Spring Security学习（三）授权管理器

在第一篇的授权部分，有分析到

授权主要由AbstractSecurityInterceptor及其子类完成

具体到实际代码中其实是

			// 用户通过了认证，基于当前用户信息，和目标对象的安全属性配置，进行相应的权限检查
			this.accessDecisionManager.decide(authenticated, object, attributes);

AccessDecisionManager

AccessDecisionManager 是一个决策管理器接口，主要有下面三个方法：

void decide(Authentication authentication, Object object,
			Collection<ConfigAttribute> configAttributes) throws AccessDeniedException,
			InsufficientAuthenticationException;

该方法是投票过程, 有三个参数 :

1. Authentication authentication代表访问者当事人,是访问者的认证令牌,包含了访问者的权限
2. Object object表示目标安全对象
3. Collection<ConfigAttribute> configAttributes表示访问目标安全对象所需要的权限

boolean supports(ConfigAttribute attribute);

该方法用于检测ConfigAttribute attribute是否是当前 AccessDecisionManager 支持的 ConfigAttribute 类型。

boolean supports(Class<?> clazz);

检测Class clazz是否是当前 AccessDecisionManager 支持的安全对象。

AccessDecisionManager 实现

Spring Security内置的 AccessDecisionManager 的实现是抽象类 AbstractAccessDecisionManager

public abstract class AbstractAccessDecisionManager implements AccessDecisionManager,
		InitializingBean, MessageSourceAware {
   
   
		
	protected final Log logger = LogFactory.getLog(getClass());

	// 通过这一组AccessDecisionVoter来投票表决完成授权
	private List<AccessDecisionVoter<?>> decisionVoters;

	protected MessageSourceAccessor messages = SpringSecurityMessageSource.getAccessor();

	private boolean allowIfAllAbstainDecisions = false;

	protected AbstractAccessDecisionManager(
			List<AccessDecisionVoter<?>> decisionVoters) {
   
   
		Assert.notEmpty(decisionVoters, "A list of AccessDecisionVoters is required");
		this.decisionVoters = decisionVoters;
	}
	
	public void afterPropertiesSet() {
   
   
		Assert.notEmpty(this.decisionVoters, "A list of AccessDecisionVoters is required");
		Assert.notNull(this.messages, "A message source must be set");
	}

	protected final void checkAllowIfAllAbstainDecisions() {
   
   
		if (!this.isAllowIfAllAbstainDecisions()) {
   
   
			throw new AccessDeniedException(messages.getMessage(
					"AbstractAccessDecisionManager.accessDenied", "Access is denied"));
		}
	}

	public List<AccessDecisionVoter<?>> getDecisionVoters() {
   
   
		return this.decisionVoters;
	}

	public boolean isAllowIfAllAbstainDecisions() {
   
   
		return allowIfAllAbstainDecisions;
	}

	public void setAllowIfAllAbstainDecisions(boolean allowIfAllAbstainDecisions) {
   
   
		this.allowIfAllAbstainDecisions = allowIfAllAbstainDecisions;
	}

	public void setMessageSource(MessageSource messageSource) {
   
   
		this.messages = new MessageSourceAccessor(messageSource);
	}

	public boolean supports(ConfigAttribute attribute) {
   
   
		for (AccessDecisionVoter voter : this.decisionVoters) {
   
   // 只要有一个匹配，返回true
			if (voter.supports(attribute)) {