姚博文 集成ACEGI 进行权限控制

集成ACEGI 进行权限控制

一. 简单介绍

1.1 本文目的

集成Acegi到自己的项目中, 并且将用户信息和权限放到数据库, 提供方法允许权限动态变化,变化后自动加载最新的权限

本文介绍Acegi例子的时候采用的是acegi-security-samples-tutorial-1.0.6.war

阅读本文需要对Spring有一定的了解, 如果你还没有接触过, 有些地方可能不容易理解, 这时候可能需要参考本文后附的Spring地址, 先了解一下Spring的基本知识.

本文使用的是Mysql数据库, 如果你使用其他的数据库, 可能需要修改相应的SQL.

本文及所附的全部代码放在http://acegi-test.sourceforge.net/

1.2 安装与配置

项目主页: http://www.acegisecurity.org/

下载地址: http://sourceforge.net/project/showfiles.php?group_id=104215

解压文件后, 将acegi-security-samples-tutorial-1.0.6.war复制Your_Tomcat_Path/webapps/

启动Tomcat, 访问http://localhost:8080/acegi-security-samples-tutorial-1.0.6/

点击页面上任何一个链接,都需要用户登录后访问, 可以在页面上看到可用的用户名和密码.

二. 开始集成到自己的程序中

2.1 将用户和角色放在数据库中

可能是为了演示方便, 简单的展示Acegi如何控制权限, 而不依赖于任何数据库, ACEGI给出的例子采用InMemoryDaoImpl获取用户信息, 用户和角色信息放在WEB-INF/users.properties 文件中, InMemoryDaoImpl 一次性的从该配置文件中读出用户和角色信息, 格式是: 用户名=密码, 角色名, 如第一行是:

marissa=koala,ROLE_SUPERVISOR

就是说marissa的密码是koala, 并且他的角色是ROLE_SUPERVISOR

对这个文件的解析是通过applicationContext-acegi-security.xml中如下的设置进行的:

<!-- UserDetailsService is the most commonly frequently Acegi Security interface implemented by end users -->
<bean id="userDetailsService"
class="org.acegisecurity.userdetails.memory.InMemoryDaoImpl">
<property name="userProperties">
<bean
class="org.springframework.beans.factory.config.PropertiesFactoryBean">
<property name="location"
value="classpath:users.properties" />
</bean>
</property>
</bean>

除了InMemoryDaoImpl之外, ACEGI还提供了Jdbc和 ldap的支持, 由于使用数据库进行验证比较常见, 下面仅就jdbc实现做出介绍.

不管是InMemoryDaoImpl还是JdbcDaoImpl都是实现了UserDetailsService接口, 而这个接口里只定义了一个方法: UserDetails loadUserByUsername(String username) 就是根据用户名加载UserDetails对象, UserDetails也是一个接口, 定义了一个用户所需要的基本信息, 包括: username, password, authorities等信息

2.1.1 直接使用JdbcDaoImpl 访问数据库中的用户信息

如果ACEGI提供的信息满足你的需要, 也就是说你只需要用户的username, password等信息, 你可以直接使用ACEGI提供的Schema, 这样, 不需要任何变动, JdbcDaoImpl就可以使用了.

如果你的数据库已经定义好了, 或者不想使用ACEGI提供的Schema,那么你也可以自定义JdbcDaoImpl的查询语句

        <property name="usersByUsernameQuery">
<value>
SELECT email, password, enabled from user u where email = ?
</value>
</property>
<property name="authoritiesByUsernameQuery">
<value>
SELECT u.email, r.role_name FROM user_role ur, user u, role r WHERE
ur.user_id = u.user_id and ur.role_id = r.role_id and u.email = ?
</value>
</property>

2.1.2 扩展JdbcDaoImpl获取更多用户信息

如果上面提到的定制查询SQL语句不能提供足够的灵活性, 那么你可能就需要定义一个JdbcDaoImpl的子类, 如果变动不大, 通过覆盖initMappingSqlQueries方法重新定义MappingSqlQuery的实例. 而如果你需要获取更多信息, 比如userId, companyId等, 那就需要做更多的改动, 第一种改动不大, 所以不具体介绍, 下面以第二种改动为例,介绍如何实现这种需求.

我们需要三张表User, Role, User_Role, 具体的SQL如下:

#

# Structure for the `role` table : 

#



DROP TABLE IF EXISTS `role`;



CREATE TABLE `role` (

`role_id` int(11) NOT NULL auto_increment,

`role_name` varchar(50) default NULL,

`description` varchar(20) default NULL,

`enabled` tinyint(1) NOT NULL default '1',

PRIMARY KEY  (`role_id`)

);



#

# Structure for the `user` table : 

#



DROP TABLE IF EXISTS `user`;



CREATE TABLE `user` (

`user_id` int(11) NOT NULL auto_increment,

`company_id` int(11) default NULL,

`email` varchar(200) default NULL,

`password` varchar(10) default NULL,

`enabled` tinyint(1) default NULL,

PRIMARY KEY  (`user_id`)

);



#

# Structure for the `user_role` table : 

#



DROP TABLE IF EXISTS `user_role`;



CREATE TABLE `user_role` (

`user_role_id` int(11) NOT NULL auto_increment,

`user_id` varchar(50) NOT NULL,

`role_id` int(11) NOT NULL,

PRIMARY KEY  (`user_role_id`)

);

前面讲过, UserDetailsService接口中只定义了一个方法: UserDetails loadUserByUsername(String username), UserDetails中不存在我们需要的userId 和companyId等信息, 所以我们首先需要扩展UserDetails接口, 并扩展org.acegisecurity.userdetails.User:

IUserDetails.java

package org.security;



import org.acegisecurity.GrantedAuthority;



/**
 * The class <code>IUserDetails</code> extends the org.acegisecurity.userdetails.UserDetails interface, and provides additional userId, companyId information<br><br>
 * @author wade
 * @see UserDetails
 */
public interface IUserDetails extends org.acegisecurity.userdetails.UserDetails{



public int getUserId();



public void setUserId(int user_id);



public int getCompanyId();



public void setCompanyId(int company_id);



public String getUsername();



public void setUsername(String username);



public GrantedAuthority[] getAuthorities();



public void setAuthorities(GrantedAuthority[] authorities);

}

UserDetailsImpl.java

package org.security;



import org.acegisecurity.GrantedAuthority;

import org.acegisecurity.userdetails.User;



/**
 * The class <code>UserDetailsImpl</code> extends the org.acegisecurity.userdetails.User class, and provides additional userId, companyId information
 * @author wade
 * 
 * @see IUserDetails, User
 */
public class UserDetailsImpl extends User implements IUserDetails{

private int user_id;

private int company_id;

private String username;

private GrantedAuthority[] authorities;



public UserDetailsImpl(String username, String password, boolean enabled,

boolean accountNonExpired, boolean credentialsNonExpired,

boolean accountNonLocked, GrantedAuthority[] authorities)

throws IllegalArgumentException {

super(username, password, enabled, accountNonExpired, credentialsNonExpired,

accountNonLocked, authorities);

setUsername(username);

setAuthorities(authorities);        

}



public UserDetailsImpl(int userid, int companyid, String username, String password, boolean enabled,

boolean accountNonExpired, boolean credentialsNonExpired,

boolean accountNonLocked, GrantedAuthority[] authorities)

throws IllegalArgumentException {

super(username, password, enabled, accountNonExpired, credentialsNonExpired,

accountNonLocked, authorities);

this.user_id = userid;

this.company_id = companyid;

setUsername(username);

setAuthorities(authorities);    

}



public int getUserId() {

return user_id;

}



public void setUserId(int user_id) {

this.user_id = user_id;

}



public int getCompanyId() {

return company_id;

}



public void setCompanyId(int company_id) {

this.company_id = company_id;

}



public String getUsername() {

return username;

}



public void setUsername(String username) {

this.username = username;

}



public GrantedAuthority[] getAuthorities() {

return authorities;

}



public void setAuthorities(GrantedAuthority[] authorities) {

this.authorities = authorities;

}

}

到此为止, 我们已经准备好了存放用户信息的类, 下面就开始动手修改取用户数据的代码.

假设我们用下面的SQL取用户信息:

SELECT u.user_id, u.company_id, email, password, enabled 

FROM role r, user_role ur, user u 

WHERE r.role_id = ur.role_id 

and ur.user_id = u.user_id 

and email = ? 

limit 1 

用下面的SQL取用户具有的Role列表

SELECT u.email, r.role_name 

FROM user_role ur, user u, role r 

WHERE ur.user_id = u.user_id 

and ur.role_id = r.role_id 

and u.email = ? 

我们需要修改的主要是两部分:

1. 取用户和用户角色的MappingSqlQuery, 增加了查询的userId和companyId.

2. loadUserByUsername方法, 修改了返回的对象类型,和很少的内部代码.

AcegiJdbcDaoImpl.java

package org.security.acegi;



import java.sql.ResultSet;

import java.sql.SQLException;

import java.sql.Types;

import java.util.List;



import javax.sql.DataSource;



import org.acegisecurity.GrantedAuthority;

import org.acegisecurity.GrantedAuthorityImpl;

import org.acegisecurity.userdetails.UsernameNotFoundException;

import org.acegisecurity.userdetails.jdbc.JdbcDaoImpl;



import org.security.IUserDetails;

import org.security.UserDetailsImpl;

import org.springframework.dao.DataAccessException;

import org.springframework.jdbc.core.SqlParameter;

import org.springframework.jdbc.object.MappingSqlQuery;



/**
 * The class AcegiJdbcDaoImpl provides the method to get IUserDetail information from db which contains userId, companyId and UserDetail information.
 * 
 * @author wade
 *
 */
public class AcegiJdbcDaoImpl extends JdbcDaoImpl {

public static final String DEF_USERS_BY_USERNAME_QUERY =

"SELECT u.user_id, u.company_id, email, password, enabled from role r, user_role ur, user u where r.role_id = ur.role_id and ur.user_id = u.user_id and email = ? limit 1";

public static final String DEF_AUTHORITIES_BY_USERNAME_QUERY =

"SELECT username,authority FROM authorities WHERE username = ?";



protected MappingSqlQuery rolesByUsernameMapping;

protected MappingSqlQuery usersByNameMapping;



private String authoritiesByUsernameQuery;

private String rolePrefix = "";

private String usersByUsernameQuery;

private boolean usernameBasedPrimaryKey = true;



public AcegiJdbcDaoImpl(){

usersByUsernameQuery = DEF_USERS_BY_USERNAME_QUERY;

authoritiesByUsernameQuery = DEF_AUTHORITIES_BY_USERNAME_QUERY;

}

public String getAuthoritiesByUsernameQuery() {

return authoritiesByUsernameQuery;

}



public String getRolePrefix() {

return rolePrefix;

}



public String getUsersByUsernameQuery() {

return usersByUsernameQuery;

}



protected void initMappingSqlQueries() {

this.usersByNameMapping = new UsersByUsernameMapping(getDataSource());

this.rolesByUsernameMapping = new AuthoritiesByUsernameMapping(getDataSource());

}



/**
     * Allows the default query string used to retrieve authorities based on username to be overriden, if
     * default table or column names need to be changed. The default query is {@link
     * #DEF_AUTHORITIES_BY_USERNAME_QUERY}; when modifying this query, ensure that all returned columns are mapped
     * back to the same column names as in the default query.
     *
     * @param queryString The query string to set
     */
public void setAuthoritiesByUsernameQuery(String queryString) {

authoritiesByUsernameQuery = queryString;

}



/**
     * Allows a default role prefix to be specified. If this is set to a non-empty value, then it is
     * automatically prepended to any roles read in from the db. This may for example be used to add the
     * <code>ROLE_</code> prefix expected to exist in role names (by default) by some other Acegi Security framework
     * classes, in the case that the prefix is not already present in the db.
     *
     * @param rolePrefix the new prefix
     */
public void setRolePrefix(String rolePrefix) {

this.rolePrefix = rolePrefix;

}



/**
     * If <code>true</code> (the default), indicates the {@link #getUsersByUsernameQuery()} returns a username
     * in response to a query. If <code>false</code>, indicates that a primary key is used instead. If set to
     * <code>true</code>, the class will use the database-derived username in the returned <code>UserDetailsImpl</code>.
     * If <code>false</code>, the class will use the {@link #loadUserByUsername(String)} derived username in the
     * returned <code>UserDetailsImpl</code>.
     *
     * @param usernameBasedPrimaryKey <code>true</code> if the mapping queries return the username <code>String</code>,
     *        or <code>false</code> if the mapping returns a database primary key.
     */
public void setUsernameBasedPrimaryKey(boolean usernameBasedPrimaryKey) {

this.usernameBasedPrimaryKey = usernameBasedPrimaryKey;

}



/**
     * Allows the default query string used to retrieve users based on username to be overriden, if default
     * table or column names need to be changed. The default query is {@link #DEF_USERS_BY_USERNAME_QUERY}; when
     * modifying this query, ensure that all returned columns are mapped back to the same column names as in the
     * default query. If the 'enabled' column does not exist in the source db, a permanent true value for this column
     * may be returned by using a query similar to <br><pre>
     * "SELECT username,password,'true' as enabled FROM users WHERE username = ?"</pre>
     *
     * @param usersByUsernameQueryString The query string to set
     */
public void setUsersByUsernameQuery(String usersByUsernameQueryString) {

this.usersByUsernameQuery = usersByUsernameQueryString;

}



public IUserDetails loadUserByUsername(String username)

throws UsernameNotFoundException, DataAccessException {

List users = usersByNameMapping.execute(username);



if (users.size() == 0) {

throw new UsernameNotFoundException("User not found");

}



IUserDetails user = (IUserDetails) users.get(0); // contains no GrantedAuthority[]
List dbAuths = rolesByUsernameMapping.execute(user.getUsername());
addCustomAuthorities(user.getUsername(), dbAuths);
if (dbAuths.size() == 0) {

throw new UsernameNotFoundException("User has no GrantedAuthority");

}



GrantedAuthority[] arrayAuths = (GrantedAuthority[]) dbAuths.toArray(new GrantedAuthority[dbAuths.size()]);



user.setAuthorities(arrayAuths);



if (!usernameBasedPrimaryKey) {

user.setUsername(username);

}



return user;

}



/**
     * Query object to look up a user's authorities.
     */
protected class AuthoritiesByUsernameMapping extends MappingSqlQuery {

protected AuthoritiesByUsernameMapping(DataSource ds) {

super(ds, authoritiesByUsernameQuery);

declareParameter(new SqlParameter(Types.VARCHAR));

compile();

}



protected Object mapRow(ResultSet rs, int rownum)

throws SQLException {

String roleName = rolePrefix + rs.getString(2);

GrantedAuthorityImpl authority = new GrantedAuthorityImpl(roleName);



return authority;

}

}



/**
     * Query object to look up a user.
     */
protected class UsersByUsernameMapping extends MappingSqlQuery {

protected UsersByUsernameMapping(DataSource ds) {

super(ds, usersByUsernameQuery);

declareParameter(new SqlParameter(Types.VARCHAR));

compile();

}



protected Object mapRow(ResultSet rs, int rownum)

throws SQLException {

int user_id = rs.getInt(1);

int company_id = rs.getInt(2);

String username = rs.getString(3);

String password = rs.getString(4);

boolean enabled = rs.getBoolean(5);



IUserDetails user = new UserDetailsImpl(username, password, enabled, true, true, true,

new GrantedAuthority[] {new GrantedAuthorityImpl("HOLDER")});

user.setUserId(user_id);

user.setCompanyId(company_id);

return user;

}

}

}

修改spring配置, 使用我们新建立的类:

    <bean id="userDetailsService"
class="org.security.acegi.AcegiJdbcDaoImpl">
<property name="dataSource">
<ref bean="dataSource" />
</property>
<property name="usersByUsernameQuery">
<value>
SELECT u.user_id, u.company_id, email, password, enabled
from role r, user_role ur, user u where r.role_id = ur.role_id and ur.user_id = u.user_id
and email = ?
limit 1
</value>
</property>
<property name="authoritiesByUsernameQuery">
<value>
SELECT u.email, r.role_name FROM user_role ur, user u, role r WHERE
ur.user_id = u.user_id and ur.role_id = r.role_id and u.email = ?
</value>
</property>
</bean>

好了, 如果再有用户登录,就会调用我们的loadUserByUsername, 从数据库中读取用户数据了, 那用户的权限都有什么呢? 一个用户又对应着哪些ROLE呢? 下面先讲一下ACEGI 例子中的权限设置

2.2 将权限放在数据库中

截止到1.0.6版, Acegi没有提供直接从数据库读取权限的方法, 而是采用通过如下的配置设置权限:

    <bean id="filterInvocationInterceptor"
class="org.acegisecurity.intercept.web.FilterSecurityInterceptor">
<property name="authenticationManager" ref="authenticationManager" />
<property name="accessDecisionManager">
<bean class="org.acegisecurity.vote.AffirmativeBased">
<property name="allowIfAllAbstainDecisions" value="false" />
<property name="decisionVoters">
<list>
<bean class="org.acegisecurity.vote.RoleVoter" />
<bean class="org.acegisecurity.vote.AuthenticatedVoter" />
</list>
</property>
</bean>
</property>
<property name="objectDefinitionSource">
<value><![CDATA[

CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON

PATTERN_TYPE_APACHE_ANT

/secure/extreme/**=ROLE_SUPERVISOR

/secure/**=IS_AUTHENTICATED_REMEMBERED

/project/**=IS_AUTHENTICATED_REMEMBERED

/task/**=ROLE_DEVELOPER                

/**=IS_AUTHENTICATED_ANONYMOUSLY

]]></value>
</property>
</bean>

而对大部分项目, 将权限放在数据库中可能是更灵活的, 为此, 我们需要写一个类去读取权限, 为了使这个类尽量简单, 我们把它做成PathBasedFilterInvocationDefinitionMap和RegExpBasedFilterInvocationDefinitionMap的代理类, PathBasedFilterInvocationDefinitionMap 采用的是Ant Path 风格的匹配方式, 而RegExpBasedFilterInvocationDefinitionMap采用的是Perl5风格的匹配方式. 用户可以通过在配置文件中设置来选择具体比较方式, 默认的比较方式是Ant Path 风格的匹配方式.

这样我们需要做的就是读取权限列表, 并放到相应的代理类里面, 而具体的比较则由代理类进行.

需要的表结构: Resource, Role_Resource

DROP TABLE IF EXISTS `resource`;



CREATE TABLE `resource` (

`resource_id` int(11) NOT NULL auto_increment,

`parent_resource_id` int(11) default NULL,

`resource_name` varchar(50) default NULL,

`description` varchar(100) default NULL,

PRIMARY KEY  (`resource_id`)

);



#

# Structure for the `resource_role` table : 

#



DROP TABLE IF EXISTS `resource_role`;



CREATE TABLE `resource_role` (

`resource_role_id` int(11) NOT NULL auto_increment,

`resource_id` int(11) NOT NULL,

`role_id` int(11) NOT NULL,

PRIMARY KEY  (`resource_role_id`)

);

添加我们的类:

AcegiJdbcDefinitionSourceImpl.java

package org.security.acegi;



import java.sql.ResultSet;

import java.sql.SQLException;

import java.util.HashMap;

import java.util.Iterator;

import java.util.List;

import java.util.Map;



import javax.sql.DataSource;



import org.acegisecurity.ConfigAttributeDefinition;

import org.acegisecurity.SecurityConfig;

import org.acegisecurity.intercept.web.FilterInvocationDefinitionMap;

import org.acegisecurity.intercept.web.FilterInvocationDefinitionSource;

import org.acegisecurity.intercept.web.PathBasedFilterInvocationDefinitionMap;

import org.acegisecurity.intercept.web.RegExpBasedFilterInvocationDefinitionMap;

import org.apache.commons.logging.Log;

import org.apache.commons.logging.LogFactory;



import org.security.IResourceRole;

import org.security.ResourceRoleImpl;

import org.security.event.IPermissionListener;

import org.security.event.PermissionEventPublisher;



import org.springframework.beans.factory.InitializingBean;

import org.springframework.jdbc.core.support.JdbcDaoSupport;

import org.springframework.jdbc.object.MappingSqlQuery;



/**
 * 
 * The class <code>AcegiJdbcDefinitionSourceImpl</code> is proxy to
 * PathBasedFilterInvocationDefinitionMap or RegExpBasedFilterInvocationDefinitionMap, This class get the permission
 * settings from the database, the default sql script is: SELECT resource, role
 * FROM role_permission, if it doesn't match your needs, changed it in bean
 * setting. <br>
 * 
 * <br>
 * $log___FCKpd___11lt;br>
 * <br>
 * 
 * @author $Author: wade $
 * @see
 */
public class AcegiJdbcDefinitionSourceImpl extends JdbcDaoSupport implements

InitializingBean, FilterInvocationDefinitionSource{

private Log logger = LogFactory.getLog(this.getClass());



public static final String DEF_PERMISSIONS_QUERY = "SELECT resource, role FROM role_permission";



/** The Perl5 expression */
String PERL5_KEY = "PATTERN_TYPE_PERL5";



/** The ant path expression */
String ANT_PATH_KEY = "PATTERN_TYPE_APACHE_ANT";



/* Set default to Ant Path Expression*/
private String resourceExpression = ANT_PATH_KEY;



private boolean convertUrlToLowercaseBeforeComparison = false;



private FilterInvocationDefinitionMap definitionSource = null;



private String permissionsQuery;



private String rolePrefix = "";



public AcegiJdbcDefinitionSourceImpl() {

permissionsQuery = DEF_PERMISSIONS_QUERY;

}



public String getAuthoritiesByUsernameQuery() {

return permissionsQuery;

}



public String getRolePrefix() {

return rolePrefix;

}



/**
     * Allows the default query string used to retrieve permissions to be
     * overriden, if default table or column names need to be changed. The
     * default query is {@link #DEF_PERMISSIONS_QUERY}; when modifying this
     * query, ensure that all returned columns are mapped back to the same
     * column names as in the default query.
     * 
     * @param queryString
     *            The query string to set
     */
public void setPermissionsQuery(String queryString) {

permissionsQuery = queryString;

}



/**
     * Allows a default role prefix to be specified. If this is set to a
     * non-empty value, then it is automatically prepended to any roles read in
     * from the db. This may for example be used to add the <code>ROLE_</code>
     * prefix expected to exist in role names (by default) by some other Acegi
     * Security framework classes, in the case that the prefix is not already
     * present in the db.
     * 
     * @param rolePrefix
     *            the new prefix
     */
public void setRolePrefix(String rolePrefix) {

this.rolePrefix = rolePrefix;

}



/**
     * Init the permission list from db
     * 
     */
protected void initMap() {

// return if we have got the latest permission list
if (definitionSource != null) {

return;

}



logger.debug("getting permissions from db");

if (PERL5_KEY.equals(getResourceExpression())) {

definitionSource = new RegExpBasedFilterInvocationDefinitionMap();

} else if (ANT_PATH_KEY.equals(getResourceExpression())) {

definitionSource = new PathBasedFilterInvocationDefinitionMap();

} else {

throw new IllegalArgumentException("wrong resourceExpression value");

}



definitionSource.setConvertUrlToLowercaseBeforeComparison(isConvertUrlToLowercaseBeforeComparison());



MappingSqlQuery permissionsMapping = new PermissionsMapping(

getDataSource());

List<IResourceRole> resources = permissionsMapping.execute();



Map<String, String> map = new HashMap<String, String>();

for (int i = 0; i < resources.size(); i++) {

ConfigAttributeDefinition defn = new ConfigAttributeDefinition();



String resource = resources.get(i).getResource();

if (map.containsKey(resource)) {

continue;

} else {

map.put(resource, resource);

}



for (int j = i; j < resources.size(); j++) {

IResourceRole resourceRole = resources.get(j);

if (resource.equals(resourceRole.getResource())) {

defn.addConfigAttribute(new SecurityConfig(resourceRole

.getRole()));

// logger.debug("added role: " + resourceRole.getRole());
}
}
definitionSource.addSecureUrl(resources.get(i).getResource(), defn);
// logger.debug("added roles to :" +
// resources.get(i).getResource());
}
}
/**
     * Query object to look up a user's authorities.
     */
protected class PermissionsMapping extends MappingSqlQuery {

protected PermissionsMapping(DataSource ds) {

super(ds, permissionsQuery);

compile();

}



protected IResourceRole mapRow(ResultSet rs, int rownum)

throws SQLException {

String resource = rs.getString(1);

String role = rolePrefix + rs.getString(2);

IResourceRole resourceRole = new ResourceRoleImpl(resource, role);



return resourceRole;

}

}



public ConfigAttributeDefinition getAttributes(Object object)

throws IllegalArgumentException {

initMap();



if (definitionSource instanceof RegExpBasedFilterInvocationDefinitionMap) {

return ((RegExpBasedFilterInvocationDefinitionMap) definitionSource).getAttributes(object);

}else if(definitionSource instanceof PathBasedFilterInvocationDefinitionMap) {

return ((PathBasedFilterInvocationDefinitionMap) definitionSource).getAttributes(object);

}



throw new IllegalStateException("wrong type of " + definitionSource + ", it should be " + RegExpBasedFilterInvocationDefinitionMap.class
+ " or " + PathBasedFilterInvocationDefinitionMap.class); 

}



public Iterator getConfigAttributeDefinitions() {

initMap();

if (definitionSource instanceof RegExpBasedFilterInvocationDefinitionMap) {

return ((RegExpBasedFilterInvocationDefinitionMap) definitionSource).getConfigAttributeDefinitions();

}else if(definitionSource instanceof PathBasedFilterInvocationDefinitionMap) {

return ((PathBasedFilterInvocationDefinitionMap) definitionSource).getConfigAttributeDefinitions();

}



throw new IllegalStateException("wrong type of " + definitionSource + ", it should be " + RegExpBasedFilterInvocationDefinitionMap.class
+ " or " + PathBasedFilterInvocationDefinitionMap.class); 

}



public boolean supports(Class clazz) {

initMap();



if (definitionSource instanceof RegExpBasedFilterInvocationDefinitionMap) {

return ((RegExpBasedFilterInvocationDefinitionMap) definitionSource).supports(clazz);

}else if(definitionSource instanceof PathBasedFilterInvocationDefinitionMap) {

return ((PathBasedFilterInvocationDefinitionMap) definitionSource).supports(clazz);

}



throw new IllegalStateException("wrong type of " + definitionSource + ", it should be " + RegExpBasedFilterInvocationDefinitionMap.class
+ " or " + PathBasedFilterInvocationDefinitionMap.class); 

}





public String getResourceExpression() {

return resourceExpression;

}



public void setResourceExpression(String resourceExpression) {

this.resourceExpression = resourceExpression;

}



public boolean isConvertUrlToLowercaseBeforeComparison() {

return convertUrlToLowercaseBeforeComparison;

}



public void setConvertUrlToLowercaseBeforeComparison(

boolean convertUrlToLowercaseBeforeComparison) {

this.convertUrlToLowercaseBeforeComparison = convertUrlToLowercaseBeforeComparison;

}



}

修改spring配置, 使用我们新建立的类和对应的SQL:

    <bean id="filterInvocationInterceptor"
class="org.acegisecurity.intercept.web.FilterSecurityInterceptor">

<property name="authenticationManager"
ref="authenticationManager" />

<property name="accessDecisionManager">

<bean class="org.acegisecurity.vote.AffirmativeBased">

<property name="allowIfAllAbstainDecisions"
value="false" />

<property name="decisionVoters">

<list>

<bean class="org.acegisecurity.vote.RoleVoter" />

<bean

class="org.acegisecurity.vote.AuthenticatedVoter" />

</list>

</property>

</bean>

</property>



<property name="objectDefinitionSource">

<ref bean="rolePermissionService"/>

</property>

</bean>



<bean id="rolePermissionService"
class="org.security.acegi.AcegiJdbcDefinitionSourceImpl">

<property name="dataSource">

<ref bean="dataSource" />

</property>

<property name="permissionsQuery">

<value>

SELECT resource_name, role_name FROM resource_role rr, resource re, role ro

WHERE rr.role_id = ro.role_id and rr.resource_id = re.resource_id

</value>

</property>

<property name="convertUrlToLowercaseBeforeComparison" value="false"></property>

<property name="resourceExpression" value="PATTERN_TYPE_APACHE_ANT"></property>

</bean>

2.3 使用JUnit进行测试

AcegiPermissionTestCase.java

package org.security;



import java.io.IOException;

import java.util.Iterator;

import java.util.LinkedHashMap;

import java.util.Map;

import java.util.Set;



import javax.servlet.FilterChain;

import javax.servlet.ServletException;

import javax.servlet.ServletRequest;

import javax.servlet.ServletResponse;



import org.acegisecurity.AccessDeniedException;

import org.acegisecurity.Authentication;

import org.acegisecurity.ConfigAttributeDefinition;

import org.acegisecurity.GrantedAuthority;

import org.acegisecurity.GrantedAuthorityImpl;

import org.acegisecurity.intercept.web.FilterInvocation;

import org.acegisecurity.intercept.web.FilterInvocationDefinitionSource;

import org.acegisecurity.intercept.web.FilterSecurityInterceptor;

import org.acegisecurity.providers.UsernamePasswordAuthenticationToken;

import org.springframework.beans.factory.annotation.Autowired;

import org.springframework.mock.web.MockHttpServletRequest;

import org.springframework.mock.web.MockHttpServletResponse;



import org.security.BaseSpringTestCase;

import org.security.IResourceRole;

import org.security.IUserDetails;

import org.security.ResourceRoleImpl;

import org.security.acegi.AcegiJdbcDaoImpl;



/**
 * 
 * The class <code>AcegiPermissionTestCase</code> test acegi permission settings<br><br>
 * $log___FCKpd___13lt;br><br>
 * @author $Author: wade $
 * @version $Revision: 1.0 $
 * @see
 */
public class AcegiPermissionTestCase extends BaseSpringTestCase {

@Autowired

private FilterInvocationDefinitionSource objectDefinitionSource;



@Autowired

private AcegiJdbcDaoImpl userDetailsService;



@Autowired

private FilterSecurityInterceptor filterInvocationInterceptor;



/**
     * Get Authentication Token by username
     * @param username
     * @return Authentication
     */
protected Authentication getAuthentication(String username){

IUserDetails userDetail = userDetailsService.loadUserByUsername(username);

Authentication authenticated;

if(userDetail.isEnabled()){

authenticated = new UsernamePasswordAuthenticationToken(userDetail, username, userDetail.getAuthorities());

}else{

//            authenticated = new AnonymousAuthenticationToken(username, userDetail, userDetail.getAuthorities());
authenticated = new UsernamePasswordAuthenticationToken(null, null, new GrantedAuthority[]{new GrantedAuthorityImpl("ROLE_ANONYMOUS")});

}



return authenticated;

}



/**
     * get FilterInvocation from the url 
     * @param url
     * @return FilterInvocation
     */
protected FilterInvocation getRequestedResource(String url){

MockHttpServletRequest request = new MockHttpServletRequest();

request.setServletPath(url);



MockHttpServletResponse response = new MockHttpServletResponse();

FilterChain filterchain = new FilterChain(){

public void doFilter(ServletRequest arg0, ServletResponse arg1)

throws IOException, ServletException {            

}};



FilterInvocation object = new FilterInvocation(request, response, filterchain);



return object;

}



/**
     * throws AccessDeniedException if no permission 
     * @param username
     * @param uri
     */
public void checkPermission(boolean shouldHasPermission, String username, String url){

Authentication authenticated = getAuthentication(username);

FilterInvocation object = getRequestedResource(url);



ConfigAttributeDefinition attr = objectDefinitionSource.getAttributes(object);

boolean hasPermission = false;



try{

filterInvocationInterceptor.getAccessDecisionManager().decide(authenticated, object, attr);

hasPermission = true;

}catch(AccessDeniedException e){

hasPermission = false;            

}



if(hasPermission){

assertTrue(username + " shouldn't be able to access " + url, shouldHasPermission);    

}else{

assertFalse(username + " should be able to access " + url, shouldHasPermission);    

}

}





public void testPermissionForAdmin(){

Map<IResourceRole, Boolean> map = new LinkedHashMap<IResourceRole, Boolean>();



map.put(new ResourceRoleImpl("/admin/index.jsp", "admin"    ), true);

map.put(new ResourceRoleImpl("/admin/index.jsp", "project"    ), false);

map.put(new ResourceRoleImpl("/admin/index.jsp", "dev"        ), false);

map.put(new ResourceRoleImpl("/admin/index.jsp", "disabled"    ), false);



map.put(new ResourceRoleImpl("/admin", "admin"    ), true);

map.put(new ResourceRoleImpl("/admin", "project"), false);

map.put(new ResourceRoleImpl("/admin", "dev"    ), false);

map.put(new ResourceRoleImpl("/admin", "disabled"), false);



map.put(new ResourceRoleImpl("/project/index.jsp", "admin"    ), true);

map.put(new ResourceRoleImpl("/project/index.jsp", "project"), true);

map.put(new ResourceRoleImpl("/project/index.jsp", "dev"    ), false);

map.put(new ResourceRoleImpl("/project/index.jsp", "disabled"), false);



map.put(new ResourceRoleImpl("/project", "admin"    ), true);

map.put(new ResourceRoleImpl("/project", "project"    ), true);

map.put(new ResourceRoleImpl("/project", "dev"        ), false);

map.put(new ResourceRoleImpl("/project", "disabled"    ), false);



map.put(new ResourceRoleImpl("/developer/index.jsp", "admin"    ), true);

map.put(new ResourceRoleImpl("/developer/index.jsp", "project"    ), true);

map.put(new ResourceRoleImpl("/developer/index.jsp", "dev"        ), true);

map.put(new ResourceRoleImpl("/developer/index.jsp", "disabled"    ), false);



map.put(new ResourceRoleImpl("/developer", "admin"        ), true);

map.put(new ResourceRoleImpl("/developer", "project"    ), true);

map.put(new ResourceRoleImpl("/developer", "dev"        ), true);

map.put(new ResourceRoleImpl("/developer", "disabled"    ), false);



map.put(new ResourceRoleImpl("/index.jsp", "admin"    ), true);

map.put(new ResourceRoleImpl("/index.jsp", "project"), true);

map.put(new ResourceRoleImpl("/index.jsp", "dev"    ), true);

map.put(new ResourceRoleImpl("/index.jsp", "disabled"), true);



map.put(new ResourceRoleImpl("/acegilogin.jsp", "admin"    ), true);

map.put(new ResourceRoleImpl("/acegilogin.jsp", "project"    ), true);

map.put(new ResourceRoleImpl("/acegilogin.jsp", "dev"    ), true);

map.put(new ResourceRoleImpl("/acegilogin.jsp", "disabled"    ), true);



Set<IResourceRole> keySet= map.keySet();

Iterator<IResourceRole> ita = keySet.iterator();

while(ita != null && ita.hasNext()){

IResourceRole resourceRole = ita.next();

boolean expectedPermission = map.get(resourceRole);



checkPermission(expectedPermission, resourceRole.getRole(), resourceRole.getResource());

}            

}

}

三. 集成之后

3.1 更改数据库中的权限

到目前为止, 一切顺利, 但是有一个问题, 用户如何修改权限, 修改后我们写的类如何能知道权限变了, 需要去重新加载呢? 看来我们需要再加一些代码以便于在权限被修改后能够得到消息, 然后去刷新权限.

为此, 我们使用Observe(观察者) 模式, 在改变权限后, 由改变权限的类通过调用PermissionEventPublisher.update(this.getClass())发出消息说权限变了.

IPermissionListener.java

public interface IPermissionListener {

public void updatePermission(Class eventSource);

}

PermissionEventPublisher.java

package org.security.event;



import java.util.HashMap;

import java.util.Iterator;

import java.util.Map;



import org.apache.commons.logging.Log;

import org.apache.commons.logging.LogFactory;





/**
 * The class PermissionEventPublisher provides a way to notify the IPermissionListener that the permission has been changed.
 * @author wade
 *
 */
public class PermissionEventPublisher {

private static Log logger = LogFactory.getLog(PermissionEventPublisher.class);



private static Map<IPermissionListener, IPermissionListener> observerList = 

new HashMap<IPermissionListener, IPermissionListener>();



/**
     * Attach a listener for permission event
     * 
     * @param subject
     * @param listener
     */
public static void attach(IPermissionListener listener){

observerList.put(listener, listener);



if(logger.isDebugEnabled()){

logger.debug("Added listener: " + listener.getClass().getName());

}

}



/**
     * Detatch from the event updater
     * @param listener
     */
public static void detatch(IPermissionListener listener){

observerList.remove(listener);



if(logger.isDebugEnabled()){

logger.debug("Removeded listener: " + listener.getClass().getName());

}

}



/**
     * send message to each listener.
     * @param eventSource
     */
public static void update(Class eventSource){

if(logger.isDebugEnabled()){

logger.debug("permission changed from "+eventSource.getName());

}



Iterator<IPermissionListener> ita = observerList.keySet().iterator();

while(ita.hasNext()){

IPermissionListener permissionListener = ita.next();

permissionListener.updatePermission(eventSource);



if(logger.isDebugEnabled()){

logger.debug("call update for listener=" + permissionListener.getClass().getName());

}

}

}

}

修改AcegiJdbcDefinitionSourceImpl.java, 增加updatePermission方法, 在权限变化后进行处理

public class AcegiJdbcDefinitionSourceImpl extends JdbcDaoSupport implements

InitializingBean, FilterInvocationDefinitionSource, IPermissionListener {



public AcegiJdbcDefinitionSourceImpl() {

permissionsQuery = DEF_PERMISSIONS_QUERY;



//attach to event publisher, so the class can get the notify when permission changes
PermissionEventPublisher.attach(this);

}



/**
     * Set definitionSource to null, so we can get a refreshed permission list from db
     */
public void updatePermission(Class eventSource) {

definitionSource = null;

}

}

3.2 在程序中获取当前用户

直接从Acegi中取用户信息不太方便, 为了简化获取用户的方法, 可以添加一个类封装对应的逻辑, 然后通过CurrentUser.getUser()直接取到用户信息.

CurrentUser.java

/**
     * Get current user which stored in session
     * You must set a user when using junit test
     * @return IUserDetails
     */
public static IUserDetails getUser(){

//if not in unit test environment, get the current user using acegi
if ((SecurityContextHolder.getContext() == null)

|| !(SecurityContextHolder.getContext() instanceof SecurityContext)

|| (((SecurityContext) SecurityContextHolder.getContext())

.getAuthentication() == null)) {

return null;

}



Authentication auth = SecurityContextHolder.getContext().getAuthentication();

if (auth.getPrincipal() == null) {

return null;

}



IUserDetails user = null;

if (auth.getPrincipal() instanceof IUserDetails) {

user = (IUserDetails)auth.getPrincipal(); 

}



return user;

}

3.3 使用Tag来判断用户是否具有某一种Role的权限

有一点一定要注意, 由于Filter的处理有顺序,所以需要将Acegi的Filter放在最前面.

<authz:authorize ifAnyGranted="ROLE_SUPERVISOR, ROLE_ADMINISTRATOR, ROLE_FULLACCESS">

Role in ROLE_SUPERVISOR, ROLE_ADMINISTRATOR, ROLE_FULLACCESS

</authz:authorize>

3.4 添加自己的Tag

Acegi 提供的Tag只能判断当前用户是不是具有某种Role, 不能判断当前用户对某一个URL有没有权限, 由于很多时候需要根据当前用户的权限来控制某些功能是否显示, 比如只有管理员才显示Add或Delete按钮

这是你可以自己写自己的Tag, 为了简单起见, 我们继承jstl的Tag, 比如下面实现两个条件的Tag, Tag的用法如下:

<auth:ifNotAuthrized url="/system/acl.action">如果当前用户没有指定url的权限,显示本部分内容</auth:ifNotAuthrized>

<auth:ifAuthrized url="/system/acl.action">如果当前用户有指定url的权限,显示本部分内容</auth:ifAuthrized>

AuthorizedTag.java

public class AuthorizedTag extends ConditionalTagSupport {

protected Log logger = LogFactory.getLog(this.getClass());



@Autowired

private FilterInvocationDefinitionSource objectDefinitionSource;



@Autowired    

private FilterSecurityInterceptor filterInvocationInterceptor;



private String url;



/**
     * Get Authentication Token from  IUserDetails object
     * @param user
     * @return Authentication
     */
protected Authentication getAuthentication(IUserDetails user){

IUserDetails userDetail = user;

Authentication authenticated;



if(userDetail == null){

authenticated = new UsernamePasswordAuthenticationToken(null, null, new GrantedAuthority[]{new GrantedAuthorityImpl("ROLE_ANONYMOUS")});            

}else{

if(userDetail.isEnabled()){

authenticated = new UsernamePasswordAuthenticationToken(userDetail, userDetail.getUsername(), userDetail.getAuthorities());

}else{

authenticated = new AnonymousAuthenticationToken(userDetail.getUsername(), userDetail, userDetail.getAuthorities());

}

}



return authenticated;

}    



/**
     * get FilterInvocation from the url 
     * @param url
     * @return FilterInvocation
     */
protected FilterInvocation getRequestedResource(String url){

MockHttpServletRequest request = new MockHttpServletRequest(pageContext.getServletContext());

request.setServletPath(url);



FilterChain filterchain = new FilterChain(){

public void doFilter(ServletRequest arg0, ServletResponse arg1)

throws IOException, ServletException {            

}};



FilterInvocation object = new FilterInvocation(request, pageContext.getResponse(), filterchain);



return object;

}



@Override

protected boolean condition() throws JspTagException {

boolean result = false;



IUserDetails user = CurrentUser.getUser();



ServletContext servletContext = pageContext.getServletContext();        

WebApplicationContext wac = WebApplicationContextUtils.getRequiredWebApplicationContext(servletContext);

wac.getAutowireCapableBeanFactory().autowireBeanProperties(this, AutowireCapableBeanFactory.AUTOWIRE_BY_TYPE, false);



ConfigAttributeDefinition attr = objectDefinitionSource.getAttributes(getRequestedResource(url));        

try{

filterInvocationInterceptor.getAccessDecisionManager().decide(getAuthentication(user), url, attr);

result = true;

}catch(AccessDeniedException e){

result = false;

if(user == null){

logger.debug("anonymous has no permission on :" + url);

}else{

logger.debug(user.getUsername() + " has no permission on :" + url);

}

}



return result;

}



public String getUrl() {

return url;

}



public void setUrl(String url) {

this.url = url;

}



}

添加Jsp页面测试新添加的Tag, 在文所附的例子程序中, 将Tag的测试代码放在index.jsp页面中, 任何人都可以访问该页面, 在页面上列出了全部地址的链接, 同时列出了当前用户有权限的地址, 这样可以方便地知道当前用户有哪些权限, 如果你想修改数据库中的权限, 然后再次测试, 可以点击页面右上侧的Reload Permission重新从数据库加载权限.

<auth:ifAuthrized url="/admin">
<p><a href="admin">Admin page</a></p>
</auth:ifAuthrized>

四. 参考文档

1. 更多深入介绍,可以根据Acegi官方提供的Suggested Steps (http://www.acegisecurity.org/suggested.html) 一步一步学习.

2. 如果要了解Acegi提供的各种功能, 可以参考http://www.acegisecurity.org/reference.html

3. 阅读本文需要对Spring有一定的了解, http://www.springframework.org/documentation

4. 扩展jstl的tag, 可以参看http://www.onjava.com/pub/a/onjava/2002/10/30/jstl3.html?page=1

5. 从https://sourceforge.net/project/platformdownload.php?group_id=216220下载本文附带的例子代码, 通过acegi.sql建立数据库, 然后将acegi-test.war放到Tomcat的webapps目录下, 或者你可以下载acegi-test.zip文件, 里面包含了完整的eclipse的项目以及sql文件.

访问http://youip:port/acegi-test, 列出全部地址的链接, 同时列出了当前用户有权限的地址链接