spring security demo

package com.yin.myproject.security.controller;

import java.util.ArrayList;
import java.util.List;

import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;

public class MyUserDetailService implements UserDetailsService{

    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        //权限
        List<SimpleGrantedAuthority> roles = new ArrayList<SimpleGrantedAuthority>();
        roles.add(new SimpleGrantedAuthority("ROLE_USER"));
        
        return new User(username,username,roles);
    }

}

package com.yin.myproject.security.controller;

import org.springframework.security.crypto.password.PasswordEncoder;

public class MyPasswordEncoder implements PasswordEncoder{

    public String encode(CharSequence rawPassword) {
        String encPassword = rawPassword.toString();
        return encPassword;
    }

    public boolean matches(CharSequence rawPassword, String encodedPassword) {
        return encode(rawPassword).equals(encodedPassword);
    }


}

package com.yin.myproject.security.controller;

import java.io.IOException;
import java.util.Collection;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;

import org.springframework.security.core.Authentication;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.web.authentication.AuthenticationSuccessHandler;

public class LoginSuccessHandler implements AuthenticationSuccessHandler{

    public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response,
            Authentication authentication) throws IOException, ServletException {
        Object principal = authentication.getPrincipal();
        User user = (User) principal;
        Collection<GrantedAuthority> authorities = user.getAuthorities();
        for (GrantedAuthority authority : authorities) {
            if (authority.getAuthority().equals("ROLE_USER")) {
                HttpSession session = request.getSession();
                session.setAttribute("role", "ROLE_USER");
                //再将用户保存在session中
                response.sendRedirect(request.getContextPath() + "/welcome");
            }
        }
    }
}

<?xml version="1.0" encoding="UTF-8"?>
<bean:beans xmlns="http://www.springframework.org/schema/security"
    xmlns:bean="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
                        http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd">

    <http pattern="/loginPage" security="none"></http>

    <http auto-config="true" use-expressions="true">
        <intercept-url pattern="/*" access="hasRole(‘ROLE_USER‘)" />
        <form-login login-page="/loginPage" login-processing-url="/login"
            authentication-success-handler-ref="mySuccessHandler"
            authentication-failure-url="/loginPage?error=error" />
        <logout logout-url="/logout" logout-success-url="/loginPage" invalidate-session="true"/>
        <remember-me key="authorition" use-secure-cookie="true"/>
<!--         权限控制 -->
        <custom-filter ref="myFilter" before="FILTER_SECURITY_INTERCEPTOR"/>
        <csrf disabled="true" />
    </http>
    <authentication-manager alias="authenticationManager">
        <authentication-provider user-service-ref="myUserDetailService">
<!--             <user-service> -->
<!--                 <user authorities="ROLE_USER" name="guest" password="guest" /> -->
<!--             </user-service> -->
    <!-- 密码加密 -->  
                   <password-encoder ref="myPasswordEncoder"/>
        </authentication-provider>
    </authentication-manager>

    <bean:bean id="myUserDetailService" class="com.yin.myproject.security.controller.MyUserDetailService"></bean:bean>

    <bean:bean id="myPasswordEncoder" class="com.yin.myproject.security.controller.MyPasswordEncoder"></bean:bean>
    
    <bean:bean id="mySuccessHandler" class="com.yin.myproject.security.controller.LoginSuccessHandler"></bean:bean>
    
<!--     权限控制过滤器 -->
    <bean:bean id="myFilter" class="com.yin.myproject.security.controller.MyfilterSecurityInterceptor"> 
             <bean:property name="accessDecisionManager" ref="accessDecisionManager"></bean:property> 
             <bean:property name="securityMetadataSourceService" ref="securityMetadataSourceService"></bean:property>
     </bean:bean> 
     
     <!--         投票规则 -->
        <bean:bean id="accessDecisionManager" class="org.springframework.security.access.vote.AffirmativeBased">  
            <bean:constructor-arg name="decisionVoters">  
                <bean:list>  
<!--                      <ref bean="roleVoter"/>    -->
<!--                      <ref bean="authenticatedVoter"/>    -->
                    <bean:ref bean="defaultVoter" />
                </bean:list>  
            </bean:constructor-arg>  
        </bean:bean>
<!--         自定义投票器 -->
        <bean:bean id="defaultVoter" class="com.yin.myproject.security.controller.DefaultVoter"></bean:bean>
        
        
        <bean:bean id="securityMetadataSourceService" class="com.yin.myproject.security.controller.MyInvocationSecurityMetadataSourceService"></bean:bean>
</bean:beans>

package com.yin.myproject.security.controller;

import java.io.IOException;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;

import org.springframework.security.access.SecurityMetadataSource;
import org.springframework.security.access.intercept.AbstractSecurityInterceptor;
import org.springframework.security.access.intercept.InterceptorStatusToken;
import org.springframework.security.web.FilterInvocation;
import org.springframework.security.web.access.intercept.FilterInvocationSecurityMetadataSource;

public class MyfilterSecurityInterceptor extends AbstractSecurityInterceptor  implements Filter{

    private FilterInvocationSecurityMetadataSource securityMetadataSourceService;
    
    public void init(FilterConfig filterConfig) throws ServletException {
        // TODO Auto-generated method stub
        
    }

    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
            throws IOException, ServletException {
        FilterInvocation fi = new FilterInvocation(request, response, chain);   
        invoke(fi);
    }

    public void destroy() {
        // TODO Auto-generated method stub
        
    }

    @Override
    public Class<?> getSecureObjectClass() {
        return FilterInvocation.class;
    }

    @Override
    public SecurityMetadataSource obtainSecurityMetadataSource() {
        return this.securityMetadataSourceService;
    }
    
    public void invoke(FilterInvocation fi) throws IOException, ServletException {  
        //fi里面有一个被拦截的url  
        //里面调用MyInvocationSecurityMetadataSource的getAttributes(Object object)这个方法获取fi对应的所有权限  
        //再调用MyAccessDecisionManager的decide方法来校验用户的权限是否足够  
        InterceptorStatusToken token = super.beforeInvocation(fi);  
        try {  
            //执行下一个拦截器  
            fi.getChain().doFilter(fi.getRequest(), fi.getResponse());     
            } finally {   
                super.afterInvocation(token, null);    
            }     
    }
    
    public FilterInvocationSecurityMetadataSource getSecurityMetadataSourceService() {
        return securityMetadataSourceService;
    }

    public void setSecurityMetadataSourceService(
            FilterInvocationSecurityMetadataSource securityMetadataSourceService) {
        this.securityMetadataSourceService = securityMetadataSourceService;
    }  

}

package com.yin.myproject.security.controller;

import java.util.ArrayList;
import java.util.Collection;
import java.util.HashMap;
import java.util.Iterator;
import java.util.List;
import java.util.Map;

import org.springframework.beans.factory.InitializingBean;
import org.springframework.security.access.ConfigAttribute;
import org.springframework.security.access.SecurityConfig;
import org.springframework.security.web.FilterInvocation;
import org.springframework.security.web.access.intercept.FilterInvocationSecurityMetadataSource;

public class MyInvocationSecurityMetadataSourceService implements FilterInvocationSecurityMetadataSource,InitializingBean{

    private static Map<String, Collection<ConfigAttribute>> resourceMap = null; 
    
    //初始化链接和权限的关系
    private void loadResourceDefine(){
        resourceMap = new HashMap<String, Collection<ConfigAttribute>>();
        
        //得到所有权限
        String tempAuth = "ROLE_USER";
        List<String> auths = new ArrayList<String>();
        //得到链接
        List<String> urls = new ArrayList<String>();
        auths.add(tempAuth);
        
        for(String auth:auths){
            ConfigAttribute ca = new SecurityConfig(auth);
            
            String tempUrl = "/welcome" ;
            urls.add(tempUrl);
            for(String url:urls){
                if(resourceMap.containsKey(url)){
                    Collection<ConfigAttribute> value = resourceMap.get(url);
                    value.add(ca);
                    resourceMap.put(url, value);
                }else{
                    Collection<ConfigAttribute> atts = new ArrayList<ConfigAttribute>();
                    atts.add(ca);
                    resourceMap.put(url, atts);
                }
            }
            
        }
    }
    
    public Collection<ConfigAttribute> getAttributes(Object object) throws IllegalArgumentException {
        String url = ((FilterInvocation) object).getRequestUrl();
        int firstQuestionMarkIndex = url.indexOf("?");
        if (firstQuestionMarkIndex != -1) {
            url = url.substring(0, firstQuestionMarkIndex);
        }
        Iterator<String> ite = resourceMap.keySet().iterator();
        while (ite.hasNext()) {
            String resURL = ite.next();

            if (url.equals(resURL)) {

                return resourceMap.get(resURL);
            }
        }

        return null;
    }

    public Collection<ConfigAttribute> getAllConfigAttributes() {
        return null;
    }

    public boolean supports(Class<?> clazz) {
        return true;
    }

    //bean加载后初始化
    public void afterPropertiesSet() throws Exception {
        loadResourceDefine();
    }

}

package com.yin.myproject.security.controller;

import java.util.Collection;

import org.springframework.security.access.AccessDecisionVoter;
import org.springframework.security.access.ConfigAttribute;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.GrantedAuthority;

public class DefaultVoter implements AccessDecisionVoter<Object>{

    public boolean supports(ConfigAttribute attribute) {
        return true;
    }

    public boolean supports(Class<?> clazz) {
        return true;
    }

    public int vote(Authentication authentication, Object object, Collection<ConfigAttribute> attributes) {
        int result = ACCESS_ABSTAIN;
        Collection<? extends GrantedAuthority> authorities = authentication.getAuthorities();
        for (ConfigAttribute attribute : attributes) {  
            if (this.supports(attribute)) {  
                result = ACCESS_DENIED;  
      
                // Attempt to find a matching granted authority  
                for (GrantedAuthority authority : authorities) {  
                    if (attribute.getAttribute().equals(authority.getAuthority())) {  
                        return ACCESS_GRANTED;  
                    }  
                }  
            }  
        }  
      
        return result;
    }
    
}