Java中SpringSecurity密码错误5次锁定用户的实现方法

spring security简介

spring security是一个能够为基于spring的企业应用系统提供声明式的安全访问控制解决方案的安全框架。它提供了一组可以在spring应用上下文中配置的bean，充分利用了spring ioc，di（控制反转inversion of control ,di:dependency injection 依赖注入）和aop（面向切面编程）功能，为应用系统提供声明式的安全访问控制功能，减少了为企业系统安全控制编写大量重复代码的工作。

下面看下实例代码：

第一步：创建 authenticationsuccesseventlistener.java  用来处理登录成功的事件。

package com.dcits.yft.auth; 
import com.dcits.yft.system.dao.userdao; 
import org.springframework.beans.factory.annotation.autowired; 
import org.springframework.context.applicationlistener; 
import org.springframework.security.authentication.event.authenticationsuccessevent; 
import org.springframework.stereotype.component; 
import java.util.map; 
/** 
 * 登陆成功监听 
 * 
 * @author shaoj 3/2/2017. 
 */ 
@component 
public class authenticationsuccesseventlistener implements applicationlistener<authenticationsuccessevent> { 
  @autowired 
  private userdao userdao; 
  @override 
  public void onapplicationevent(authenticationsuccessevent authenticationsuccessevent) { 
    yftuserdetails yftuserdetails = (yftuserdetails) authenticationsuccessevent.getauthentication().getprincipal(); 
    string account = yftuserdetails.getusername(); 
    map<string, object> user = userdao.queryuserbyaccount(account); 
    userdao.updatestatusbyaccount(account, user.get("enable").tostring(), 0); 
  } 
}

第二步：新建authenticationfailurelistener.java 用来处理登录失败的事件。

package com.dcits.yft.auth; 
import com.dcits.yft.system.dao.paramsdao; 
import com.dcits.yft.system.dao.userdao; 
import org.springframework.beans.factory.annotation.autowired; 
import org.springframework.context.applicationlistener; 
import org.springframework.security.authentication.event.authenticationfailurebadcredentialsevent; 
import org.springframework.stereotype.component; 
import java.util.map; 
/** 
 * 登陆失败监听 
 * 
 * @author shaoj 3/2/2017. 
 */ 
@component 
public class authenticationfailurelistener implements applicationlistener<authenticationfailurebadcredentialsevent> { 
  @autowired 
  private userdao userdao; 
  @autowired 
  private paramsdao paramsdao; 
  @override 
  public void onapplicationevent(authenticationfailurebadcredentialsevent authenticationfailurebadcredentialsevent) { 
    string account = authenticationfailurebadcredentialsevent.getauthentication().getprincipal().tostring(); 
    map<string, object> user = userdao.queryuserbyaccount(account); 
    if (user != null) { 
      // 用户失败次数 
      int fails = integer.parseint(user.get("fails").tostring()); 
      fails++; 
      // 系统配置失败次数 
      int fails_count = integer.parseint(paramsdao.queryparamsvalue("fails_count")); 
      // 超出失败次数，停用账户 
      if (fails >= fails_count) { 
        userdao.updatestatusbyaccount(account, "false", fails); 
        // 失败次数++ 
      } else { 
        userdao.updatestatusbyaccount(account, user.get("enable").tostring(), fails); 
      } 
    } 
  } 
} 

第三步：在userdao.java中加入登录状态更新的代码

/** 
 * 更新用户登录次数 
 * 
 * @param account 账户 
 * @param login_counts 登录次数 
 * @return 
 */ 
public void updatelogincounts(string account) { 
  daoutil.update("update t_yft_user set login_counts = login_counts + 1 where account = ?", account); 
} 

第四步：数据库中添加登录次数字段

<span style="font-family: arial, helvetica, sans-serif;">alter table t_yft_user add (fails number(11) default 0 );</span> 
<span style="font-family: arial, helvetica, sans-serif;">comment on column t_yft_user.fails is '失败尝试次数';</span> 
[sql] view plain copy
insert into t_yft_params (id,code,name,value,unit,remark,crt_date) 
 values (66,'fails_count','登陆尝试次数','5','','',to_date('2017-03-02','yyyy-mm-dd')); 

以上所述是小编给大家介绍的java中springsecurity密码错误5次锁定用户的实现方法，希望对大家有所帮助