spring security 中启用角色继承、ACL与CAS

<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security"
             xmlns:beans="http://www.springframework.org/schema/beans"
             xmlns:context="http://www.springframework.org/schema/context"
             xmlns:util="http://www.springframework.org/schema/util"
             xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
             xsi:schemaLocation="http://www.springframework.org/schema/beans
          http://www.springframework.org/schema/beans/spring-beans.xsd
          http://www.springframework.org/schema/util
          http://www.springframework.org/schema/util/spring-util.xsd
          http://www.springframework.org/schema/context
          http://www.springframework.org/schema/context/spring-context.xsd
          http://www.springframework.org/schema/security
          http://www.springframework.org/schema/security/spring-security.xsd">

    <!-- 方法安全 -->
    <global-method-security secured-annotations="enabled" pre-post-annotations="enabled" jsr250-annotations="enabled" access-decision-manager-ref="methodAccessDecisionManager">
        <expression-handler ref="methodSecurityExpressionHandler"/>
        <after-invocation-provider ref="postInvocationAdviceProvider"/>
    </global-method-security>

    <!-- HTTP安全 -->
    <http pattern="/proxy.html" security="none" />
    <http entry-point-ref="casEntryPoint" use-expressions="true" access-decision-manager-ref="webAccessDecisionManager">
        <expression-handler ref="webSecurityExpressionHandler"/>
        <intercept-url pattern="/" access="hasRole(‘ROLE_USER‘)"/>
        <custom-filter ref="requestSingleLogoutFilter" before="LOGOUT_FILTER"/>
        <custom-filter ref="singleLogoutFilter" before="CAS_FILTER"/>
        <custom-filter ref="casFilter" position="CAS_FILTER"/>
    </http>

    <!-- ↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓授权(Authorization)配置↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓ -->
    <beans:bean id="aclAuthorizationStrategy" class="org.springframework.security.acls.domain.AclAuthorizationStrategyImpl">
        <beans:constructor-arg name="auths">
            <beans:list>
                <beans:ref bean="supervisor"/>
                <beans:ref bean="supervisor"/>
                <beans:ref bean="supervisor"/>
            </beans:list>
        </beans:constructor-arg>
    </beans:bean>

    <beans:bean id="permissionGrantingStrategy" class="org.springframework.security.acls.domain.DefaultPermissionGrantingStrategy">
        <beans:constructor-arg name="auditLogger">
            <beans:bean class="org.springframework.security.acls.domain.ConsoleAuditLogger"/>
        </beans:constructor-arg>
    </beans:bean>

    <beans:bean id="supervisor" class="org.springframework.security.core.authority.SimpleGrantedAuthority">
        <beans:constructor-arg name="role" value="ROLE_SUPERVISOR"/>
    </beans:bean>

    <beans:bean id="aclCache" class="org.springframework.security.acls.domain.EhCacheBasedAclCache">
        <beans:constructor-arg name="cache">
            <beans:bean class="org.springframework.cache.ehcache.EhCacheFactoryBean">
                <beans:property name="overflowToDisk" value="true"/>
                <beans:property name="maxElementsInMemory" value="1024"/>
            </beans:bean>
        </beans:constructor-arg>
        <beans:constructor-arg name="permissionGrantingStrategy" ref="permissionGrantingStrategy"/>
        <beans:constructor-arg name="aclAuthorizationStrategy" ref="aclAuthorizationStrategy"/>
    </beans:bean>

    <beans:bean id="lookupStrategy" class="org.springframework.security.acls.jdbc.BasicLookupStrategy">
        <beans:constructor-arg name="dataSource" ref="dataSource"/>
        <beans:constructor-arg name="aclCache" ref="aclCache"/>
        <beans:constructor-arg name="aclAuthorizationStrategy" ref="aclAuthorizationStrategy"/>
        <beans:constructor-arg name="grantingStrategy" ref="permissionGrantingStrategy"/>
    </beans:bean>

    <beans:bean id="aclService" class="org.springframework.security.acls.jdbc.JdbcMutableAclService">
        <beans:constructor-arg name="dataSource" ref="dataSource"/>
        <beans:constructor-arg name="lookupStrategy" ref="lookupStrategy"/>
        <beans:constructor-arg name="aclCache" ref="aclCache"/>
        <beans:property name="classIdentityQuery" value="select @@identity"/><!-- select @@identity用于获得刚刚插入的自增id select LAST_INSERT_ID() -->
        <beans:property name="sidIdentityQuery" value="select @@identity"/>
    </beans:bean>

    <!-- 通过表达式使用ACL -->
    <beans:bean id="aclPermissionEvaluator" class="org.springframework.security.acls.AclPermissionEvaluator">
        <beans:constructor-arg name="aclService" ref="aclService"/>
    </beans:bean>

    <!-- 角色继承 -->
    <beans:bean id="roleHierarchy" class="org.springframework.security.access.hierarchicalroles.RoleHierarchyImpl">
        <beans:property name="hierarchy">
            <beans:value>
                ROLE_DEVELOPER > ROLE_SUPERVISOR
                ROLE_SUPERVISOR > ROLE_ADMIN
                ROLE_ADMIN > ROLE_USER
            </beans:value>
        </beans:property>
    </beans:bean>

    <!-- 用于web的ExpressionHandler -->
    <beans:bean id="webSecurityExpressionHandler" name="webSecurityExpressionHandler"
                class="org.springframework.security.web.access.expression.DefaultWebSecurityExpressionHandler">
        <beans:property name="roleHierarchy" ref="roleHierarchy"/>
        <beans:property name="permissionEvaluator" ref="aclPermissionEvaluator"/>
    </beans:bean>

    <!-- 用于method的ExpressionHandler -->
    <beans:bean id="methodSecurityExpressionHandler" class="org.springframework.security.access.expression.method.DefaultMethodSecurityExpressionHandler">
        <beans:property name="roleHierarchy" ref="roleHierarchy"/>
        <beans:property name="permissionCacheOptimizer">
            <beans:bean class="org.springframework.security.acls.AclPermissionCacheOptimizer">
                <beans:constructor-arg name="aclService" ref="aclService"/>
            </beans:bean>
        </beans:property>
        <beans:property name="permissionEvaluator" ref="aclPermissionEvaluator"/>
    </beans:bean>

    <!-- 用于web(taglib以及url)的AccessDecisionManager -->
    <beans:bean id="webAccessDecisionManager" class="org.springframework.security.access.vote.AffirmativeBased">
        <beans:constructor-arg>
            <beans:list>
                <beans:bean class="org.springframework.security.web.access.expression.WebExpressionVoter">
                    <beans:property name="expressionHandler" ref="webSecurityExpressionHandler"/>
                </beans:bean>
                <beans:bean class="org.springframework.security.access.vote.RoleHierarchyVoter">
                    <beans:constructor-arg ref="roleHierarchy"/>
                </beans:bean>
                <beans:bean class="org.springframework.security.access.vote.AuthenticatedVoter"/>
            </beans:list>
        </beans:constructor-arg>
    </beans:bean>

    <!-- 用于method的AccessDecisionManager -->
    <beans:bean id="methodAccessDecisionManager" class="org.springframework.security.access.vote.AffirmativeBased">
        <beans:constructor-arg>
            <beans:list>
                <beans:bean class="org.springframework.security.access.vote.RoleHierarchyVoter">
                    <beans:constructor-arg ref="roleHierarchy"/>
                </beans:bean>
                <beans:bean class="org.springframework.security.access.vote.AuthenticatedVoter"/>
                <beans:bean class="org.springframework.security.access.prepost.PreInvocationAuthorizationAdviceVoter">
                    <beans:constructor-arg name="pre">
                        <beans:bean class="org.springframework.security.access.expression.method.ExpressionBasedPreInvocationAdvice">
                            <beans:property name="expressionHandler" ref="methodSecurityExpressionHandler"/>
                        </beans:bean>
                    </beans:constructor-arg>
                </beans:bean>
                <beans:bean class="org.springframework.security.access.annotation.Jsr250Voter"/>
            </beans:list>
        </beans:constructor-arg>
    </beans:bean>

    <!-- 后置过滤 -->
    <beans:bean id="postInvocationAdviceProvider" class="org.springframework.security.access.prepost.PostInvocationAdviceProvider">
        <beans:constructor-arg name="postAdvice">
            <beans:bean class="org.springframework.security.access.expression.method.ExpressionBasedPostInvocationAdvice">
                <beans:constructor-arg name="expressionHandler" ref="methodSecurityExpressionHandler"/>
            </beans:bean>
        </beans:constructor-arg>
    </beans:bean>
    <!-- ↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑/授权(Authorization)配置↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑ -->

    <!-- ↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓认证(Authentication)配置↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓↓ -->
    <authentication-manager alias="authManager">
        <authentication-provider ref="casAuthProvider"/>
    </authentication-manager>

    <beans:bean id="userService" class="org.springframework.security.core.userdetails.jdbc.JdbcDaoImpl">
        <beans:property name="enableGroups" value="true"/>
        <beans:property name="dataSource" ref="dataSource"/>
    </beans:bean>

    <!-- This filter handles a Single Logout Request from the CAS Server -->
    <beans:bean id="singleLogoutFilter" class="org.jasig.cas.client.session.SingleSignOutFilter"/>
    <!-- This filter redirects to the CAS Server to signal Single Logout should be performed -->
    <beans:bean id="requestSingleLogoutFilter"
                class="org.springframework.security.web.authentication.logout.LogoutFilter">
        <beans:property name="filterProcessesUrl" value="/j_spring_cas_security_logout"/>
        <beans:constructor-arg name="logoutSuccessUrl" value="https://${cas.server}/logout"/>
        <beans:constructor-arg name="handlers">
            <beans:bean class="org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler"/>
        </beans:constructor-arg>
    </beans:bean>

    <beans:bean id="serviceProperties" class="org.springframework.security.cas.ServiceProperties">
        <beans:property name="service" value="https://${cas.service}/j_spring_cas_security_check"/>
    </beans:bean>
    <beans:bean id="casEntryPoint"
                class="org.springframework.security.cas.web.CasAuthenticationEntryPoint">
        <beans:property name="serviceProperties" ref="serviceProperties"/>
        <beans:property name="loginUrl" value="https://${cas.server}/login"/>
    </beans:bean>
    <beans:bean id="casFilter"
                class="org.springframework.security.cas.web.CasAuthenticationFilter">
        <beans:property name="authenticationManager" ref="authManager"/>
        <beans:property name="serviceProperties" ref="serviceProperties"/>
        <beans:property name="authenticationDetailsSource">
            <beans:bean class="org.springframework.security.cas.web.authentication.ServiceAuthenticationDetailsSource"/>
        </beans:property>
        <beans:property name="authenticationFailureHandler">
            <beans:bean class="org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler"/>
        </beans:property>
    </beans:bean>

    <!--
        NOTE: In a real application you should not use an in memory implementation. You will also want
              to ensure to clean up expired tickets by calling ProxyGrantingTicketStorage.cleanup()
     -->
    <beans:bean id="casAuthProvider" class="org.springframework.security.cas.authentication.CasAuthenticationProvider">
        <beans:property name="serviceProperties" ref="serviceProperties"/>
        <beans:property name="key" value="${cas.key}"/>
        <beans:property name="authenticationUserDetailsService">
            <beans:bean
                    class="org.springframework.security.core.userdetails.UserDetailsByNameServiceWrapper">
                <beans:constructor-arg ref="userService"/>
            </beans:bean>
        </beans:property>
        <beans:property name="ticketValidator">
            <beans:bean
                    class="org.jasig.cas.client.validation.Cas20ProxyTicketValidator">
                <beans:constructor-arg value="https://${cas.server}"/>
            </beans:bean>
        </beans:property>
    </beans:bean>

    <!-- Configuration for the environment can be overriden by system properties -->
    <context:property-placeholder system-properties-mode="OVERRIDE" properties-ref="environment"/>
    <util:properties id="environment">
        <beans:prop key="cas.service">localhost:8444/user</beans:prop>
        <beans:prop key="cas.server">localhost:8443/cas</beans:prop>
        <beans:prop key="cas.key">CAS_KEY_ADMIN.USER</beans:prop>
    </util:properties>
    <!-- ↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑/认证(Authentication)配置↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑ -->
</beans:beans>
时间： 2024-10-14 04:55:06

spring security 中启用角色继承、ACL与CAS的相关文章

Spring Security 4 基于角色的登录例子（带源码）

原文网址: http://websystique.com/spring-security/spring-security-4-role-based-login-example/ [相关已翻译的本系列其他文章,点击分类里面的spring security 4] [翻译by 明明如月 QQ 605283073] 上一篇: Spring Security 4 安全视图片段 使用标签(Spring Security 标签) 下一篇: Spring Security 4 Hibernate整合 注解和xm

Spring Security中html页面设置hasRole无效的问题

Spring Security中html页面设置hasRole无效的问题 一.前言 学了几天的spring Security,偶然发现的hasRole和hasAnyAuthority的区别.当然,可能有更深入的我没看到.现在把我实际的调试结果分享给大家 二.失效原因及解决 下面是部分示例html页面代码 <div sec:authorize="hasRole('R_ADMIN')">   <p class="bg-info">权限0001可见

spring security中配置密码为md5的带salt加密

spring security中配置密码为md5的带salt加密 service: private Md5PasswordEncoder encoder; //spring security md5 public Md5PasswordEncoder getEncoder() { return encoder; } @Resource public void setEncoder(Md5PasswordEncoder encoder) { this.encoder = encoder; } @O

Spring Security（19）——对Acl的支持

目录 1.1           准备工作 1.2           表功能介绍 1.2.1     表acl_sid 1.2.2     表acl_class 1.2.3     表acl_object_identity 1.2.4     表acl_entry 1.3           Acl主要接口 1.4           配置AclService 1.4.1     配置DataSource 1.4.2     配置LookupStrategy 1.4.3     配置AclAu

spring boot跨域请求访问配置以及spring security中配置失效的原理解析

一.同源策略 同源策略[same origin policy]是浏览器的一个安全功能,不同源的客户端脚本在没有明确授权的情况下,不能读写对方资源. 同源策略是浏览器安全的基石. 什么是源 源[origin]就是协议.域名和端口号.例如:http://www.baidu.com:80这个URL. 什么是同源 若地址里面的协议.域名和端口号均相同则属于同源. 是否是同源的判断 例如判断下面的URL是否与 http://www.a.com/test/index.html 同源 http://www.a

spring boot 整合spring security中spring security版本升级的遇到的坑

在spring security3.x的版本中 hasAnyRole这个方法不会对我们需要认证的身份前面加个前缀ROLE_,在3.x版本hasRole的源码如下 public final boolean hasAnyRole(String... roles) { Set<String> roleSet = getAuthoritySet(); for (String role : roles) { if (roleSet.contains(role)) { return true; } } r

spring security中的过滤器

一.SS的默认过滤器 当配置的http是自动配置时,默认要经过SS的11个过滤器: 1,HttpSessionContextintegrationFilter:把session中的securitycontext放入securitycontextHolder中,用完后清空: 2,LogoutFilter:处理注销请求,默认请求地址为:/j_spring_security_logout; 3,AuthenticationProcessingFilter:认证过滤器,处理FROM登录,默认只处理:/j

spring security中@PreAuthorize注解的使用

添加依赖<!-- oauth --><dependency> <groupId>org.springframework.cloud</groupId> <artifactId>spring-cloud-starter-oauth2</artifactId></dependency><dependency> <groupId>org.springframework.boot</groupId&g

Spring Security应用开发(15)层次化角色体系

1.1. 层次化角色体系 使用Spring Security的层次化角色体系,可以简化复杂角色的配置.配置过程如下: (1)首先需要在http结点中指定访问决策管理器. <!-- 角色和URL模式的对应关系 access-decision-manager-ref:指定使用的访问决策管理器. --> <sec:http auto-config="true" use-expressions="true" access-decision-manager-