自定义授权（accessDecisionManager）

最新推荐文章于 2024-05-06 16:09:45 发布

lianghyan

最新推荐文章于 2024-05-06 16:09:45 发布

阅读量1w

点赞数 3

分类专栏： Spring security 文章标签： class bean authentication security list access

本文链接：https://blog.youkuaiyun.com/lianghyan/article/details/6308683

版权

Spring security 专栏收录该内容

3 篇文章

订阅专栏

xml配置：

<global-method-security access-decision-manager-ref="accessDecisionManager"/>
    <http pattern="/loggedout.jsp" security="none"/>
    <http pattern="/login.jsp" security="none"/>

    <http auto-config="true" access-decision-manager-ref="accessDecisionManager">
         <intercept-url pattern="/**" access="permitAll" />
        <form-login login-page="/login.jsp" authentication-failure-url="/login.jsp?login_error=1"
        default-target-url="/listAccounts.html"/>
        <http-basic/>
        <logout logout-success-url="/loggedout.jsp" delete-cookies="JSESSIONID"/>
        <remember-me />

        <session-management invalid-session-url="/timeout.jsp">
            <concurrency-control max-sessions="1" error-if-maximum-exceeded="true" />
        </session-management>
    </http>

<beans:bean id="accessDecisionManager" class="org.springframework.security.access.vote.AffirmativeBased">
   <beans:property name="allowIfAllAbstainDecisions" value="false"/>
   <beans:property name="decisionVoters">
     <beans:list>
       <beans:bean class="net.mantis.security.auth.DatabaseRoleVoter"/>
       <beans:bean class="org.springframework.security.access.vote.AuthenticatedVoter"/>
     </beans:list>
   </beans:property>
</beans:bean>

java code: DatabaseRoleVoter

public class DatabaseRoleVoter implements AccessDecisionVoter {
     @Override
    public boolean supports(ConfigAttribute arg0) {
        System.out.println(this.getClass().getName()
                + ".supports(ConfigAttribute arg0)");
        return true;
    }

    @Override
    public boolean supports(Class arg0) {
        System.out.println(this.getClass().getName() + ".supports(Class arg0)");
        return true;
    }

    @Override
    public int vote(Authentication au, Object arg1, Collection arg2) {
        int result = 0;
        String name = au.getName();
        if (name.equalsIgnoreCase("Rod")) {
            result = 1;
        } else {
            result = -1;
        }
        System.out.println(this.getClass().getName() + ".vote");
        System.out.println(arg1);
        System.out.println(arg2);
        return result;
    }
}