spring-security4.2实现登录退出以及权限配置

最近用到了spring-security框架来实现登录验证。
以前做登录的步骤是：
1、用户输入用户名、密码登录
2、连接数据库对用户名、密码进行验证
3、获取用户信息（角色列表等等）
4、获取相关操作权限
security安全框架有点不同：
1、用户名、密码组合生成一个AuthenticationToken对象。
2、生成的这个token对象会传递给一个AuthenticationManager对象用于验证。
3、当成功认证后，AuthenticationManager返回一个Authentication对象。
4、接下来，就可以调用AuthenticationSuccessHandler成功处理器跳转首页或者登录之前访问的url。

---

先上spring-security.xml的配置

<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:beans="http://www.springframework.org/schema/beans" xsi:schemaLocation="
    http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-4.2.xsd
    http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-4.3.xsd">

    <http pattern="/skin/**" security="none" />
    <http pattern="/login.action" security="none" />

    <http authentication-manager-ref="authenticationManager" entry-point-ref="customAuthenticationEntryPoint">
        <!-- 初始化 -->
        <intercept-url pattern="/init/**" access="hasRole('ROLE_ADMIN')" />
        <!-- 登录 -->
        <intercept-url pattern="/login.action*" access="permitAll" />
        <!-- 用户管理(如果多个权限可以访问就用hasAnyRole('xx','cc')) -->
        <intercept-url pattern="/user/*.action" access="hasRole('ROLE_ADMIN')" />
        <!-- 其他 -->
        <intercept-url pattern="/**" access="authenticated" />
        <!-- 自定义认证过滤器 -->
        <custom-filter ref="customAuthenticationFilter" position="FORM_LOGIN_FILTER" />
        <!-- 自定义退出成功处理器 -->
        <logout logout-url="/logout.action" success-handler-ref="customLogoutSuccessHandler" />
        <headers>
            <!-- Iframe页面允许被其它页面嵌入 -->
            <frame-options disabled="true" />
        </headers>
        <csrf disabled="true" />
    </http>

    <!-- 认证管理器 -->
    <authentication-manager alias="authenticationManager">
        <authentication-provider ref="customAuthenticationProvider" />
    </authentication-manager>

    <!-- 认证服务提供者 -->
    <beans:bean id="customAuthenticationProvider" class="com.identity.security.CustomAuthenticationProvider" />

    <!-- 认证入口点 -->
    <beans:bean id="customAuthenticationEntryPoint" class="com.identity.security.CustomAuthenticationEntryPoint">
        <beans:constructor-arg name="pcLoginUrl" value="/login.action" />
    </beans:bean>

    <!-- 认证过滤器 -->
    <beans:bean id="customAuthenticationFilter" class="com.identity.security.CustomAuthenticationFilter">
        <beans:constructor-arg name="filterProcessesUrl" value="/doLogin.action" />
        <beans:property name="authenticationSuccessHandler" ref="customAuthenticationSuccessHandler" />
        <beans:property name="authenticationFailureHandler" ref="customAuthenticationFailureHandler" />
        <beans:property name="authenticationManager" ref="authenticationManager" />
    </beans:bean>

    <!-- 登录认证成功处理器 -->
    <beans:bean id="customAuthenticationSuccessHandler" class="com.identity.security.CustomAuthenticationSuccessHandler" />

    <!-- 登录认证失败处理器 -->
    <beans:bean id="customAuthenticationFailureHandler" class="com.identity.security.CustomAuthenticationFailureHandler" />

    <!-- 退出登录处理器 -->
    <beans:bean id="customLogoutSuccessHandler" class="com.identity.security.CustomLogoutSuccessHandler" />

</beans:beans>

先配置一个自定义登录页面

package com.identity.security;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.springframework.security.core.AuthenticationException;
import org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint;

/**
 * 自定义认证入口点
 * 
 */
public class CustomAuthenticationEntryPoint extends LoginUrlAuthenticationEntryPoint {

    /**
     * 构造方法
     * 
     * @param pcLoginUrl 登录页
     */
    public CustomAuthenticationEntryPoint(String pcLoginUrl) {
        super(pcLoginUrl);
    }

    @Override
    protected String determineUrlToUseForThisRequest(HttpServletRequest request, HttpServletResponse response, AuthenticationException exception) {
        return super.determineUrlToUseForThisRequest(request, response, exception);
    }
}

创建一个自定义的token对象类

package com.identity.security;

import org.springframework.security.authentication.AbstractAuthenticationToken;

import com.identity.entitys.UserInfo;

/**
 * 自定义认证token
 * 
 */
public class CustomAuthenticationToken extends AbstractAuthenticationToken {

    private static final long serialVersionUID = 1L;

    /** Principal */
    private Object principal;

    /** 帐号 */
    private String username;

    /** 密码 */
    private String password;

    /** 登录IP */
    private String loginIp;

    /** 构造方法，未通过登录认证 */
    public CustomAuthenticationToken() {
        super(null);
        this.principal = null;
        super.setAuthenticated(false);
    }

    /** 构造方法，已经通过登录认证 */
    public CustomAuthenticationToken(UserInfo user) {
        super(user.getAuthoritys());
        this.principal = user;
        super.setAuthenticated(true);
    }

    /**
     * 获取帐号
     * 
     * @return username 帐号
     */
    public String getUsername() {
        return username;
    }

    /**
     * 设置帐号
     * 
     * @param username 帐号
     */
    public void setUsername(String username) {
        this.username = username;
    }

    /**
     * 获取密码
     * 
     * @return password 密码
     */
    public String getPassword() {
        return password;
    }

    /**
     * 设置密码
     * 
     * @param password 密码
     */
    public void setPassword(String password) {
        this.password = password;
    }

    /**
     * 获取登录IP
     * 
     * @return loginIp 登录IP
     */
    public String getLoginIp() {
        return loginIp;
    }

    /**
     * 设置登录IP
     * 
     * @param loginIp 登录IP
     */
    public void setLoginIp(String loginIp) {
        this.loginIp = loginIp;
    }

    @Override
    public Object getCredentials() {
        return null;
    }

    @Override
    public Object getPrincipal() {
        return this.principal;
    }
}

用户输入完账号密码后会先进这个认证滤器生成我们定义好的token对象

package com.identity.security;

import java.io.IOException;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.apache.commons.lang.StringUtils;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter;

/**
 * 自定义认证过滤器
 */
public class CustomAuthenticationFilter extends AbstractAuthenticationProcessingFilter {

    private static final Logger LOGGER = LoggerFactory.getLogger(CustomAuthenticationFilter.class);

    /** 构造方法，设置登录URL */
    public CustomAuthenticationFilter(String filterProcessesUrl) {
        super(filterProcessesUrl);
    }

    @Override
    public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException, IOException, ServletException {
        try {
            CustomAuthenticationToken token = new CustomAuthenticationToken();
            token.setUsername(request.getParameter("username"));
            token.setPassword(request.getParameter("password"));
            token.setLoginIp(getRequestIp(request));
            token.setDetails(authenticationDetailsSource.buildDetails(request));
            return this.getAuthenticationManager().authenticate(token);
        } catch (CustomAuthenticationException e) {
            throw e;
        } catch (Exception e) {
            LOGGER.error("登录过程异常，请求参数为[" + request + "]", e);
            throw new CustomAuthenticationException("登录失败，服务器内部错误，请稍后再试...");
        }
    }

    /** 获取请求客户端真实IP */
    public String getRequestIp(HttpServletRequest request) {
        String ip = request.getHeader("X-Forwarded-For");
        if (StringUtils.isEmpty(ip) || "unknown".equalsIgnoreCase(ip)) {
            ip = request.getHeader("Proxy-Client-IP");
        }
        if (StringUtils.isEmpty(ip) || "unknown".equalsIgnoreCase(ip)) {
            ip = request.getHeader("WL-Proxy-Client-IP");
        }
        if (StringUtils.isEmpty(ip) || "unknown".equalsIgnoreCase(ip)) {
            ip = request.getHeader("HTTP_CLIENT_IP");
        }
        if (StringUtils.isEmpty(ip) || "unknown".equalsIgnoreCase(ip)) {
            ip = request.getHeader("HTTP_X_FORWARDED_FOR");
        }
        if (StringUtils.isEmpty(ip) || "unknown".equalsIgnoreCase(ip)) {
            ip = request.getRemoteAddr();
        }
        return ip;
    }

}

然后过滤器把这个Authentication对象传递给AuthenticationProvider去处理

package com.identity.security;

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.security.authentication.AuthenticationProvider;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;
import org.springframework.transaction.annotation.Transactional;

import com.identity.entitys.LoginLog;
import com.identity.entitys.UserInfo;
import com.identity.querys.impl.UserInfoQueryImpl;

/**
 * 自定义认证服务提供者
 * 
 */
public class CustomAuthenticationProvider implements AuthenticationProvider {

    private static final Logger LOGGER = LoggerFactory.getLogger(CustomAuthenticationProvider.class);

    @Override
    @Transactional()
    public Authentication authenticate(Authentication authentication) throws AuthenticationException {
        try {
            CustomAuthenticationToken token = (CustomAuthenticationToken) authentication;
            UserInfo user = retrieveUser(token);
            preAuthenticationCheck(token, user);
            additionalAuthenticationCheck(token, user);
            postAuthenticationCheck(token, user);
            saveLoginLog(token, user);
            CustomAuthenticationToken result = new CustomAuthenticationToken(user);
            result.setDetails(authentication.getDetails());
            return result;
        } catch (CustomAuthenticationException e) {
            throw e;
        } catch (Exception e) {
            LOGGER.error("登录认证异常，Token为[" + authentication + "]", e);
            throw new CustomAuthenticationException("登录失败，服务器内部错误，请稍后再试...", e);
        }
    }

    @Override
    public boolean supports(Class<?> authentication) {
        return CustomAuthenticationToken.class.isAssignableFrom(authentication);
    }

    /** 检索用户 */
    private UserInfo retrieveUser(CustomAuthenticationToken token) {
    //这里是进数据库根据账号查用户
        UserInfo user = null;
        user = new UserInfoQueryImpl().username(token.getUsername(),false).uniqueResult();
        return user;
    }

    /** 前置的身份认证检查 */
    private void preAuthenticationCheck(CustomAuthenticationToken token, UserInfo user) {
        if (user == null) {
            throw new CustomAuthenticationException("登录失败，帐号不存在");
        }
        if (!user.isEnabled()) {
            throw new CustomAuthenticationException("登录失败，您的帐号已被禁用");
        }
        if (!user.isAccountNonExpired()) {
            throw new CustomAuthenticationException("登录失败，您的帐号已过期");
        }
    }

    /** 后置的身份认证检查 */
    private void postAuthenticationCheck(CustomAuthenticationToken token, UserInfo user) {
        if (!user.isCredentialsNonExpired()) {
            throw new CustomAuthenticationException("登录失败，您的密码已过期");
        }
    }

    /** 额外的身份认证检查 */
    public void additionalAuthenticationCheck(CustomAuthenticationToken token, UserInfo user) {
        if (!user.isRealPassword(token.getPassword())) {
            throw new CustomAuthenticationException("帐号或密码错误");
        }
    }

    /** 保存登录日志 */
    public void saveLoginLog(CustomAuthenticationToken token, UserInfo user) {
        LoginLog loginLog = new LoginLog();
        loginLog.setIp(token.getLoginIp());
        loginLog.setUser(user);
        loginLog.saveOrUpdateIt();
    }
}

在AuthenticationProvider里面验证后会进入登录成功或者失败处理器

package com.identity.security;

import java.io.IOException;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;

import net.sf.json.JSONObject;

import org.apache.commons.lang.StringUtils;
import org.springframework.security.core.Authentication;
import org.springframework.security.web.WebAttributes;
import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
import org.springframework.security.web.savedrequest.DefaultSavedRequest;
import org.springframework.security.web.savedrequest.HttpSessionRequestCache;
import org.springframework.security.web.savedrequest.RequestCache;

/**
 * 自定义登录认证成功处理器
 * 
 */
public class CustomAuthenticationSuccessHandler implements AuthenticationSuccessHandler {

    private RequestCache requestCache = new HttpSessionRequestCache();

    @Override
    public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException, ServletException {

        response.setContentType("text/html;charset=UTF-8");
        JSONObject jsonObject = new JSONObject();
        String targetUrl = request.getParameter("to");
        if (StringUtils.isEmpty(targetUrl)) {
            DefaultSavedRequest savedRequest = (DefaultSavedRequest) this.requestCache.getRequest(request, response);
            if (savedRequest != null) {
                targetUrl = savedRequest.getRequestURI() + "?" + savedRequest.getQueryString();
            } else {
                targetUrl = request.getContextPath() + "/index.action";
            }
        } else {
            this.requestCache.removeRequest(request, response);
        }
        clearAuthenticationAttributes(request);
        jsonObject.put("staut", true);
        jsonObject.put("targetUrl", targetUrl);
        response.getWriter().write(jsonObject.toString());
    }

    /** 删除身份认证临时数据 */
    protected final void clearAuthenticationAttributes(HttpServletRequest request) {
        HttpSession session = request.getSession(false);
        if (session == null) {
            return;
        }
        session.removeAttribute(WebAttributes.AUTHENTICATION_EXCEPTION);
    }
}

package com.identity.security;

import java.io.IOException;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import net.sf.json.JSONObject;

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.web.authentication.AuthenticationFailureHandler;

/**
 * 自定义登录认证失败处理器
 * 
 */
public class CustomAuthenticationFailureHandler implements AuthenticationFailureHandler {

    private static final Logger LOGGER = LoggerFactory.getLogger(CustomAuthenticationFailureHandler.class);

    @Override
    public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response, AuthenticationException exception) throws IOException, ServletException {
        response.setContentType("text/html;charset=UTF-8");
        String errorMsg = null;
        JSONObject jsonObject = new JSONObject();
        if (exception instanceof CustomAuthenticationException) {
            errorMsg = exception.getMessage();
        } else {
            LOGGER.error("登录异常，请求参数为[" + request + "]", exception);
            errorMsg = "登录失败，服务器内部错误，请稍后再试...";
        }
        jsonObject.put("staut", false);
        jsonObject.put("errorMsg", errorMsg);
        response.getWriter().write(jsonObject.toString());
    }
}

自定义异常类

package com.identity.security;

import org.springframework.security.core.AuthenticationException;

/**
 * 自定义认证异常
 * 
 */
public class CustomAuthenticationException extends AuthenticationException {

    private static final long serialVersionUID = 1L;

    public CustomAuthenticationException(String msg) {
        super(msg);
    }

    public CustomAuthenticationException(String msg, Throwable t) {
        super(msg, t);
    }
}

然后是退出

package com.identity.security;

import java.io.IOException;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import net.sf.json.JSONObject;

import org.apache.commons.lang.StringUtils;
import org.springframework.security.core.Authentication;
import org.springframework.security.web.authentication.logout.LogoutSuccessHandler;

/**
 * 自定义退出登录处理器
 * 
 */
public class CustomLogoutSuccessHandler implements LogoutSuccessHandler {

    @Override
    public void onLogoutSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException, ServletException {
        response.setContentType("text/html;charset=UTF-8");
        JSONObject jsonObject = new JSONObject();
        String url = request.getParameter("to");
        if (StringUtils.isEmpty(url)) {
            url = request.getContextPath() + "/login.action?logout=true";
        }
        jsonObject.put("staut", true);
        jsonObject.put("url", url);
        response.getWriter().write(jsonObject.toString());
    }
}

然后用户和权限实体多对多的关系就行了，权限表的权限名记得是ROLE_XX的格式。完成以上的配置基本上登录退出就完成了~~