SpringSecurity实现两个登陆口权限控制 要求请求角色及权限从数据库中取

wangzhiwei231 2015-09-24 05:17:41
一个登录口的已经实现了
通过默认接口LoginUrlAuthenticationEntryPoint设置登陆点 position="FORM_LOGIN_FILTER"

置加了个登录验证,重写UsernamePasswordAuthenticationFilter获取登陆时候的角色
before="FILTER_SECURITY_INTERCEPTOR"位置加入自定义filter,通过重写
AccessDecisionManager 、FilterInvocationSecurityMetadataSource 、
UserDetailsService 实现从数据库提取相关角色和权限

现在想要再加一个登陆口 实现后台管理者 和 前台用户 分别登录 都进行相应的权限管理
网上找了很多都是通过access=“hasRole(XXX)”这样进行控制的 但是没有从数据库提取权限的
已经困扰我好几天了 求大神
下面是自己尝试加两个登陆口写的代码 但是不好使

<http name="admin" pattern="/admin/**" use-expressions="true"
entry-point-ref="adminAuthProcessingFilterEntryPoint"
access-denied-page="/admin/login">


<!-- 检测失效的sessionId,超时时定位到另外一个URL -->
<session-management invalid-session-url="/admin/login" />

<custom-filter ref="adminLoginFilter" position="FORM_LOGIN_FILTER" />
<!-- 增加一个自定义的filter,放在FILTER_SECURITY_INTERCEPTOR之前, 实现用户、角色、权限、资源的数据库管理。 -->
<custom-filter ref="adminCustomFilter" before="FILTER_SECURITY_INTERCEPTOR" />
</http>

<!-- 用户Token登录控制 -->
<http name="publisher" pattern="/publisher/**" use-expressions="true"
entry-point-ref="tokenAuthProcessingFilterEntryPoint"
access-denied-page="/publisher/login">

<!-- 检测失效的sessionId,超时时定位到另外一个URL -->
<session-management invalid-session-url="/publisher/login" />

<custom-filter ref="tokenLoginFilter" positon="FORM_LOGIN_FILTER" />
<!-- 增加一个自定义的filter,放在FILTER_SECURITY_INTERCEPTOR之前, 实现用户、角色、权限、资源的数据库管理。 -->
<custom-filter ref="tokenCustomFilter" before="FILTER_SECURITY_INTERCEPTOR" />
</http>


<!-- <http use-expressions="true" entry-point-ref="authenticationProcessingFilterEntryPoint"> -->

<!-- <form-login login-page="/login" authentication-failure-url="/login?error=true"
default-target-url="/login" /> -->

<!-- <intercept-url pattern="/admin/**" access="ROLE_USER" /> -->

<!-- "记住我"功能,采用持久化策略(将用户的登录信息存放在数据库表中) -->
<!-- <remember-me data-source-ref="dataSource" /> -->

<!-- 检测失效的sessionId,超时时定位到另外一个URL -->
<!-- <session-management invalid-session-url="/publisher/login" /> -->

<!-- <custom-filter ref="adminLoginFilter" position="FORM_LOGIN_FILTER"
/> 增加一个自定义的filter,放在FILTER_SECURITY_INTERCEPTOR之前, 实现用户、角色、权限、资源的数据库管理。 <custom-filter
ref="customFilter" before="FILTER_SECURITY_INTERCEPTOR" /> </http> -->

<!-- 未登录的切入点 -->
<beans:bean id="adminAuthProcessingFilterEntryPoint"
class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint">
<beans:property name="loginFormUrl" value="/admin/login"></beans:property>
</beans:bean>
<beans:bean id="tokenAuthProcessingFilterEntryPoint"
class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint">
<beans:property name="loginFormUrl" value="/publisher/login"></beans:property>
</beans:bean>

<!-- 登录验证器 -->
<beans:bean id="adminLoginFilter"
class="com.sportedu.server.security.admin.AdminUsernamePasswordAuthenticationFilter">
<!-- 处理登录 -->
<beans:property name="filterProcessesUrl" value="/j_spring_security_check" />
<beans:property name="authenticationSuccessHandler"
ref="loginAdminAuthenticationSuccessHandler" />
<beans:property name="authenticationFailureHandler"
ref="simpleAdminUrlAuthenticationFailureHandler" />
<beans:property name="authenticationManager" ref="adminauthenticationManager" />
</beans:bean>

<!-- 登录成功页面跳转 -->
<beans:bean id="loginAdminAuthenticationSuccessHandler"
class="org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler">
<beans:property name="defaultTargetUrl" value="/jsp/admin/common/main.jsp" />
</beans:bean>
<!-- 登录失败返回页面 -->
<beans:bean id="simpleAdminUrlAuthenticationFailureHandler"
class="org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler">
<beans:property name="defaultFailureUrl" value="/admin/login" />
</beans:bean>


<beans:bean id="tokenLoginFilter"
class="com.sportedu.server.security.token.TokenUsernamePasswordAuthenticationFilter">
<!-- 处理登录 -->
<beans:property name="filterProcessesUrl" value="/j_spring_security_check" />
<beans:property name="authenticationSuccessHandler"
ref="loginPublisherAuthenticationSuccessHandler" />
<beans:property name="authenticationFailureHandler"
ref="simplePublisehrUrlAuthenticationFailureHandler" />
<beans:property name="authenticationManager" ref="tokenauthenticationManager" />
</beans:bean>

<!-- 登录成功页面跳转 -->
<beans:bean id="loginPublisherAuthenticationSuccessHandler"
class="org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler">
<beans:property name="defaultTargetUrl" value="/jsp/publisher/common/main.jsp" />
</beans:bean>
<!-- 登录失败返回页面 -->
<beans:bean id="simplePublisehrUrlAuthenticationFailureHandler"
class="org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler">
<beans:property name="defaultFailureUrl" value="/publisher/login" />
</beans:bean>

<!-- 一个自定义的filter,必须包含authenticationManager, accessDecisionManager,securityMetadataSource三个属性。 -->
<beans:bean id="adminCustomFilter"
class="com.sportedu.server.security.admin.AdminFilterSecurityInterceptor">
<beans:property name="authenticationManager" ref="adminauthenticationManager" />
<beans:property name="accessDecisionManager" ref="adminAccessDecisionManager" />
<beans:property name="securityMetadataSource" ref="adminSecurityMetadataSource" />
</beans:bean>

<beans:bean id="tokenCustomFilter"
class="com.sportedu.server.security.token.TokenFilterSecurityInterceptor">
<beans:property name="authenticationManager" ref="tokenauthenticationManager" />
<beans:property name="accessDecisionManager" ref="tokenAccessDecisionManager" />
<beans:property name="securityMetadataSource" ref="tokenSecurityMetadataSource" />
</beans:bean>
<!-- 注意能够为authentication-manager 设置alias别名 -->
<authentication-manager alias="adminauthenticationManager">
<authentication-provider user-service-ref="adminDetailsService" />
</authentication-manager>
<authentication-manager alias="tokenauthenticationManager">
<authentication-provider user-service-ref="tokenDetailsService" />
</authentication-manager>
<!-- 自定义权限处理 -->
<beans:bean name="adminDetailsService"
class="com.sportedu.server.security.admin.AdminUserDetailsService" />
<beans:bean name="tokenDetailsService"
class="com.sportedu.server.security.token.TokenUserDetailsService" />
<!-- 访问决策器,决定某个用户具有的角色,是否有足够的权限去访问某个资源。 -->
<beans:bean id="adminAccessDecisionManager"
class="com.sportedu.server.security.admin.AdminAccessDecisionManager">
</beans:bean>
<beans:bean id="tokenAccessDecisionManager"
class="com.sportedu.server.security.token.TokenAccessDecisionManager">
</beans:bean>
<!-- 资源源数据定义,将所有的资源和权限对应关系建立起来,即定义某一资源可以被哪些角色去访问。 -->
<beans:bean id="adminSecurityMetadataSource"
class="com.sportedu.server.security.admin.AdminInvocationSecurityMetadataSourceService">
</beans:bean>
<beans:bean id="tokenSecurityMetadataSource"
class="com.sportedu.server.security.token.TokenInvocationSecurityMetadataSourceService">
</beans:bean>

</beans:beans>
...全文
66 点赞 收藏 回复
写回复
回复
切换为时间正序
当前发帖距今超过3年,不再开放新的回复
发表回复
相关推荐
发帖
Web 开发
创建于2007-09-28

8.0w+

社区成员

Java Web 开发
申请成为版主
帖子事件
创建了帖子
2015-09-24 05:17
社区公告
暂无公告