spring security 3.2.0.M1 方法級別教程 基於註解——第一部分
說明
一直在用spring security與shiro權限框架。最近spring security升級到了3.2.0.M1,因此更新了一下，看一下是否仍是能夠按照老方法使用。java
基於方法級別的權限控制
spring security經過用戶角色的URL來限制訪問,一般是用來保護Web應用程序的。然而，它也能夠用在方法和類上，使編碼或配置錯誤不容許後門進入受限制的數據。構建安全系統深刻而不弄亂代碼。它還容許額外的靈活性，如容許用戶只能訪問與他們相關的信息，而不是其餘用戶的信息。git
下面的代碼演示了基於方法基本的一部分Spring Security的展現，這個應用程序還演示各類功能和技術在後面的文章中說明。github
初始環境與工具
下面的環境與工具備想必你們開發JAVA的同窗不會陌生吧！我就不介紹它們的安裝了。web
* SDK * MAVEN * myeclipse 或者 IDEA （我本人習慣於IDEA，這個教程就用它了）
基本結構
運行idea建立一個maven項目 
spring
建立完成後補全目錄結構，以下： apache
運用maven 添加依賴
什麼依賴你們就本身看吧，具體代碼以下：api
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
<modelVersion>4.0.0</modelVersion>
<groupId>org.excalibur</groupId>
<artifactId>security</artifactId>
<packaging>war</packaging>
<version>1.0-SNAPSHOT</version>
<name>security Maven Webapp</name>
<url>http://maven.apache.org</url>
<properties>
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
<junit.version>4.10</junit.version>
<!--about spring -->
<spring.version>4.0.0.M1</spring.version>
<spring.security.version>3.2.0.M1</spring.security.version>
<log4j.version>1.2.17</log4j.version>
<slf4j.version>1.7.1</slf4j.version>
<!-- plugin-->
<jetty.version>8.1.5.v20120716</jetty.version>
</properties>
<repositories>
<!-- spring security 倉庫 -->
<repository>
<id>repository.springframework.security</id>
<name>Spring security Maven Repository</name>
<url>http://repo1.maven.org/maven2/org/springframework/security/</url>
</repository>
</repositories>
<dependencies>
<dependency>
<groupId>org.springframework</groupId>
<artifactId>spring-webmvc</artifactId>
<version>${spring.version}</version>
</dependency>
<dependency>
<groupId>org.springframework</groupId>
<artifactId>spring-web</artifactId>
<version>${spring.version}</version>
</dependency>
<!-- test start-->
<!-- junit-->
<dependency>
<groupId>junit</groupId>
<artifactId>junit</artifactId>
<version>${junit.version}</version>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.springframework</groupId>
<artifactId>spring-test</artifactId>
<version>${spring.version}</version>
</dependency>
<!-- test end-->
<!-- spring basic start -->
<dependency>
<groupId>org.springframework</groupId>
<artifactId>spring-core</artifactId>
<version>${spring.version}</version>
<exclusions>
<exclusion>
<groupId>commons-logging</groupId>
<artifactId>commons-logging</artifactId>
</exclusion>
</exclusions>
</dependency>
<dependency>
<groupId>org.springframework</groupId>
<artifactId>spring-context</artifactId>
<version>${spring.version}</version>
<exclusions>
<!-- Exclude Commons Logging in favor of SLF4j -->
<exclusion>
<groupId>commons-logging</groupId>
<artifactId>commons-logging</artifactId>
</exclusion>
</exclusions>
</dependency>
<dependency>
<groupId>org.springframework</groupId>
<artifactId>spring-beans</artifactId>
<version>${spring.version}</version>
</dependency>
<dependency>
<groupId>org.springframework</groupId>
<artifactId>spring-context-support</artifactId>
<version>${spring.version}</version>
</dependency>
<dependency>
<groupId>org.springframework</groupId>
<artifactId>spring-tx</artifactId>
<version>${spring.version}</version>
</dependency>
<dependency>
<groupId>org.springframework</groupId>
<artifactId>spring-oxm</artifactId>
<version>${spring.version}</version>
</dependency>
<!-- spring basic end -->
<!--spring security start-->
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-core</artifactId>
<version>${spring.security.version}</version>
</dependency>
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-web</artifactId>
<version>${spring.security.version}</version>
</dependency>
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-config</artifactId>
<version>${spring.security.version}</version>
</dependency>
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-aspects</artifactId>
<version>${spring.security.version}</version>
</dependency>
<!--spring security end-->
<!-- web begin-->
<dependency>
<groupId>javax.servlet</groupId>
<artifactId>jstl</artifactId>
<version>1.2</version>
</dependency>
<dependency>
<groupId>javax.servlet</groupId>
<artifactId>servlet-api</artifactId>
<version>2.5</version>
<scope>provided</scope>
</dependency>
<dependency>
<groupId>javax.servlet.jsp</groupId>
<artifactId>javax.servlet.jsp-api</artifactId>
<version>2.2.1</version>
<scope>provided</scope>
</dependency>
<dependency>
<groupId>taglibs</groupId>
<artifactId>standard</artifactId>
<version>1.1.2</version>
<scope>provided</scope>
</dependency>
<dependency>
<groupId>org.springframework</groupId>
<artifactId>spring-webmvc</artifactId>
<version>${spring.version}</version>
</dependency>
<dependency>
<groupId>org.springframework</groupId>
<artifactId>spring-web</artifactId>
<version>${spring.version}</version>
</dependency>
<dependency>
<groupId>org.springframework</groupId>
<artifactId>spring-jdbc</artifactId>
<version>${spring.version}</version>
</dependency>
<!-- WEB end -->
<!-- AOP begin -->
<dependency>
<groupId>org.aspectj</groupId>
<artifactId>aspectjrt</artifactId>
<version>1.7.0</version>
</dependency>
<dependency>
<groupId>org.aspectj</groupId>
<artifactId>aspectjweaver</artifactId>
<version>1.7.0</version>
</dependency>
<dependency>
<groupId>cglib</groupId>
<artifactId>cglib</artifactId>
<version>2.2.2</version>
<scope>runtime</scope>
</dependency>
<dependency>
<groupId>asm</groupId>
<artifactId>asm</artifactId>
<version>3.3.1</version>
<scope>runtime</scope>
</dependency>
<!-- AOP end -->
<dependency>
<groupId>org.slf4j</groupId>
<artifactId>slf4j-api</artifactId>
<version>${slf4j.version}</version>
</dependency>
<!-- slf4j-log4j綁定 -->
<dependency>
<groupId>org.slf4j</groupId>
<artifactId>slf4j-log4j12</artifactId>
<version>${slf4j.version}</version>
<scope>runtime</scope>
</dependency>
<!-- common-logging 實際調用slf4j -->
<dependency>
<groupId>org.slf4j</groupId>
<artifactId>jcl-over-slf4j</artifactId>
<version>${slf4j.version}</version>
<scope>runtime</scope>
</dependency>
<!-- java.util.logging 實際調用slf4j -->
<dependency>
<groupId>org.slf4j</groupId>
<artifactId>jul-to-slf4j</artifactId>
<version>${slf4j.version}</version>
<scope>runtime</scope>
</dependency>
<!-- log4j -->
<dependency>
<groupId>log4j</groupId>
<artifactId>log4j</artifactId>
<version>${log4j.version}</version>
</dependency>
<!-- log4jdbc -->
<dependency>
<groupId>org.lazyluke</groupId>
<artifactId>log4jdbc-remix</artifactId>
<version>0.2.7</version>
<scope>runtime</scope>
</dependency>
<!-- LOGGING end -->
<!-- AOP begin -->
<dependency>
<groupId>org.aspectj</groupId>
<artifactId>aspectjrt</artifactId>
<version>1.7.0</version>
</dependency>
<dependency>
<groupId>org.aspectj</groupId>
<artifactId>aspectjweaver</artifactId>
<version>1.7.0</version>
</dependency>
<dependency>
<groupId>cglib</groupId>
<artifactId>cglib</artifactId>
<version>2.2.2</version>
<scope>runtime</scope>
</dependency>
<dependency>
<groupId>asm</groupId>
<artifactId>asm</artifactId>
<version>3.3.1</version>
<scope>runtime</scope>
</dependency>
<!-- AOP end -->
</dependencies>
<build>
<finalName>security</finalName>
<plugins>
<plugin>
<groupId>org.mortbay.jetty</groupId>
<artifactId>jetty-maven-plugin</artifactId>
<version>${jetty.version}</version>
<configuration>
<scanIntervalSeconds>10</scanIntervalSeconds>
<stopKey>stopIt</stopKey>
<stopPort>9191</stopPort>
</configuration>
</plugin>
</plugins>
</build>
</project>
web.xml
在web.xml中增長spring mvc 與 spring security配置：spring-mvc
<?xml version="1.0" encoding="UTF-8"?>
<web-app
xmlns="http://java.sun.com/xml/ns/javaee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
version="3.0">
<display-name>spring security 練習</display-name>
<context-param>
<param-name>contextConfigLocation</param-name>
<param-value>
classpath*:applicationContext-*.xml
</param-value>
</context-param>
<!-- UTF-8 encoding filter -->
<filter>
<filter-name>encodingFilter</filter-name>
<filter-class>
org.springframework.web.filter.CharacterEncodingFilter
</filter-class>
<init-param>
<param-name>encoding</param-name>
<param-value>UTF-8</param-value>
</init-param>
<init-param>
<param-name>forceEncoding</param-name>
<param-value>true</param-value>
</init-param>
</filter>
<filter-mapping>
<filter-name>encodingFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<!-- spring security3.2 Filter-->
<filter>
<filter-name>springSecurityFilterChain</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
<filter-name>springSecurityFilterChain</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<!-- Web App Dispatcher -->
<servlet>
<servlet-name>AppBaseDispatcherServlet</servlet-name>
<servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
<init-param>
<param-name>contextConfigLocation</param-name>
<param-value>classpath:app-servlet.xml</param-value>
</init-param>
<load-on-startup>1</load-on-startup>
</servlet>
<servlet-mapping>
<servlet-name>AppBaseDispatcherServlet</servlet-name>
<url-pattern>/</url-pattern>
</servlet-mapping>
<!--Spring ApplicationContext 載入 -->
<listener>
<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>
</web-app>
app-servlet.xml
編寫app-servlet.xml的spring mvc配置：安全
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:context="http://www.springframework.org/schema/context"
xmlns:tx="http://www.springframework.org/schema/tx"
xmlns:mvc="http://www.springframework.org/schema/mvc"
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.2.xsd
http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.2.xsd
http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx-3.2.xsd
http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc-3.2.xsd">
<!-- 不過濾靜態資源 -->
<mvc:resources mapping="/resources/**" location="/resources/" order="0" />
<mvc:resources mapping="/favicon.ico" location="/resources/img/favicon.ico" order="0"/>
<!-- 自動掃描 -->
<context:component-scan base-package="org.excalibur" ></context:component-scan>
<!-- 定義JSP文件的位置 -->
<bean class="org.springframework.web.servlet.view.InternalResourceViewResolver">
<property name="viewClass" value="org.springframework.web.servlet.view.JstlView" />
<property name="prefix" value="/WEB-INF/views/jsp/"/>
<property name="suffix" value=".jsp"/>
</bean>
<!-- 默認的註解映射的支持 -->
<tx:annotation-driven />
<mvc:annotation-driven />
</beans>
applicationContext-security.xml
編寫applicationContext-security.xml的spring security配置：mvc
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:sec="http://www.springframework.org/schema/security"
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.2.xsd
http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd">
<!--開啓註解-->
<!--pre-post註解是方法級別的 支持事先或過後-->
<sec:global-method-security pre-post-annotations="enabled" />
</beans>
業務邏輯層
接下來咱們寫個業務邏輯層來測試一下。 UserService:
package org.excalibur.books.controller.org.excalibur.books.service;
import org.springframework.security.access.prepost.PreAuthorize;
/**
* Created with IntelliJ IDEA.
* User: faith
* Date: 13-6-24
* Time: 上午11:13
* To change this template use File | Settings | File Templates.
*/
public interface UserService {
@PreAuthorize("hasRole('ROLE_USER')")
public String login(String name,String password);
}
UserServiceImpl:
package org.excalibur.books.controller.org.excalibur.books.service.impl;
import org.excalibur.books.controller.org.excalibur.books.service.UserService;
import org.springframework.stereotype.Service;
/**
* Created with IntelliJ IDEA.
* User: faith
* Date: 13-6-24
* Time: 上午11:15
* To change this template use File | Settings | File Templates.
*/
@Service("userService")
public class UserServiceImpl implements UserService{
@Override
public String login(String name,String password) {
System.out.println(name+","+password);
return "登陸成功";
}
}
測試
UserServiceTest：
package org.excalibur.books.service;
import junit.framework.Assert;
import org.excalibur.books.controller.org.excalibur.books.service.UserService;
import org.junit.Test;
import org.junit.runner.RunWith;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.access.AccessDeniedException;
import org.springframework.security.authentication.AuthenticationCredentialsNotFoundException;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.authority.AuthorityUtils;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.test.context.ContextConfiguration;
import org.springframework.test.context.junit4.SpringJUnit4ClassRunner;
/**
* Created with IntelliJ IDEA.
* User: faith
* Date: 13-6-24
* Time: 上午11:22
* To change this template use File | Settings | File Templates.
*/
@ContextConfiguration(locations = {"classpath*:app-servlet.xml","classpath*:applicationContext-security.xml"})
@RunWith(SpringJUnit4ClassRunner.class)
public class UserServiceTest {
private Authentication admin = new UsernamePasswordAuthenticationToken("test", "xxx", AuthorityUtils.createAuthorityList("ROLE_ADMIN"));
private Authentication user = new UsernamePasswordAuthenticationToken("test", "xxx", AuthorityUtils.createAuthorityList("ROLE_USER"));
@Autowired
private UserService userService;
@Test(expected = AuthenticationCredentialsNotFoundException.class)
public void testLogin1(){
userService.login("excalibur","123456");
}
@Test(expected = AccessDeniedException.class)
public void testLogin2(){
SecurityContextHolder.getContext().setAuthentication(admin);
userService.login("excalibur", "123456");
}
@Test
public void testLogin3(){
SecurityContextHolder.getContext().setAuthentication(user);
String result = userService.login("excalibur", "123456");
Assert.assertEquals(result,"登陸成功");
}
}
源碼
相關文章
- 1. spring security 3.2.0.M1 方法級別教程 基於註解——第二部分
- 2. 基於spring4和spring security實現oauth2.0教程（註解）
- 3. Spring Security教程第一部分-jar包下載
- 4. Spring Security部分詳解
- 5. Spring Security教程(一)
- 6. Spring Security教程
- 7. 【譯】Spring 官方教程：Spring Security 架構
- 8. Spring Security教程(一)：初識Spring Security
- 9. spring security的一些註解
- 10. Spring3.1.M1 cache註解
- 更多相關文章...
- • 第一個Spring程序 - Spring教程
- • Spring基於Annotation裝配Bean - Spring教程
- • Git五分鐘教程
- • Git可視化極簡易教程 — Git GUI使用方法
相關標籤/搜索
每日一句
-
每一个你不满意的现在，都有一个你没有努力的曾经。
歡迎關注本站公眾號,獲取更多信息
相關文章
- 1. spring security 3.2.0.M1 方法級別教程 基於註解——第二部分
- 2. 基於spring4和spring security實現oauth2.0教程（註解）
- 3. Spring Security教程第一部分-jar包下載
- 4. Spring Security部分詳解
- 5. Spring Security教程(一)
- 6. Spring Security教程
- 7. 【譯】Spring 官方教程：Spring Security 架構
- 8. Spring Security教程(一)：初識Spring Security
- 9. spring security的一些註解
- 10. Spring3.1.M1 cache註解