acegi安全系统标准配置指南草案

一、在web.xml中配置acegi的Filter二、新建一个spring的配置文件applicationContext-security.xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE beans PUBLIC "-//SPRING//DTD BEAN//EN"
    "http://www.springframework.org/dtd/spring-beans.dtd">

<beans>
</beans>

添加filterChainProxy,主要是来设置URL的过滤与Acegi的Filter的关联,可以使用正则表达式

<bean id="filterChainProxy" class="net.sf.acegisecurity.util.FilterChainProxy">
      <property name="filterInvocationDefinitionSource">
           <value>
                CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON
                PATTERN_TYPE_APACHE_ANT
                /j_security_check*=httpSessionContextIntegrationFilter,authenticationProcessingFilter
          /**/*.html*=httpSessionContextIntegrationFilter,anonymousProcessingFilter,securityEnforcementFilter
                /**/*.jsp*=httpSessionContextIntegrationFilter,securityEnforcementFilter
            </value>
      </property>
 </bean>

添加filterInvocationInterceptor,主要对URL和role直接的对应，可以使用正则表达式

<bean id="filterInvocationInterceptor" class="net.sf.acegisecurity.intercept.web.FilterSecurityInterceptor">
        <property name="authenticationManager"><ref local="authenticationManager"/></property>
        <property name="accessDecisionManager"><ref local="accessDecisionManager"/></property>
         <property name="objectDefinitionSource">
            <value>
                CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON
                PATTERN_TYPE_APACHE_ANT
                /signup.html=ROLE_ANONYMOUS,admin,tomcat
                /passwordhint.html*=ROLE_ANONYMOUS,admin,tomcat
                /**/*.html*=admin,tomcat
                /clickstreams.jsp=admin
            </value>
        </property>
    </bean>

添加authenticationManager

    <bean id="authenticationManager" class="net.sf.acegisecurity.providers.ProviderManager">
        <property name="providers">
            <list>
                <ref local="daoAuthenticationProvider"/>
                <ref local="anonymousAuthenticationProvider"/>
            </list>
        </property>
    </bean>

添加loggerListener

<bean id="loggerListener" class="net.sf.acegisecurity.providers.dao.event.LoggerListener"/>

添加daoAuthenticationProvider

    <bean id="daoAuthenticationProvider" class="net.sf.acegisecurity.providers.dao.DaoAuthenticationProvider">
         <property name="authenticationDao"><ref local="jdbcAuthenticationDao"/></property>
         <property name="userCache"><ref local="userCache"/></property>
    </bean>

添加jdbcAuthenticationDao,从数据库中查询出用户信息和用户权限信息

    <bean id="jdbcAuthenticationDao" class="net.sf.acegisecurity.providers.dao.jdbc.JdbcDaoImpl">
        <property name="dataSource"><ref bean="dataSource"/></property>
        <property name="usersByUsernameQuery">
            <value>SELECT username,password,enabled FROM app_user WHERE username = ?</value>
        </property>
        <property name="authoritiesByUsernameQuery">
            <value>SELECT username,role_name FROM user_role WHERE username = ?</value>
        </property>
    </bean>

添加userCache,添加缓存机制

    <bean id="userCache" class="net.sf.acegisecurity.providers.dao.cache.EhCacheBasedUserCache">
        <property name="cache">
            <bean class="org.springframework.cache.ehcache.EhCacheFactoryBean">
                <property name="cacheManager">
                    <bean class="org.springframework.cache.ehcache.EhCacheManagerFactoryBean"/>
                </property>
                <property name="cacheName"><value>userCache</value></property>
            </bean>
        </property>
    </bean>

添加anonymousAuthenticationProvider,添加匿名用户的Bean

    <bean id="anonymousAuthenticationProvider" class="net.sf.acegisecurity.providers.anonymous.AnonymousAuthenticationProvider">
        <property name="key"><value>anonymous</value></property>
    </bean>

添加投票策略

    <bean id="roleVoter" class="net.sf.acegisecurity.vote.RoleVoter">
        <property name="rolePrefix"><value/></property>
    </bean>

   <bean id="accessDecisionManager" class="net.sf.acegisecurity.vote.AffirmativeBased">
        <property name="allowIfAllAbstainDecisions"><value>false</value></property>
        <property name="decisionVoters">
            <list>
                <ref local="roleVoter"/>
            </list>
        </property>
    </bean> 

开始http请求的安全配置

<bean id="httpSessionContextIntegrationFilter" class="net.sf.acegisecurity.context.HttpSessionContextIntegrationFilter">
        <property name="context"><value>net.sf.acegisecurity.context.security.SecureContextImpl</value></property>
    </bean>

    <bean id="authenticationProcessingFilter" class="net.sf.acegisecurity.ui.webapp.AuthenticationProcessingFilter">
        <property name="authenticationManager"><ref local="authenticationManager"/></property>
        <property name="authenticationFailureUrl"><value>/login.jsp?error=true</value></property>
        <property name="defaultTargetUrl"><value>/</value></property>
        <property name="filterProcessesUrl"><value>/j_security_check</value></property>
    </bean>

    <bean id="anonymousProcessingFilter" class="net.sf.acegisecurity.providers.anonymous.AnonymousProcessingFilter">
        <property name="key"><value>anonymous</value></property>
        <property name="userAttribute"><value>anonymous,ROLE_ANONYMOUS</value></property>
    </bean>

    <bean id="securityEnforcementFilter" class="net.sf.acegisecurity.intercept.web.SecurityEnforcementFilter">
        <property name="filterSecurityInterceptor"><ref local="filterInvocationInterceptor"/></property>
        <property name="authenticationEntryPoint"><ref local="authenticationProcessingFilterEntryPoint"/></property>
    </bean>

    <bean id="authenticationProcessingFilterEntryPoint" class="net.sf.acegisecurity.ui.webapp.AuthenticationProcessingFilterEntryPoint">
        <property name="loginFormUrl"><value>/login.jsp</value></property>
        <property name="forceHttps"><value>false</value></property>
    </bean>

 

<filter>
        <filter-name>securityFilter</filter-name>
        <filter-class>net.sf.acegisecurity.util.FilterToBeanProxy</filter-class>
        <init-param>
            <param-name>targetClass</param-name>
            <param-value>net.sf.acegisecurity.util.FilterChainProxy</param-value>
        </init-param>
</filter>
<filter-mapping>
        <filter-name>securityFilter</filter-name>
        <url-pattern>/*</url-pattern>
</filter-mapping>