a,users b,roles c where a.userId=

5、b.userId and a.roleId=c.roleId and b.logName=? 用户名一定要用username的别名，否则取不到,运行起来,访问http:/t18:3000/s4/home，出现spring security自带的登陆界面；输入test test，登陆成功！ 当然，数据库中用户名test，密码test，角色ROLE_TEST,配置hibernate访问数据库用户,参照 这里需要写一点代码。 a、写一个org.springframework.security.core.userdetails.User的构造器assembler bean： Service(assem

6、bler) public class Assembler /Transactional(readOnly = true) User buildUserFromUserEntity(mon.beans.User userEntity) String username = userEntity.getLogName(); String password = userEntity.getPassword(); boolean enabled = true;/userEntity.isActive(); boolean accountNonExpired = true;/userEntity.isAc

7、tive();,配置hibernate访问数据库用户,boolean credentialsNonExpired = true;/userEntity.isActive(); boolean accountNonLocked = true;/userEntity.isActive(); Collection authorities = new ArrayList(); for (Object userrole : userEntity.getUserRoles() UserRole ur = (UserRole)userrole; authorities.add(new GrantedAuth

8、orityImpl(ur.getId().getRole().getRoleName(); User user = new User(username, password, enabled, accountNonExpired, credentialsNonExpired, accountNonLocked, authorities); return user; ,配置hibernate访问数据库用户,b、实现org.springframework.security.core.userdetails.UserDetails接口的服务userDetailsService bean,配置hiber

9、nate访问数据库用户,Service(userDetailsService) public class UserDetailsServiceImpl implements UserDetailsService Autowired private mon.dao.IUserDao dao; Autowired private Assembler assembler; /Transactional(readOnly = true) public UserDetails loadUserByUsername(String username) throws UsernameNotFoundExcep

10、tion, DataAccessException UserDetails userDetails = null; User userEntity = (User)dao.findObjectByHQL(from User u where u.logName=+username+); if (userEntity = null) throw new UsernameNotFoundException(user not found); return assembler.buildUserFromUserEntity(userEntity); ,配置hibernate访问数据库用户,c、在secu

11、rity.xml中,用userDetailsService提供用户,配置hibernate访问数据库用户, ,配置hibernate访问数据库用户,d、配置事务，使得hibernate可用 ,运行,运行起来，访问http:/t18:3000/s4/home，出现spring security自带的登陆界面；输入test test，登陆成功！ 依然，数据库中用户名test，密码test，角色ROLE_TEST。,修改默认登陆界面,security.xml中修改http配置，增加form-login属性 ,修改默认登陆界面,这里login-page和authentication-failure-u

12、rl的/login指向一个spring mvc 控制器，它指向一个自定义登陆页面。 login-processing-url=/j_spring_security_check 在spring in action第三版中写的是/static/j_spring_security_check 有的地方又说是 /应用根/j_spring_security_check 折腾一上午，最后在我的环境里应该是/j_spring_security_check,修改默认登陆界面,自定义登陆页面就是一个form，用POST方法提交到/j_spring_security_check，用户名的name属性写成j-username，密码的name属性写成j-password即可。,修改默认登陆界面, ,logback日志系统,另注：在参考spring security tutorial