标签：基础上 html new ini val 版本 -- display auth
描述：本篇博客在上一博客基础上实现利用SpringSecurity标签库控制页面显示权限。代码为完整代码，复制即可使用。
1.项目结构
2.pom.xml
1 <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 2 xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd"> 3 4 <modelVersion>4.0.0</modelVersion> 5 6 <groupId>org.springsecurity</groupId> 7 <artifactId>SpringSecurity</artifactId> 8 <packaging>war</packaging> 9 <version>0.0.1-SNAPSHOT</version> 10 <name>SpringSecurity Maven Webapp</name> 11 <url>http://maven.apache.org</url> 12 13 <!-- 统一版本 --> 14 <properties> 15 <jdk.version>1.7</jdk.version> 16 <spring.version>4.3.5.RELEASE</spring.version> 17 <spring.security.version>4.2.1.RELEASE</spring.security.version> 18 </properties> 19 20 <dependencies> 21 <!-- junit依赖 --> 22 <dependency> 23 <groupId>junit</groupId> 24 <artifactId>junit</artifactId> 25 <version>4.12</version> 26 <scope>test</scope> 27 </dependency> 28 <!-- spring依赖 --> 29 <dependency> 30 <groupId>org.springframework</groupId> 31 <artifactId>spring-core</artifactId> 32 <version>${spring.version}</version> 33 </dependency> 34 <dependency> 35 <groupId>org.springframework</groupId> 36 <artifactId>spring-web</artifactId> 37 <version>${spring.version}</version> 38 </dependency> 39 <dependency> 40 <groupId>org.springframework</groupId> 41 <artifactId>spring-webmvc</artifactId> 42 <version>${spring.version}</version> 43 </dependency> 44 <!-- spring security依赖 --> 45 <dependency> 46 <groupId>org.springframework.security</groupId> 47 <artifactId>spring-security-web</artifactId> 48 <version>${spring.security.version}</version> 49 </dependency> 50 <dependency> 51 <groupId>org.springframework.security</groupId> 52 <artifactId>spring-security-config</artifactId> 53 <version>${spring.security.version}</version> 54 </dependency> 55 <!-- SpringSecurity标签库依赖 --> 56 <dependency> 57 <groupId>org.springframework.security</groupId> 58 <artifactId>spring-security-taglibs</artifactId> 59 <version>${spring.security.version}</version> 60 </dependency> 61 <!-- jsp、servlet依赖 --> 62 <dependency> 63 <groupId>jstl</groupId> 64 <artifactId>jstl</artifactId> 65 <version>1.2</version> 66 </dependency> 67 <dependency> 68 <groupId>taglibs</groupId> 69 <artifactId>standard</artifactId> 70 <version>1.1.2</version> 71 </dependency> 72 <dependency> 73 <groupId>javax.servlet</groupId> 74 <artifactId>javax.servlet-api</artifactId> 75 <version>3.1.0</version> 76 </dependency> 77 </dependencies> 78 <build> 79 <finalName>SpringSecurity</finalName> 80 </build> 81 </project>
3.mvc-dispatcher-servlet.xml
1 <?xml version="1.0" encoding="UTF-8"?> 2 <beans xmlns="http://www.springframework.org/schema/beans" 3 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 4 xmlns:context="http://www.springframework.org/schema/context" 5 xsi:schemaLocation="http://www.springframework.org/schema/beans 6 http://www.springframework.org/schema/beans/spring-beans.xsd 7 http://www.springframework.org/schema/context 8 http://www.springframework.org/schema/context/spring-context.xsd"> 9 10 <!-- 开启包扫描 --> 11 <context:component-scan base-package="org.springsecurity.*"/> 12 13 <!-- 定义视图解析器 --> 14 <bean class="org.springframework.web.servlet.view.InternalResourceViewResolver"> 15 <property name="prefix"> 16 <value>/WEB-INF/pages/</value> 17 </property> 18 <property name="suffix"> 19 <value>.jsp</value> 20 </property> 21 </bean> 22 23 </beans>
4.spring-security.xml
1 <?xml version="1.0" encoding="UTF-8"?> 2 <beans xmlns="http://www.springframework.org/schema/beans" 3 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 4 xmlns:security="http://www.springframework.org/schema/security" 5 xsi:schemaLocation="http://www.springframework.org/schema/beans 6 http://www.springframework.org/schema/beans/spring-beans.xsd 7 http://www.springframework.org/schema/security 8 http://www.springframework.org/schema/security/spring-security.xsd"> 9 10 <security:http auto-config="true"> 11 <!-- 指定需要拦截的URL，并设置访问所需的角色 --> 12 <security:intercept-url pattern="/" 13 access="hasRole(‘USER‘) or hasRole(‘ADMIN‘) or hasRole(‘DBA‘)"/> 14 <!-- 测试中发现SpringSecurity会自动在角色名称前加上ROLE_。即ROLE_USER == USER --> 15 <security:intercept-url pattern="/home**" 16 access="hasRole(‘USER‘) or hasRole(‘ADMIN‘)or hasRole(‘DBA‘)"/> 17 <!-- login-page:跳转到登录界面的请求名称 18 default-target-url:指定身份验证通过后默认执行的请求名称 19 authentication-failure-url:如果验证失败，则转向URL 20 username-parameter:表示登录时用户使用的是哪个参数，即用户名输入框的name 21 password-parameter:表示登录时密码使用的是哪个参数，即密码输入框的name 22 --> 23 <security:form-login login-page="/login" default-target-url="/home" 24 authentication-failure-url="/login?error" username-parameter="username" 25 password-parameter="password"/> 26 <!-- 开启csrf，在登录或注销页面都必须包含_csrf.token --> 27 <security:csrf/> 28 </security:http> 29 30 <security:authentication-manager> 31 <security:authentication-provider> 32 <security:user-service> 33 <!-- 设置用户的密码和角色，authorities指定角色必须加上ROLE_，否则会报错403：Access is denied --> 34 <security:user name="admin" password="123456" authorities="ROLE_ADMIN" /> 35 <security:user name="user" password="123456" authorities="ROLE_USER" /> 36 <security:user name="dba" password="123456" authorities="ROLE_DBA" /> 37 </security:user-service> 38 </security:authentication-provider> 39 </security:authentication-manager> 40 41 </beans>
5.web.xml
1 <web-app xmlns="http://java.sun.com/xml/ns/javaee" 2 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 3 xsi:schemaLocation="http://java.sun.com/xml/ns/javaee 4 http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd" 5 version="3.0" metadata-complete="true"> 6 7 <!-- Spring MVC --> 8 <servlet> 9 <servlet-name>mvc-dispatcher</servlet-name> 10 <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class> 11 <init-param> 12 <param-name>contextConfigLocation</param-name> 13 <param-value>classpath:mvc-dispatcher-servlet.xml</param-value> 14 </init-param> 15 </servlet> 16 <servlet-mapping> 17 <servlet-name>mvc-dispatcher</servlet-name> 18 <url-pattern>/</url-pattern> 19 </servlet-mapping> 20 21 <listener> 22 <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class> 23 </listener> 24 25 <!-- 加载spring-security配置文件 --> 26 <context-param> 27 <param-name>contextConfigLocation</param-name> 28 <param-value>classpath:spring-security.xml</param-value> 29 </context-param> 30 31 <!-- spring security --> 32 <filter> 33 <filter-name>springSecurityFilterChain</filter-name> 34 <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class> 35 </filter> 36 <filter-mapping> 37 <filter-name>springSecurityFilterChain</filter-name> 38 <url-pattern>/*</url-pattern> 39 </filter-mapping> 40 41 </web-app>
6.HelloController.java
1 package org.springsecurity.controller; 2 3 import org.springframework.security.core.context.SecurityContextHolder; 4 import org.springframework.security.core.userdetails.UserDetails; 5 import org.springframework.stereotype.Controller; 6 import org.springframework.web.bind.annotation.RequestMapping; 7 import org.springframework.web.bind.annotation.RequestMethod; 8 import org.springframework.web.bind.annotation.RequestParam; 9 import org.springframework.web.servlet.ModelAndView; 10 11 @Controller 12 public class HelloController { 13 14 @RequestMapping(value = {"/", "/home**"}, method = RequestMethod.GET) 15 public ModelAndView welcomePage() { 16 17 ModelAndView model = new ModelAndView(); 18 model.addObject("user", getPrincipal()); 19 model.setViewName("success"); 20 return model; 21 22 } 23 24 @RequestMapping(value = "/login", method = RequestMethod.GET) 25 public ModelAndView login( 26 @RequestParam(value = "error", required = false) String error, 27 @RequestParam(value = "logout", required = false) String logout) { 28 29 ModelAndView model = new ModelAndView(); 30 if(error != null){ 31 model.addObject("error", "违法的用户名或密码！"); 32 } 33 if(logout != null){ 34 model.addObject("msg", "您已成功注销！"); 35 } 36 model.setViewName("login"); 37 return model; 38 39 } 40 41 private String getPrincipal() { 42 43 String username = null; 44 Object principal = SecurityContextHolder.getContext().getAuthentication().getPrincipal(); 45 if(principal instanceof UserDetails) { 46 username = ((UserDetails) principal).getUsername(); 47 } else { 48 username = principal.toString(); 49 } 50 return username; 51 52 } 53 54 }
7.login.jsp
1 <%@ page language="java" contentType="text/html; charset=UTF-8" 2 pageEncoding="UTF-8"%> 3 <%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" %> 4 <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> 5 <html> 6 <head> 7 <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> 8 <title>Insert title here</title> 9 </head> 10 <body onload="focus()"> 11 <h1>Spring Security 自定义登录界面</h1> 12 <div id="login-box"> 13 <c:if test="${not empty error }"> 14 <div class="error"><font color="red">${error }</font><br/><br/></div> 15 </c:if> 16 <c:if test="${not empty msg }"> 17 <div class="msg"><font color="red">${msg }</font><br/><br/></div> 18 </c:if> 19 <!-- SpringSecurity3.x默认的登录拦截URL是/j_spring_security_check； 20 4.x默认的登录拦截URL是/login --> 21 <form name="loginForm" action="<c:url value=‘/login‘/>" method="POST"> 22 <table> 23 <tr> 24 <td>用户名：</td> 25 <!-- name必须与spring-security.xml中配置的username-parameter一致，否则登录认证会失败 --> 26 <td><input type="text" name="username"/></td> 27 </tr> 28 <tr> 29 <td>密码：</td> 30 <!-- name必须与spring-security.xml中配置的password-parameter一致，否则登录认证会失败 --> 31 <td><input type="password" name="password"></td> 32 </tr> 33 <tr style="text-align: center;" > 34 <td colspan="2"> 35 <input type="reset" value="重置"/> 36 <input type="submit" value="登录"/> 37 </td> 38 </tr> 39 </table> 40 <!-- 开启csrf后必须包含_csrf.token,否则报错： 41 403 Could not verify the provided CSRF token because your session was not found --> 42 <input type="hidden" name="${_csrf.parameterName }" value="${_csrf.token }"/> 43 </form> 44 </div> 45 </body> 46 <script type="text/javascript"> 47 48 function focus(){//设置加载时鼠标焦点 49 50 document.loginForm.username.focus(); 51 52 } 53 54 </script> 55 </html>
8.success.jsp
1 <%@ page language="java" contentType="text/html; charset=UTF-8" 2 pageEncoding="UTF-8"%> 3 <%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" %> 4 <%@ taglib prefix="sec" uri="http://www.springframework.org/security/tags" %> 5 <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> 6 <html> 7 <head> 8 <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> 9 <title>Insert title here</title> 10 </head> 11 <body> 12 Dear <strong>${user }</strong>, Welcome to Home Page. 13 <a href="javascript:formSubmit()">Logout</a> 14 15 <!-- 隐藏域，用于提交注销请求 --> 16 <c:url value="/logout" var="logoutUrl"/> 17 <!-- 假设注销请求是*，若*=logout（即等于默认的注销拦截URL）,则实际请求是/login?logout 18 若*!=logout,则实际请求是/*。具体原因未知。。 --> 19 <form action="${logoutUrl }" method="POST" id="logoutForm"> 20 <!-- 开启csrf后必须包含_csrf.token,否则报错： 21 403 Could not verify the provided CSRF token because your session was not found --> 22 <input type="hidden" name="${_csrf.parameterName }" value="${_csrf.token }"> 23 </form> 24 25 <br/><br/> 26 This part is visible to Everyone. 27 <sec:authorize access="hasRole(‘USER‘)"><!-- USER角色专有 --> 28 This part is visible to <font color="red">USER</font>. 29 </sec:authorize> 30 <sec:authorize access="hasRole(‘ADMIN‘)"><!-- ADMIN角色专有 --> 31 This part is visible to <font color="red">ADMIN</font>. 32 </sec:authorize> 33 <sec:authorize access="hasRole(‘DBA‘)"><!-- DBA角色专有 --> 34 This part is visible to <font color="red">DBA</font>. 35 </sec:authorize> 36 </body> 37 <script type="text/javascript"> 38 39 function formSubmit(){//提交注销请求表单 40 41 document.getElementById("logoutForm").submit(); 42 43 } 44 45 </script> 46 </html>
9.效果预览
9.1 登录界面
9.2 ADMIN角色登录
9.3 DBA角色登录
9.4 USER角色登录
SpringSecurity学习三----------通过Security标签库简单显示视图
标签：基础上 html new ini val 版本 -- display auth
原文地址：http://www.cnblogs.com/jinjiyese153/p/6672608.html
