activiti-rest的权限控制

1.观察activiti-rest的目录结构，可以知道该war包为Webapp，按照教程二创建工程目录，并根据activiti-rest的目录导入资源和java类

classes中class文件和java类的对应关系，classes目录<---->src目录，src目录新建package，并与classes的目录结构一一对应

其他资源文件的的对应结构，classes<---->webapp中class目录下

2.将源web.xml中的内容复制到工程项目

3.使用Maven解决相关依赖

4.部署到Tomcat上，查看是否与原来的war包实现同一个功能

5.观察源码，通过跟踪，可以知道管理登录及认证的在类SecurityConfiguration.java中

package org.activiti.rest.conf;
import org.activiti.rest.security.BasicAuthenticationProvider;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationProvider;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.annotation.web.configurers.CsrfConfigurer;
import org.springframework.security.config.annotation.web.configurers.ExpressionUrlAuthorizationConfigurer.AuthorizedUrl;
import org.springframework.security.config.annotation.web.configurers.ExpressionUrlAuthorizationConfigurer.ExpressionInterceptUrlRegistry;
import org.springframework.security.config.annotation.web.configurers.SessionManagementConfigurer;
import org.springframework.security.config.annotation.web.servlet.configuration.EnableWebMvcSecurity;
import org.springframework.security.config.http.SessionCreationPolicy;
@Configuration
@EnableWebSecurity
@EnableWebMvcSecurity
public class SecurityConfiguration
  extends WebSecurityConfigurerAdapter
{
  @Bean
  public AuthenticationProvider authenticationProvider()
  {
    return new BasicAuthenticationProvider();
  }
   
  protected void configure(HttpSecurity http)
    throws Exception
  {
    ((HttpSecurity)((ExpressionUrlAuthorizationConfigurer.AuthorizedUrl)((HttpSecurity)((HttpSecurity)http.authenticationProvider(authenticationProvider()).sessionManagement()
    .sessionCreationPolicy(SessionCreationPolicy.STATELESS).and())
    .csrf().disable())
    .authorizeRequests().anyRequest())
    .authenticated().and())
    .httpBasic();
  }
}

这里是使用Spring Security进行验证，那么更改为

package org.activiti.rest.conf;
 
import com.kf580.Kf580BasicAuthenticationProvider;
import org.activiti.engine.IdentityService;
import org.activiti.engine.identity.Group;
import org.activiti.rest.security.BasicAuthenticationProvider;
import org.activiti.rest.service.api.identity.GroupResource;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.HttpMethod;
import org.springframework.security.authentication.AuthenticationProvider;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.annotation.web.configurers.ExpressionUrlAuthorizationConfigurer;
import org.springframework.security.config.annotation.web.configurers.SessionManagementConfigurer;
import org.springframework.security.config.annotation.web.servlet.configuration.EnableWebMvcSecurity;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.userdetails.UserDetails;
 
//antMatchers(HttpMethod.PUT,"/**/identity/users/{userId}").hasAuthority("admin")
//rest提交方式为PUT，地址为/**/identity/users/{userId}，注意/**/表示在前面匹配任何字符，hasAuthority表示对什么身份开放,{userId}会自动替换
 
@Configuration
@EnableWebSecurity
@EnableWebMvcSecurity
public class SecurityConfiguration
  extends WebSecurityConfigurerAdapter//Spring 安全性管理security
{
  protected static final Logger LOGGER = LoggerFactory.getLogger(SecurityConfiguration.class);
  @Bean
  public AuthenticationProvider authenticationProvider(){
    return new BasicAuthenticationProvider();
  }
   
  protected void configure(HttpSecurity http)
    throws Exception
  {
/*       ((HttpSecurity)((ExpressionUrlAuthorizationConfigurer.AuthorizedUrl)
                ((HttpSecurity)((HttpSecurity)http.authenticationProvider(authenticationProvider())
                        .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and())
                        .csrf().disable())
                        .authorizeRequests()
                        .anyRequest())
                .authenticated().and()).httpBasic();*/
/*更改为*/
          ((HttpSecurity)((ExpressionUrlAuthorizationConfigurer.AuthorizedUrl)
                  ((HttpSecurity)((HttpSecurity)http.authenticationProvider(authenticationProvider())
                      .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and())
                      .csrf().disable())
                      .authorizeRequests()
                      .antMatchers(HttpMethod.PUT,"/**/identity/users/{userId}").hasAuthority("admin")//更新用户
                      .antMatchers(HttpMethod.POST,"/**/identity/users").hasAuthority("admin")//创建用户
                      .antMatchers(HttpMethod.DELETE,"/**/identity/users/{userId}").hasAuthority("admin")//删除用户
                      .antMatchers(HttpMethod.PUT,"/**/identity/users/{userId}/info/{key}").hasAuthority("admin")//更新用户的信息
                      .antMatchers(HttpMethod.POST,"/**/identity/users/{userId}/info").hasAuthority("admin")//创建用户信息条目
                      .antMatchers(HttpMethod.DELETE,"/**/identity/users/{userId}/info/{key}").hasAuthority("admin")//删除用户的信息
                      .antMatchers(HttpMethod.PUT,"/**/identity/groups/{groupId}").hasAuthority("admin")//更新群组
                      .antMatchers(HttpMethod.POST,"/**/identity/groups").hasAuthority("admin")//创建群组
                      .antMatchers(HttpMethod.DELETE,"/**/identity/groups/{groupId}").hasAuthority("admin")//删除群组
                      .antMatchers(HttpMethod.POST,"/**/identity/groups/{groupId}/members").hasAuthority("admin")//为群组添加一个成员
                      .antMatchers(HttpMethod.DELETE,"/**/identity/groups/{groupId}/members/{userId}").hasAuthority("admin")//删除群组的成员
                      .anyRequest())
                      .authenticated().and()).httpBasic();
  }
}

6.然后安装教程activiti-explorer乱码问题的解决，导出class文件进行对源文件的替换即可