Spring Security受權 AccessDecisionManager

Spring Security受權 AccessDecisionManager

博客分類：

 
• Security
• Spring

 

在前面那篇博客有一段配置： 

<http auto-config="false" disable-url-rewriting="true" use-expressions="true" entry-point-ref="dtAuth"
     create-session="never">
     <!-- <session-management session-authentication-strategy-ref="dtsession"/> -->
     <intercept-url pattern="/unread/get" access="isAuthenticated()"/>
     <intercept-url pattern="/authtest.xhtm" access="hasRole('working')"/>
     <intercept-url pattern="/authtest1.xhtm" access="hasRole('trac')"/>
     <intercept-url pattern="/cmmt/uc" access="isAuthenticated()"/>
     <intercept-url pattern="/favicon.ico" access="denyAll"/>
     <intercept-url pattern="/**" access="permitAll"/>
     <custom-filter position="PRE_AUTH_FILTER" ref="dtSessionMgr"/>
 </http>

pattern表示url,access表示url的權限，但這個isAuthenticated()具體在哪裏執行呢？原來Spring提供受權機制，由org.springframework.security.access.AccessDecisionManager這個接口來實現。 

這個接口定義了這個方法： 

void decide(Authentication authentication, Object object, Collection<ConfigAttribute> configAttributes)
    throws AccessDeniedException, InsufficientAuthenticationException;

對應上面的配置：object就是url,configAttributes就是一個access。經常使用的實現類是AffirmativeBased