spring-security3 配置和使用-优快云博客

本文详细介绍了如何在 Spring 应用中配置 Spring Security 来实现用户认证与授权功能，包括 web.xml 和 application-security.xml 的具体配置方法。通过示例展示了如何设置登录页面、拦截 URL 访问、管理 session 以及配置权限。

web.xml配置

<context-param>

<param-name>contextConfigLocation</param-name>
<param-value>classpath*:applicationContext-*.xml</param-value>
</context-param>
<filter>
<filter-name>springSecurityFilterChain</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>

</filter>

<filter-mapping>
<filter-name>springSecurityFilterChain</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>

application-security.xml配置

<?xmlversion="1.0"encoding="UTF-8"?>
<beans:beansxmlns="http://www.springframework.org/schema/security"
xmlns:beans="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
http://www.springframework.org/schema/security
http://www.springframework.org/schema/security/spring-security-3.0.xsd">
<!--auto-config=true则使用from-login.如果不使用该属性则默认为http-basic(没有session).
access-denied-page:出错后跳转到的错误页面;
-->
<httpauto-config="true"access-denied-page="/common/403.jsp">
<!--intercept-url:拦截器,可以设定哪些路径需要哪些权限来访问.filters=none不使用过滤,也可以理解为忽略
只有ROLE_USER角色的用户才能访问 -->
<intercept-urlpattern="/index.jsp"access="ROLE_USER"/>
<intercept-urlpattern="/login.jsp"filters="none"/>
<intercept-urlpattern="/common/**"filters="none"/>
<intercept-urlpattern="/script/**"filters="none"/>
<intercept-urlpattern="/admin.jsp"access="ROLE_ADMIN"/>
<intercept-urlpattern="/user.jsp"access="ROLE_USER"/>
<!--id登陆唯一.后登陆的账号会挤掉第一次登陆的账号error-if-maximum-exceeded="true"禁止2次登陆;
session-fixation-protection="none"防止伪造sessionid攻击.用户登录成功后会销毁用户当前的session.
创建新的session,并把用户信息复制到新session中.
-->
<session-managementsession-fixation-protection="none">
<concurrency-control/>
</session-management>
<form-loginlogin-page="/login.jsp"
authentication-failure-url="/common/403.jsp"
default-target-url="/admin.jsp"/>
<logoutlogout-success-url="/login.jsp"/>
<http-basic/>
</http>
<authentication-manager>
<authentication-provider>
<password-encoderhash="md5">
<salt-sourceuser-property="username"/>
</password-encoder>
-->
<jdbc-user-servicedata-source-ref="dataSource"
users-by-username-query="selectusername,password,enabledfromuserwhereusername=?andenabled=1"
authorities-by-username-query="selectu.username,r.namefromuserujoinuser_roleuronu.uid=ur.uidjoinroleronr.rid=ur.ridwhereu.username=?"/>
<!--
使用固定的用户名和密码及权限来做验证.
<user-service>
<username="admin"password="admin"authorities="ROLE_USER,ROLE_ADMIN"/>
<username="user"password="user"authorities="ROLE_USER"/>
</user-service>
-->
</authentication-provider>
</authentication-manager>
防止一个用户重复登录好几次-第二次登录会让第一次登录失效。通常我们更想防止第二次登录，这时候我们可以使用
```
    <session-management>
        <concurrency-control max-sessions="1" error-if-maximum-exceeded="true" />
    </session-management>     
```
</beans:beans>

获取当前用户信息

Object principal = SecurityContextHolder.getContext().getAuthentication().getPrincipal();

if (principal instanceof UserDetails) {
  String username = ((UserDetails)principal).getUsername();
} else {
  String username = principal.toString();
}

登陆后操作

public class AuthenticationSuccessHandler extendsSavedRequestAwareAuthenticationSuccessHandler {

登陆是操作(如添加验证码)

public class validateCodeUsernamePasswordAuthenticationFilter extends UsernamePasswordAuthenticationFilter{