使用acegi控制用户权限实例

acegi权限控制：
1.配置authenticationProcessingFilter的登陆url: <property name="filterProcessesUrl" value="/login.do"/>
2.UserDetailsServiceImpl.loadUserByUsername(username)   与登陆页面的<input name="j_username"/> 一致
<input name="j_password"/>
username 来自于j_username

<form id="loginForm"  method="post" action="<c:url value="/j_acegi_security_check"/>">

密码错误，进不去系统
官码正确，
3.DaoAuthenticationProvider.retrieveUser
4.ProviderManager.doAuthentication
5.FilterChainProxy.doFilter
6.模式是否正确： ant  /pages/**、/user/*.do、/**、/login.do、/user/*.do
           Exp 
          
页面跳转：
1.tomcat启动，初始化 ：UrlFilterInvocationDefinitionSource
2.j_acegi_security_check
3.UrlFilterInvocationDefinitionSource 这个类初始化所有角色
4. UserDetailsServiceImpl 初始化某用户所属角色
5.如果有login.do权限，正常跳转，否则accessDenied.jsp
org.acegisecurity.providers.encoding.PlaintextPasswordEncoder: 明码
org.acegisecurity.providers.encoding.Md5PasswordEncoder： md5

似乎没有用到缓存？

如果没有权限，将跳转到accessDenied.jsp，注意相同的url覆盖权限
configDefinition = new ConfigAttributeDefinition();
configDefinition.addConfigAttribute(new SecurityConfig("ROLE_ANONYMOUS"));//匿名用户能访问的页面
configDefinition.addConfigAttribute(new SecurityConfig("ROLE_USER"));
map.addSecureUrl("/pages/login.jsp*", configDefinition);

SecurityContext安全上下文
SecurityContext securityContext = SecurityContextHolder.getContext();
SecurityContext中保存着实现了Authentication 接口的对象，如果用户尚未通过
认证，那么SecurityContext.getAuthenticaiton()方法就会返回null。
  注意，如果使用了匿名用户，SecurityContext.getAuthenticaiton()返回的不是null.
  只有在未启用过滤器链的情况下，SecurityContext.getAuthenticaiton()才返回空。

 

applicationContext.xml

<!-- acegi start-->
 
 <!-- Ehcache与spring整合 -->
 <bean id="ehCacheManager" class="org.springframework.cache.ehcache.EhCacheManagerFactoryBean" p:shared="true">
  <property name="configLocation" value="classpath:ehcache.xml" />
 </bean>
 
 <bean id="acegiCache" class="org.acegisecurity.providers.dao.cache.EhCacheBasedUserCache">
   <property name="cache">
     <bean class="org.springframework.cache.ehcache.EhCacheFactoryBean">
      <property name="cacheManager">
       <ref bean="ehCacheManager"/>
                        </property>       
      <property name="cacheName" value="userAuthCache"/>
     </bean>
        </property>
 </bean>
 
 <bean id="userDetailsService" class="cn.util.UserDetailsServiceImpl">
      <property name="userService" ref="userService"/>
 </bean>
 
 <bean id="daoAuthenticationProvider" class="org.acegisecurity.providers.dao.DaoAuthenticationProvider">
     <property name="userDetailsService" ref="userDetailsService"/>
     <property name="passwordEncoder">
   <!--    <bean class="org.acegisecurity.providers.encoding.Md5PasswordEncoder"></bean>  PlaintextPasswordEncoder:不加密-->
       <bean class="org.acegisecurity.providers.encoding.PlaintextPasswordEncoder">
        <property name="ignorePasswordCase" value="true"></property>
       </bean>
     </property>
 </bean>
    
 <bean id="authenticationManager" class="org.acegisecurity.providers.ProviderManager">
  <property name="providers">
   <list>
    <ref bean="daoAuthenticationProvider"/>
    <bean class="org.acegisecurity.providers.anonymous.AnonymousAuthenticationProvider">
     <property name="key" value="changeThis"/>
    </bean>
<!--     <bean class="org.acegisecurity.providers.rememberme.RememberMeAuthenticationProvider"> -->
<!--      <property name="key" value="changeThis"/> -->
<!--     </bean> -->
   </list>
  </property>
 </bean>
 
 <bean id="filterInvocationInterceptor" class="org.acegisecurity.intercept.web.FilterSecurityInterceptor">
  <property name="authenticationManager" ref="authenticationManager"/>
  <property name="accessDecisionManager">
   <bean class="org.acegisecurity.vote.AffirmativeBased">
    <property name="allowIfAllAbstainDecisions" value="false"/>
    <property name="decisionVoters">
     <list>
      <bean class="org.acegisecurity.vote.RoleVoter">
      </bean>
      <bean class="org.acegisecurity.vote.AuthenticatedVoter"/>
     </list>
    </property>
   </bean>
  </property>
  
  <property name="objectDefinitionSource" ref="filterInvocationDefinitionSource">  
   <!--value>
    CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON
    /login.jsp=ROLE_ANONYMOUS
    /.*=ROLE_USER
   </value-->
  </property>
 </bean> 
 
 <bean id="filterInvocationDefinitionSource" class="cn.util.UrlFilterInvocationDefinitionSource">
  <property name="roleService" ref="roleService"/>
 </bean> 
 
 <!-- httpSessionContextIntegrationFilter,logoutFilter,authenticationProcessingFilter,securityContextHolderAwareRequestFilter,rememberMeProcessingFilter,anonymousProcessingFilter,exceptionTranslationFilter,filterInvocationInterceptor -->
  <bean id="filterChainProxy" class="org.acegisecurity.util.FilterChainProxy"> 
        <property name="filterInvocationDefinitionSource"> 
            <value> 
            CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON  
            PATTERN_TYPE_APACHE_ANT  
            /**=httpSessionContextIntegrationFilter,logoutFilter,authenticationProcessingFilter,securityContextHolderAwareRequestFilter,anonymousProcessingFilter,exceptionTranslationFilter,filterInvocationInterceptor  
         </value> 
        </property> 
    </bean>
 
 <bean id="httpSessionContextIntegrationFilter" class="org.acegisecurity.context.HttpSessionContextIntegrationFilter"/>
 
 <bean id="logoutFilter" class="org.acegisecurity.ui.logout.LogoutFilter">
  <constructor-arg value="/pages/login.jsp"/> <!-- URL redirected to after logout -->
  <constructor-arg>
   <list>
    <bean class="org.acegisecurity.ui.logout.SecurityContextLogoutHandler"/>
   </list>
  </constructor-arg>
 </bean>
 
 <bean id="securityContextHolderAwareRequestFilter" class="org.acegisecurity.wrapper.SecurityContextHolderAwareRequestFilter"/>
 
 <bean id="authenticationProcessingFilter" class="org.acegisecurity.ui.webapp.AuthenticationProcessingFilter">
  <property name="authenticationManager" ref="authenticationManager"/>
  <property name="authenticationFailureUrl" value="/pages/login.jsp?login_error=1"/>
  <property name="defaultTargetUrl" value="/login.do"/><!-- 登录后的跳转页面 -->
  <property name="filterProcessesUrl" value="/j_acegi_security_check"/>
        <property name="exceptionMappings">
            <value>
                org.acegisecurity.concurrent.ConcurrentLoginException=/login.jsp?login_error=too_many_user_error
            </value>
        </property>  
 </bean>
 
 <bean id="exceptionTranslationFilter" class="org.acegisecurity.ui.ExceptionTranslationFilter">
  <property name="authenticationEntryPoint">
   <bean class="org.acegisecurity.ui.webapp.AuthenticationProcessingFilterEntryPoint">
    <property name="loginFormUrl" value="/pages/login.jsp"/>
    <property name="forceHttps" value="false"/>
   </bean>
  </property>
  <property name="accessDeniedHandler">
   <bean class="org.acegisecurity.ui.AccessDeniedHandlerImpl">
    <property name="errorPage" value="/pages/accessDenied.jsp"/>
   </bean>
  </property>
 </bean>
 
 <!--  
        匿名过滤器。 该过滤器是用来对匿名用户的处理。  
        如果用户尚未登录，将生成一个匿名用户的Authentication存放到ContextHolder中。 即当不存在任何授权信息时，  
        自动为Authentication对象添加userAttribute中定义的匿名用户权限。  
    --> 
    <bean id="anonymousProcessingFilter" 
        class="org.acegisecurity.providers.anonymous.AnonymousProcessingFilter"> 
        <property name="key" value="changeThis" /> 
        <property name="userAttribute" value="anonymous,ROLE_ANONYMOUS" /> 
    </bean>
 
 <!-- acegi end-->
 <!-- 监听认证授权事件，输出日志 -->
    <bean id="authenticationLoggerListener" class="org.acegisecurity.event.authentication.LoggerListener" />

 

 

ehcache.xml

 

<?xml version="1.0" encoding="UTF-8"?>
<ehcache>
 <!-- 默认的磁盘缓存目录 -->
    <diskStore path="java.io.tmpdir"/>

<cache name="userAuthCache"
        maxElementsInMemory="300"
        eternal="true"
        overflowToDisk="true"
        memoryStoreEvictionPolicy="LFU"
        /> 
</ehcache>

web.xml

 

<filter>  
    <filter-name>Acegi Filter Chain Proxy</filter-name>  
    <filter-class>org.acegisecurity.util.FilterToBeanProxy</filter-class>  
    <init-param>  
        <param-name>targetClass</param-name>  
        <param-value>org.acegisecurity.util.FilterChainProxy</param-value>  
    </init-param>  
</filter>  
 
 
<filter-mapping>  
    <filter-name>Acegi Filter Chain Proxy</filter-name>  
    <url-pattern>*.html</url-pattern>  
</filter-mapping>  
<filter-mapping>  
    <filter-name>Acegi Filter Chain Proxy</filter-name>  
    <url-pattern>*.do</url-pattern>  
</filter-mapping>  
<filter-mapping>  
    <filter-name>Acegi Filter Chain Proxy</filter-name>  
    <url-pattern>*.jsp</url-pattern>  
</filter-mapping>  
<filter-mapping>  
    <filter-name>Acegi Filter Chain Proxy</filter-name>  
    <url-pattern>/j_acegi_security_check</url-pattern>  
</filter-mapping>  
 
  <!--  
        Acegi  
        Security能够限定次数防止一个principal多次并行认证到同一个应用。许多ISV利用这一点来加强授权管理，网管也喜欢这个特性因为可以防止一个用户名被重复使用。例如，你可以限制“Batman”用户从两个不同的session登录系统。  
      
    <listener>  
        <listener-class>org.acegisecurity.ui.session.HttpSessionEventPublisher</listener-class>  
    </listener> 
    -->
 
  <!-- 
  <context-param>
   <param-name>log4jConfigLocation</param-name>
   <param-value>classpath:log4j.properties</param-value>
  </context-param>
  -->