HTTP BASIC authentication headers (一个基于IEFT RFC 的标准)
HTTP Digest authentication headers (一个基于IEFT RFC 的标准)
HTTP X.509 client certificate exchange (一个基于IEFT RFC 的标准)
LDAP (一个非常常见的跨平台认证需要做法,特别是在大环境)
Form-based authentication (提供简单用户接口的需求)
OpenID authentication
Computer Associates Siteminder
JA-SIG Central Authentication Service (CAS,这是一个流行的开源单点登录系统)
Transparent authentication context propagation for Remote Method Invocation and HttpInvoker (一个Spring远程调用协议)
//从spring容器中获取UserDetailsService(这个从数据库根据用户名查询用户信息,及加载权限的service) UserDetailsService userDetailsService = (UserDetailsService)SpringContextUtil.getBean("userDetailsService"); //根据用户名username加载userDetails UserDetails userDetails = userDetailsService.loadUserByUsername(username); //根据userDetails构建新的Authentication,这里使用了 //PreAuthenticatedAuthenticationToken当然可以用其他token,如UsernamePasswordAuthenticationToken PreAuthenticatedAuthenticationToken authentication = new PreAuthenticatedAuthenticationToken(userDetails, userDetails.getPassword(),userDetails.getAuthorities()); //设置authentication中details authentication.setDetails(new WebAuthenticationDetails(request)); //存放authentication到SecurityContextHolder SecurityContextHolder.getContext().setAuthentication(authentication); HttpSession session = request.getSession(true); //在session中存放security context,方便同一个session中控制用户的其他操作 session.setAttribute("SPRING_SECURITY_CONTEXT", SecurityContextHolder.getContext());
/** * 获取用户Details信息的回调函数. */ public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException,DataAccessException { GeOperator geOperator = geOperatorService.findOperatorByPK(username); if(geOperator == null){ throw new UsernameNotFoundException("","用户名错误"); } //加载该用户权限 Set<GrantedAuthority> grantedAuths = obtainGrantedAuthorities(geOperator); boolean enabled = true; boolean accountNonExpired = true; boolean credentialsNonExpired = true; boolean accountNonLocked = true; UserDetails userdetails = new MisUser(username, geOperator.getPwd(), geOperator, enabled, accountNonExpired, credentialsNonExpired, accountNonLocked, grantedAuths); return userdetails; }
参考问题:
How to manually set an authenticated user in Spring Security / SpringMVC
Java知识总结:Java反射机制(用实例理解),布布扣,bubuko.com
原文地址:http://blog.csdn.net/zhongwen7710/article/details/26755755