SpringMVC + security模块 框架整合详解

最近整理一个二手后台管理项目，整体大体可分为 ： Springmvc + mybatis + tiles + easyui + security 这几个模块，再用maven做管理。刚拿到手里面东西实在太多，所以老大让重新整一个，只挑出骨架。不可否认，架构整体规划得还是很好的，尤其是前端界面用tiles+easyui ，开发很高效！其实，之前虽然听说过security，但做过的项目都没用过security，所以也算是一个新手！整合过程还是很烧脑的。

1、首先是springmvc部分，也是框架的最核心骨架部分。springmvc也是基于servlet框架完成的，所以我们都可以从web.xml入手，然后顺藤摸瓜，整理出整个架构。web.xml中主要部分是放置spring的各种配置：

1. 
   
2. <context-param>
3. <param-name>contextConfigLocation</param-name>
4. <param-value>
5. /WEB-INF/spring/appServlet/servlet-context.xml
6. </param-value>
8. </context-param>

和

1. 
   
2. <servlet>
3. <servlet-name>appServlet</servlet-name>
4. <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
5. <init-param>
6. <param-name>contextConfigLocation</param-name>
7. <param-value>/WEB-INF/spring/appServlet/servlet-context.xml</param-value>
8. </init-param>
9. <load-on-startup>1</load-on-startup>
10. <async-supported>true</async-supported>
11. </servlet>
13. <servlet-mapping>
14. <servlet-name>appServlet</servlet-name>
15. <url-pattern>/</url-pattern>
16. </servlet-mapping>

这两部分指定了配置文件地址和web请求地址拦截规则。需要注意的是，然后配置文件里就是常用的注解、数据源、之类的，不一而足。

2、然后是security，本文实现了自定义的用户信息登录认证，主要部分：spring的security主要注意几个地方：

1）web.xml中配置security必须的过滤器，注意名字必须是springSecurityFilterChain,这是内置的过滤器；然后将过滤规则设置为/*，表示对所有请求都拦截。

2) 关于security的配置文件必须在<context-param>中加入，因为ContextLoaderListener在加载的时候就会去加载security相关的东西，而此时springmvc（servlet)模块还没有初始化。

二者配置如下：

1. 
   
2. <context-param>
3. <param-name>contextConfigLocation</param-name>
4. <param-value>
5. /WEB-INF/spring/appServlet/servlet-context.xml
6. </param-value>
8. </context-param>
10. <!-- Creates the Spring Container shared by all Servlets and Filters -->
11. <listener>
12. <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
13. </listener>
14. <!-- 用户权限模块 -->
15. <filter>
16. <filter-name>springSecurityFilterChain</filter-name>
17. <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
18. </filter>
19. <filter-mapping>
20. <filter-name>springSecurityFilterChain</filter-name>
21. <url-pattern>/*</url-pattern>
22. </filter-mapping>

本文中security配置文件再servlet-context.xml中被引入，形如：

<beans:import resource="spring-security.xml"/>

3）spring-security.xml配置文件：

现在来看这个xml文件：

首先 <http>标签部分声明了访问拦截规则，这是security的关键。在这部分，我们先声明了一些不需要验证的资源和访问路径；然后是地址拦截规则部分：该部分拦截路径是/**，**表示可以跨目录结构，因此此处拦截该站点所有请求（除之前声明security=“none”的以外），然后拦截规则access="isAuthenticated()"，这是SecurityExpressionRoot中的判断是否认证过的方法之一，跟hasRole()类似，官方描述是Returns true if the user is not anonymous ，也就是用户认证后返回true。

1. 
   
2. <?xml version="1.0" encoding="UTF-8"?>
3. <beans:beans xmlns="http://www.springframework.org/schema/security"
4. xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
5. xmlns:security="http://www.springframework.org/schema/security"
6. xsi:schemaLocation="http://www.springframework.org/schema/beans
7. http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
8. http://www.springframework.org/schema/security
9. http://www.springframework.org/schema/security/spring-security-3.2.xsd">
11. <!-- For Web security -->
12. <http pattern="/js/**" security="none"/>
13. <http pattern="/images/**" security="none"/>
14. <http pattern="/mgmt/**" security="none"/>
15. <http pattern="/image_sys/**" security="none"/>
16. <http pattern="/style/**" security="none"/>
17. <http pattern="/view/login.jsp" security="none"/>
18. <http pattern="/view/login/forgotPassword.jsp" security="none"/>
19. <http pattern="/securityCodeImage.html" security="none"/>
20. <http pattern="/checkSecurityCode.html" security="none"/>
21. <http pattern="/admin/validateMobile.html" security="none"/>
22. <http pattern="/verifycode/sendVerifyCode.html" security="none"/>
23. <http pattern="/admin/resetPassword.html" security="none"/>
26. <http use-expressions="true" entry-point-ref="authenticationProcessingFilterEntryPoint" access-denied-page="/view/403.jsp">
27. <intercept-url pattern="/**" access="isAuthenticated()" />
28. <remember-me />
29. <!-- <expression-handler ref="webSecurityExpressionHandler"/> -->
30. <custom-filter ref="loginFilter" position="FORM_LOGIN_FILTER" />
31. <logout logout-url="/j_spring_security_logout" logout-success-url="/view/login.jsp" delete-cookies="JSESSIONID"/>
32. </http>
34. <!-- 未登录的切入点 -->
35. <beans:bean id="authenticationProcessingFilterEntryPoint" class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint">
36. <beans:property name="loginFormUrl" value="/view/login.jsp"></beans:property>
37. </beans:bean>
39. <!-- 登录体系loginFilter -->
40. <beans:bean id="loginFilter"
41. class="com.security.AdminUsernamePasswordAuthenticationFilter">
42. <beans:property name="filterProcessesUrl" value="/j_spring_security_check"></beans:property>
43. <beans:property name="authenticationSuccessHandler" ref="myAuthenticationSuccessHandler"></beans:property>
44. <beans:property name="authenticationFailureHandler" ref="myAuthenticationFailureHandler"></beans:property>
45. <beans:property name="authenticationManager" ref="authenticationManager"></beans:property>
46. </beans:bean>
48. <!-- 验证失败显示页面 -->
49. <beans:bean id="myAuthenticationFailureHandler"
50. class="org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler">
51. <beans:property name="defaultFailureUrl" value="/view/login.jsp?error=true" />
52. </beans:bean>
53. <!-- 验证成功默认显示页面 -->
54. <beans:bean id="myAuthenticationSuccessHandler"
55. class="org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler">
56. <beans:property name="alwaysUseDefaultTargetUrl" value="true" />
57. <!--此处可以请求登录首页的action地址 -->
58. <beans:property name="defaultTargetUrl" value="/index/homepage" />
59. </beans:bean>
61. <!-- authentication体系 -->
62. <authentication-manager alias="authenticationManager" erase-credentials="false">
63. <authentication-provider ref="authenticationProvider" />
64. </authentication-manager>
65. <beans:bean id="authenticationProvider"
66. class="com.security.AdminAuthenticationProvider">
67. <beans:property name="userDetailsService" ref="userDetailsService" />
68. </beans:bean>
69. <beans:bean id="userDetailsService"
70. class="com.security.AdminUserDetailsService">
71. <beans:property name="adminService" ref="adminServiceImpl"></beans:property>
72. </beans:bean>

</beans:beans>

然后声明了自定义的用户登录的拦截器loginFilter，用于在登录时实现security认证。spring的登录认证模块执行顺序为：

1、UsernamePasswordAuthenticationFilter的attemptAuthentication（）方法，此部分可以做用户名密码的判断，正确后继续执行；

2、接下来调用AuthenticationManager的authenticate（）方法（中途具体怎么调用此处不深究），一个Mannager对应了多个authenticationProvider，其实最终是通过调用provider的authenticate（）方法来进行认证的，只要provider的supports方法返回true即可声明该provider或可进行认证，最后将被manager调用。在authenticate（）方法中，调用UserDetails的loadUserByUserName()方法来加载登录用户信息，包括权限信息，最后封装成AbstractAuthenticationToken,这个对象就是security模块认证后的用户完整信息。

自定义认证主要类如下：

1. 
   
2. /**
3. * 用户登录验证步骤一：attemptAutentication（）
4. */
5. public class AdminUsernamePasswordAuthenticationFilter extends UsernamePasswordAuthenticationFilter {
7. public static final String VALIDATE_CODE = "validateCode";
8. public static final String USERNAME = "j_username";
9. public static final String PASSWORD = "j_password";
10. public static final String EMPLOYEENO = "j_employeeNo";
12. @Resource
13. private AdminService adminService;
15. @Override
16. public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response)
17. throws AuthenticationException {
18. if (!request.getMethod().equals("POST")) {
19. throw new AuthenticationServiceException("Authentication method not supported: " + request.getMethod());
20. }
22. // 判断用户信息
24. // UsernamePasswordAuthenticationToken实现 Authentication
25. UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(
26. adminModel.getAdminId(), password);
28. // 允许子类设置详细属性
29. setDetails(request, authRequest);
31. // 运行UserDetailsService的loadUserByUsername 再次封装Authentication
32. return this.getAuthenticationManager().authenticate(authRequest);
33. }
34. @Override
35. protected String obtainUsername(HttpServletRequest request) {
36. Object obj = request.getParameter(USERNAME);
37. return null == obj ? "" : obj.toString();
38. }
39. @Override
40. protected String obtainPassword(HttpServletRequest request) {
41. Object obj = request.getParameter(PASSWORD);
42. return null == obj ? "" : obj.toString();
43. }
44. }

1. 
   
2. /**
3. * <span style="font-family: Arial, Helvetica, sans-serif;">用户登录验证步骤二：</span><span style="font-family: Arial, Helvetica, sans-serif;">authenticate</span><span style="font-family: Arial, Helvetica, sans-serif;">（）</span><span style="font-family: Arial, Helvetica, sans-serif;">
4. </span> */
5. public class AdminAuthenticationProvider implements AuthenticationProvider {
6. protected Logger logger = LoggerFactory.getLogger(this.getClass());
8. private UserDetailsService userDetailsService = null;
10. public AdminAuthenticationProvider() {
11. super();
12. }
13. /**
14. * @param userDetailsService
15. */
16. public AdminAuthenticationProvider(UserDetailsService userDetailsService) {
17. super();
18. this.userDetailsService = userDetailsService;
19. }
21. public UserDetailsService getUserDetailsService() {
22. return userDetailsService;
23. }
25. public void setUserDetailsService(UserDetailsService userDetailsService) {
26. this.userDetailsService = userDetailsService;
27. }
29. /**
30. * provider的authenticate()方法，用于登录验证
31. */
32. @SuppressWarnings("unchecked")
33. public Authentication authenticate(Authentication authentication) throws AuthenticationException {
35. // 1. Check username and password
36. try {
37. doLogin(authentication);
38. } catch (Exception e) {
39. if (e instanceof AuthenticationException) {
40. throw (AuthenticationException) e;
41. }
42. logger.error("failure to doLogin", e);
43. }
45. // 2. Get UserDetails
46. UserDetails userDetails = null;
47. try {
48. userDetails = this.userDetailsService.loadUserByUsername(authentication.getName());
49. } catch (Exception e) {
50. if (e instanceof AuthenticationException) {
51. throw (AuthenticationException) e;
52. }
53. logger.error("failure to get user detail", e);
54. }
55. // 3. Check and get all of admin roles and contexts.
56. Collection<GrantedAuthority> authorities = (Collection<GrantedAuthority>) userDetails.getAuthorities();
57. if (authorities != null && !authorities.isEmpty()) {
58. AdminAuthenticationToken token = new AdminAuthenticationToken(authentication.getName(),
59. authentication.getCredentials(), authorities);
60. token.setDetails(userDetails);
61. return token;
62. }
63. throw new BadCredentialsException("没有分配权限");
64. }
65. protected void doLogin(Authentication authentication) throws AuthenticationException {
67. }
68. @Override
69. public boolean supports(Class<?> authentication) {
70. // TODO Auto-generated method stub
71. return true;
72. }
73. }

1. 
   
2. /**用户详细信息获取
3. */
4. public class AdminUserDetailsService implements UserDetailsService {
5. private Logger logger = LoggerFactory.getLogger(AdminUserDetailsService.class);
6. private AdminService adminService;
8. @Override
9. public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
11. AdminUserDetails userDetails = new AdminUserDetails();
12. userDetails.setAdminId(username);
14. ///加载用户基本信息
15. AdminModel adminModel = adminService.getAdminByAdminId(username);
16. try {
17. PropertyUtils.copyProperties(userDetails, adminModel);
18. } catch (IllegalAccessException e) {
19. logger.error("用户信息复制到userDetails出错",e);
20. } catch (InvocationTargetException e) {
21. logger.error("用户信息复制到userDetails出错",e);
22. } catch (NoSuchMethodException e) {
23. logger.error("用户信息复制到userDetails出错",e);
24. }
25. //加载权限信息
26. List<AdminRoleGrantedAuthority> authorities = this.adminService.getAuthorityByUserId(username);
27. if (authorities == null || authorities.size() == 0) {////如果为普通用户
28. if (isCommonUserRequest()) {
29. AdminRoleGrantedAuthority authority =
30. new AdminRoleGrantedAuthority(AdminRoleGrantedAuthority.ADMIN_ROLE_TYPE_COMMON_USER);
31. userDetails.getAuthorities().add(authority);
32. } else {
33. logger.warn("person authorities is empty, personId is [{}]", username);
34. }
35. }
36. //加载用户权限
37. userDetails.getAuthorities().addAll(authorities);
39. ///这个就是权限系统最后的用户信息
40. return userDetails;
41. }
43. private boolean isCommonUserRequest() {
44. // TODO Auto-generated method stub
45. return true;
46. }
48. public AdminService getAdminService() {
49. return adminService;
50. }
52. public void setAdminService(AdminService adminService) {
53. this.adminService = adminService;
54. }
56. }

1. 
   
2. public class AdminAuthenticationToken extends AbstractAuthenticationToken {
4. /**
5. *
6. */
7. private static final long serialVersionUID = 5976309306377973996L;
9. private final Object principal;
10. private Object credentials;
12. public AdminAuthenticationToken(Object principal, Object credentials) {
13. super(null);
14. this.principal = principal;
15. this.credentials = credentials;
16. setAuthenticated(false);
17. }
19. c AdminAuthenticationToken(Object principal, Object credentials, Collection<? extends GrantedAuthority> authorities) {
20. super(authorities);
21. this.principal = principal;
22. this.credentials = credentials;
23. super.setAuthenticated(true); //注意，这里设置为true了！ must use super, as we override
24. }
26. public Object getCredentials() {
27. return this.credentials;
28. }
30. public Object getPrincipal() {
31. return this.principal;
32. }
34. public void setAuthenticated(boolean isAuthenticated) throws IllegalArgumentException {
35. if (isAuthenticated) {
36. throw new IllegalArgumentException("Cannot set this token to trusted - use constructor which takes a GrantedAuthority list instead");
37. }
38. super.setAuthenticated(false);
39. }
41. @Override
42. public void eraseCredentials() {
43. super.eraseCredentials();
44. credentials = null;
45. }
46. }

到这里基本就完成了spring security的设置，

4）最后就是jsp页面部分，页面主要是表单的action地址必须为：path+/j_spring_security_check,其中path是项目路径，然后登录的时候就可以使用security模块了！

至于文章中可能涉及到的一些bean或者service，这里就不贴代码了，毕竟项目较为完善，涉及东西太多，另外每个项目业务逻辑也不一样。

在整个框架整合过程中，遇到了很多奇怪的问题，很多是因为版本不一致引起的，建议用maven进行jar等依赖包的统一管理。