实现自己的AuthenticationProcessingFilter:
package com.radicasys.lm.filter;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import org.acegisecurity.Authentication;
import org.acegisecurity.AuthenticationException;
import org.acegisecurity.providers.UsernamePasswordAuthenticationToken;
import org.acegisecurity.ui.AbstractProcessingFilter;
public class MyAuthenticationProcessingFilter extends AbstractProcessingFilter {
public static final String ACEGI_SECURITY_FORM_USERNAME_KEY = "j_username";
public static final String ACEGI_SECURITY_FORM_PASSWORD_KEY = "j_password";
public static final String ACEGI_SECURITY_LAST_USERNAME_KEY = "ACEGI_SECURITY_LAST_USERNAME";
public static final String ACEGI_SECURITY_CURRENTUSERGROUP = "currenGroup";
public static final String ACEGI_SECURITY_USERNAME_KEY = "ACEGI_SECURITY_USERNAME";
//~ Methods ========================================================================================================
public Authentication attemptAuthentication(HttpServletRequest request)
throws AuthenticationException {
String username = obtainUsername(request);
String password = obtainPassword(request);
String currentGroup = obtainCurrentGroup(request);
if (username == null) {
username = "";
}
if (password == null) {
password = "";
}
request.getSession().setAttribute(ACEGI_SECURITY_USERNAME_KEY, username);
username = username.trim()+"_"+currentGroup.trim();
UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(username, password);
// Place the last username attempted into HttpSession for views
request.getSession().setAttribute(ACEGI_SECURITY_LAST_USERNAME_KEY, username);
//set currentGroup to HttpSession
request.getSession().setAttribute(ACEGI_SECURITY_CURRENTUSERGROUP, currentGroup.trim());
// Allow subclasses to set the "details" property
setDetails(request, authRequest);
return this.getAuthenticationManager().authenticate(authRequest);
}
/**
* This filter by default responds to <code>/j_acegi_security_check</code>.
*
* @return the default
*/
public String getDefaultFilterProcessesUrl() {
return "/j_acegi_security_check";
}
public void init(FilterConfig filterConfig) throws ServletException {}
/**
* Enables subclasses to override the composition of the password, such as by including additional values
* and a separator.<p>This might be used for example if a postcode/zipcode was required in addition to the
* password. A delimiter such as a pipe (|) should be used to separate the password and extended value(s). The
* <code>AuthenticationDao</code> will need to generate the expected password in a corresponding manner.</p>
*
* @param request so that request attributes can be retrieved
*
* @return the password that will be presented in the <code>Authentication</code> request token to the
* <code>AuthenticationManager</code>
*/
protected String obtainPassword(HttpServletRequest request) {
return request.getParameter(ACEGI_SECURITY_FORM_PASSWORD_KEY);
}
/**
* Enables subclasses to override the composition of the username, such as by including additional values
* and a separator.
*
* @param request so that request attributes can be retrieved
*
* @return the username that will be presented in the <code>Authentication</code> request token to the
* <code>AuthenticationManager</code>
*/
protected String obtainUsername(HttpServletRequest request) {
return request.getParameter(ACEGI_SECURITY_FORM_USERNAME_KEY);
}
protected String obtainCurrentGroup(HttpServletRequest request){
return request.getParameter(ACEGI_SECURITY_CURRENTUSERGROUP);
}
/**
* Provided so that subclasses may configure what is put into the authentication request's details
* property.
*
* @param request that an authentication request is being created for
* @param authRequest the authentication request object that should have its details set
*/
protected void setDetails(HttpServletRequest request, UsernamePasswordAuthenticationToken authRequest) {
authRequest.setDetails(authenticationDetailsSource.buildDetails(request));
}
}
在user model里面:
public class User implements UserDetails {
private Set<Role> roles = new HashSet<Role>();
@Transient
public GrantedAuthority[] getAuthorities() {
return roles.toArray(new GrantedAuthority[0]);
}
}
在UserDaoHibernate里面:
@SuppressWarnings("unchecked")
public UserDetails loadUserByUsername(String username)
throws UsernameNotFoundException {
List<User> users = getHibernateTemplate().find(
"from User where email=?", username);
if (users == null || users.isEmpty()) {
throw new UsernameNotFoundException("user '" + username
+ "' not found...");
}
else if(!users.get(0).isEnabled()){
throw new DisabledException("user " + username
+ " suspended...");
}
else {
return (UserDetails) users.get(0);
}
}
分享到:
相关推荐
acegi配置文件清单
被解剖的acegi配置文件. 博文链接:https://rmn190.iteye.com/blog/175041
Acegi配置.mhtAcegi配置的相关配置的信息在里面有一些
Acegi配置指南[整理].pdf
acegi实例,acegi详细配置和代码实现
jar包 博文链接:https://fengzgxing.iteye.com/blog/248761
<br>真正高效的acegi权限配置,有效为你节省大量时间,因为你不需要再花费大量时间耗费在网络上查找“关于acegi的配置”; <br>acegi中高级配置在后文将陆续推出,敬请时刻关注; <br>下载资源仅需4分,相信你...
CAS及客户端Acegi的安装配置指南 CAS及客户端Acegi的安装配置指南
如何定义spring security的安全认证框架,对url和系统类method进行过滤以及权限分配和控制
Acegi是基于Spring Web应用的安全框架,即是“声明式”的访问安全控制的解决方案,用户基本上不需编写代码而仅通过配置就可以实施应用系统的安全。
acegi在spring中的完整配置 spring与acegi的结合
详解acegi的实现方法,附有acegi的解释说明,不过是英文版的,请下载之前考虑好哦
acegi配置,让你更好的合理的了解acegi是什么
Acegi是大明鼎鼎都开源权限控制框架,权限Acegi的使用文档,帮助你在应用系统中配置权限.
-- ========= Acegi as a CAS Client的配置============= --> class="org.acegisecurity.ui.cas.CasProcessingFilter"> ref="authenticationManager" /> value="/login.do?login_error=1" /> ...
Acegi是一个专门为SpringFramework应用提供安全机制的开放源代码项目,全称为Acegi Security System for ...通过这个例子详细介绍如何配置Acegi的各个组件,同时介绍如何扩展Acegi 使其能够从数据库中读取配置信息。