Java SecurityConfig类代码示例

import org.springframework.security.access.SecurityConfig; //导入依赖的package包/类
@PostConstruct
private void loadResourceDefine() {
	//System.err.println(" ---------------MaxSecurityMetadataSource loadResourceDefine--------------- ");
	if (resourceMap == null) {
		resourceMap = new HashMap<String, Collection<ConfigAttribute>>();
		List<Resources> resources = authService.fetchAllResources();
		for (Resources resource : resources) {
			Collection<ConfigAttribute> configAttributes = new ArrayList<ConfigAttribute>();
			Set<Role> roles = resource.getRoles();
			for(Role r : roles) {
				ConfigAttribute configAttribute = new SecurityConfig(r.getRoleKey());
				configAttributes.add(configAttribute);
			}
			resourceMap.put(resource.getResUrl(), configAttributes);
		}
	}
}
 

import org.springframework.security.access.SecurityConfig; //导入依赖的package包/类
@Override
public void decide(Authentication authentication, Object object,Collection<ConfigAttribute> configAttributes)
		
		throws AccessDeniedException, InsufficientAuthenticationException {
	
	if(configAttributes == null){
		return	;
	}
	Iterator<ConfigAttribute> ite = configAttributes.iterator();
	while(ite.hasNext()){
		
		ConfigAttribute ca = ite.next();
		
		String needRole = ((SecurityConfig)ca).getAttribute();
		
		for(GrantedAuthority grantedAuthority : authentication.getAuthorities()){
			if(needRole.trim().equals(grantedAuthority.getAuthority().trim())){
				return;
			}
		}
	}
	//û��Ȩ�޷���
	throw new AccessDeniedException("û��Ȩ�޷��ʣ�");

}
 

import org.springframework.security.access.SecurityConfig; //导入依赖的package包/类
/**
 * 自定义访问策略
 * 
 * @param authentication
 *            用户及用户权限信息
 * @param object
 * @param configAttributes
 *            访问资源需要的权限
 * @throws AccessDeniedException
 * @throws InsufficientAuthenticationException
 * @see org.springframework.security.access.AccessDecisionManager#decide(org.springframework.security.core.Authentication,
 *      java.lang.Object, java.util.Collection)
 */
public void decide(Authentication authentication, Object object,
		Collection<ConfigAttribute> configAttributes)
		throws AccessDeniedException, InsufficientAuthenticationException {
	SysUserVO user = (SysUserVO) authentication.getPrincipal();
	logger.info("访问资源的用户为" + user.getUsername());
	// 如果访问资源不需要任何权限则直接通过
	if (configAttributes == null) {
		return;
	}
	Iterator<ConfigAttribute> ite = configAttributes.iterator();
	// 遍历configAttributes看用户是否有访问资源的权限
	while (ite.hasNext()) {
		ConfigAttribute ca = ite.next();
		String needRole = ((SecurityConfig) ca).getAttribute();
		// ga 为用户所被赋予的权限。 needRole 为访问相应的资源应该具有的权限。
		for (GrantedAuthority ga : authentication.getAuthorities()) {
			if (needRole.trim().equals(ga.getAuthority().trim())) {
				return;
			}
		}
	}
	throw new AccessDeniedException("没有权限访问！ ");
}
 

import org.springframework.security.access.SecurityConfig; //导入依赖的package包/类
private void addSecurityConfig(FilterInvocation filterInvocation, Collection<ConfigAttribute> guiConfigAttr,
                   String url, DisplayableValue<String>[] actions) {

     AntPathRequestMatcher matcher = new AntPathRequestMatcher(url);
     if (!matcher.matches(filterInvocation.getRequest()) || actions == null) {
         return;
     }
     
     for (DisplayableValue<String> action : actions) {
         String actionUri = action.getValue();
         if (StringUtils.isBlank(actionUri)) {
             continue;
         }

         //all users has permission to access these resources
         if (action.equals(AuthorizationConstants.AUTZ_UI_PERMIT_ALL_URL)) {
             return;
         }

         SecurityConfig config = new SecurityConfig(actionUri);
if (!guiConfigAttr.contains(config)) {
	guiConfigAttr.add(config);
}
     }
 }
 

import org.springframework.security.access.SecurityConfig; //导入依赖的package包/类
@Test
public void getAttributes1() {
   SetpointSecuredSecurityMetadataSource mds = (SetpointSecuredSecurityMetadataSource) SetpointSecuredSecurityMetadataSource
         .instance();
   CibetMethodInvocation mi = new CibetMethodInvocation(null, null, null, null, null);
   mi.addRule("Secured", "' ROLE_ADMIN\", 'ROLE_DARM'}");

   Collection<ConfigAttribute> attributes = mds.getAttributes(mi);
   Assert.assertEquals(2, attributes.size());
   Assert.assertEquals(SecurityConfig.class, attributes.iterator().next().getClass());
   Iterator<ConfigAttribute> it = attributes.iterator();
   SecurityConfig sc1 = (SecurityConfig) it.next();
   Assert.assertEquals("ROLE_ADMIN", sc1.getAttribute());
   SecurityConfig sc2 = (SecurityConfig) it.next();
   Assert.assertEquals("ROLE_DARM", sc2.getAttribute());
}
 

import org.springframework.security.access.SecurityConfig; //导入依赖的package包/类
/**
 * 根据路径获取访问权限的集合接口
 *
 * @param object
 * @return
 * @throws IllegalArgumentException
 */
@Override
public Collection<ConfigAttribute> getAttributes(Object object)
        throws IllegalArgumentException {
    HttpServletRequest request = ((FilterInvocation) object).getHttpRequest();
    List<ConfigAttribute> attrs = new ArrayList<>();
    try {
        List<Permission> permissions = permissionService.findAll();
        for (Permission p : permissions) {
            AntPathRequestMatcher matcher = new AntPathRequestMatcher(p.getUrl());
            if (matcher.matches(request)) {
                attrs.add(new SecurityConfig(p.getCode()));
            }
        }
    } catch (ExecutionException e) {
        e.printStackTrace();
    }

    return attrs;
}
 

import org.springframework.security.access.SecurityConfig; //导入依赖的package包/类
/**
 * 获取所有角色权限
 * @return
 */
@Override
public Collection<ConfigAttribute> getAllConfigAttributes() {
    //从数据库查出所有角色实体
    List<RoleEntity> roleEntities = roleService.findAll();

    //所有角色权限列表
    List<ConfigAttribute> configAttributes = new ArrayList<>();

    if(roleEntities == null || roleEntities.isEmpty())
        return configAttributes;

    //遍历，把角色权限加进角色权限列表中
    for(RoleEntity re : roleEntities){
        ConfigAttribute ca = new SecurityConfig(re.getName());
        configAttributes.add(ca);
    }

    return configAttributes;
}
 

import org.springframework.security.access.SecurityConfig; //导入依赖的package包/类
/**
 * Gets the filter security interceptor.
 *
 * @return the filter security interceptor
 */
@Bean(name = "fsi")
public FilterSecurityInterceptor getFilterSecurityInterceptor() {
  FilterSecurityInterceptor interceptor = new FilterSecurityInterceptor();
  interceptor.setAuthenticationManager(getProviderManager());
  interceptor.setAccessDecisionManager(getAffirmativeBased());

  LinkedHashMap<RequestMatcher, Collection<ConfigAttribute>> requestMap = new LinkedHashMap<>();
  requestMap.put(new AntPathRequestMatcher("/adm/**"),
      SecurityConfig.createListFromCommaDelimitedString("ROLE_MANAGER,ROLE_MANAGER-GUI"));
  requestMap.put(new AntPathRequestMatcher("/adm/restartvm.ajax"), SecurityConfig
      .createListFromCommaDelimitedString("ROLE_POWERUSERPLUS,ROLE_MANAGER,ROLE_MANAGER-GUI"));
  requestMap.put(new AntPathRequestMatcher("/sql/**"), SecurityConfig
      .createListFromCommaDelimitedString("ROLE_POWERUSERPLUS,ROLE_MANAGER,ROLE_MANAGER-GUI"));
  requestMap.put(new AntPathRequestMatcher("/app/**"),
      SecurityConfig.createListFromCommaDelimitedString(
          "ROLE_POWERUSER,ROLE_POWERUSERPLUS,ROLE_MANAGER,ROLE_MANAGER-GUI"));
  requestMap.put(new AntPathRequestMatcher("/**"),
      SecurityConfig.createListFromCommaDelimitedString(
          "ROLE_PROBEUSER,ROLE_POWERUSER,ROLE_POWERUSERPLUS,ROLE_MANAGER,ROLE_MANAGER-GUI"));

  interceptor
      .setSecurityMetadataSource(new DefaultFilterInvocationSecurityMetadataSource(requestMap));
  return interceptor;
}
 

import org.springframework.security.access.SecurityConfig; //导入依赖的package包/类
public void decide(Authentication authentication, Object object, Collection<ConfigAttribute> configAttributes)
		throws AccessDeniedException, InsufficientAuthenticationException {
	log.debug("decide calling {},{}", object, configAttributes);
	if (configAttributes == null) {
		return;
	}
	System.out.println("decide " + object.toString()); // object is a URL.
	Iterator<ConfigAttribute> ite = configAttributes.iterator();
	while (ite.hasNext()) {
		ConfigAttribute ca = ite.next();
		String needRole = ((SecurityConfig) ca).getAttribute();
		for (GrantedAuthority ga : authentication.getAuthorities()) {
			if (needRole.equals(ga.getAuthority())) { // ga is user's role.
				return;
			}
		}
	}
	throw new AccessDeniedException("no right");
}
 

import org.springframework.security.access.SecurityConfig; //导入依赖的package包/类
public Collection<ConfigAttribute> loadRoleByResource(String url) {
	try {
		String sql = "select ro.name as role,re.res_string as url " + "from ls_role ro join ls_resc_role rr on ro.id=rr.role_id "
				+ "join ls_resource re on re.id=rr.resc_id " + "where re.res_string='" + url + "'";
		List<Map<String, Object>> authList = jdbcTemplate.queryForList(sql);
		Collection<ConfigAttribute> auths = new ArrayList<ConfigAttribute>();

		for (Map<String, Object> map : authList) {
			ConfigAttribute auth = new SecurityConfig(map.get("role").toString());
			auths.add(auth);
		}

		return auths;
	} catch (RuntimeException re) {
		log.error("find roles by url failed " + re);
		throw re;
	}
}
 

import org.springframework.security.access.SecurityConfig; //导入依赖的package包/类
private void loadResourceDefine() {
	if(resourceMap == null) {
		resourceMap = new HashMap<String, Collection<ConfigAttribute>>();
		List<Permission> resources = this.permissionManager.findAll();
		for (Permission resource : resources) {
			Collection<ConfigAttribute> configAttributes = new ArrayList<ConfigAttribute>();
               //以权限名封装为Spring的security Object
			ConfigAttribute configAttribute = new SecurityConfig(resource.getId());
			configAttributes.add(configAttribute);
			resourceMap.put(resource.getUrl(), configAttributes);
		}
	}
	
	Set<Entry<String, Collection<ConfigAttribute>>> resourceSet = resourceMap.entrySet();
	Iterator<Entry<String, Collection<ConfigAttribute>>> iterator = resourceSet.iterator();
	
}
 

import org.springframework.security.access.SecurityConfig; //导入依赖的package包/类
/**
 * 加载所有资源与权限的关系 
 */
public synchronized void loadResourceDefine() {
	List<Menu> resources = menuMapper.getMenuList();
	if (resourceMap == null) 
		resourceMap = new HashMap<String, Collection<ConfigAttribute>>((int)(resources.size()/0.75F));
	else
		resourceMap.clear();
	for (Menu resource : resources) {
		if("1".equals(resource.getMenulevcod())) continue;
		//获取可以访问这个资源的角色
		List<Role> roleList = roleMapper.getRoleListByAuthority(resource.getMenu_id());
		if(null == roleList || roleList.size() == 0) continue;
		Collection<ConfigAttribute> configAttributes = new ArrayList<ConfigAttribute>();
		for (Role role : roleList) {
			configAttributes.add(new SecurityConfig(role.getRole_name()));
		}
		//授权信息存入内存
		resourceMap.put(MMT.FILTER_ROOT + resource.getMenuurl(), configAttributes);
	}
}
 

import org.springframework.security.access.SecurityConfig; //导入依赖的package包/类
public void execute(
        DelegatingMethodSecurityMetadataSource delegatingMethodSecurityMetadataSource,
        Map<String, String> resourceMap) {
    Assert.notNull(delegatingMethodSecurityMetadataSource);
    Assert.notNull(resourceMap);

    logger.info("refresh method resource");

    Map<String, List<ConfigAttribute>> methodMap = null;
    methodMap = new LinkedHashMap<String, List<ConfigAttribute>>();

    for (Map.Entry<String, String> entry : resourceMap.entrySet()) {
        methodMap.put(entry.getKey(), SecurityConfig
                .createListFromCommaDelimitedString(entry.getValue()));
    }

    MethodSecurityMetadataSource source = new MapBasedMethodSecurityMetadataSource(
            methodMap);
    List<MethodSecurityMetadataSource> sources = new ArrayList<MethodSecurityMetadataSource>();
    sources.add(source);

    List<MethodSecurityMetadataSource> methodSecurityMetadataSources = delegatingMethodSecurityMetadataSource
            .getMethodSecurityMetadataSources();
    methodSecurityMetadataSources.clear();
    methodSecurityMetadataSources.addAll(sources);

    Map attributeCache = (Map) BeanUtils.safeGetFieldValue(
            delegatingMethodSecurityMetadataSource, "attributeCache");
    attributeCache.clear();
}
 

import org.springframework.security.access.SecurityConfig; //导入依赖的package包/类
public void refresh() {
    if ((delegatingMethodSecurityMetadataSource == null)
            || (methodSourceFetcher == null)) {
        logger.info(
                "delegatingMethodSecurityMetadataSource : {}, methodSourceFetcher : {}",
                delegatingMethodSecurityMetadataSource, methodSourceFetcher);

        return;
    }

    logger.info("execute refresh");

    Map<String, List<ConfigAttribute>> methodMap = null;
    methodMap = new LinkedHashMap<String, List<ConfigAttribute>>();

    Map<String, String> resourceMap = methodSourceFetcher.getSource(null);

    for (Map.Entry<String, String> entry : resourceMap.entrySet()) {
        methodMap.put(entry.getKey(), SecurityConfig
                .createListFromCommaDelimitedString(entry.getValue()));
    }

    MethodSecurityMetadataSource source = new MapBasedMethodSecurityMetadataSource(
            methodMap);
    List<MethodSecurityMetadataSource> sources = new ArrayList<MethodSecurityMetadataSource>();
    sources.add(source);

    List<MethodSecurityMetadataSource> methodSecurityMetadataSources = delegatingMethodSecurityMetadataSource
            .getMethodSecurityMetadataSources();
    methodSecurityMetadataSources.clear();
    methodSecurityMetadataSources.addAll(sources);

    Map attributeCache = (Map) BeanUtils.safeGetFieldValue(
            delegatingMethodSecurityMetadataSource, "attributeCache");
    attributeCache.clear();
}
 

import org.springframework.security.access.SecurityConfig; //导入依赖的package包/类
public void execute(FilterSecurityInterceptor filterSecurityInterceptor,
        Map<String, String> resourceMap) {
    Assert.notNull(filterSecurityInterceptor);
    Assert.notNull(resourceMap);

    logger.info("refresh url resource");

    LinkedHashMap<RequestMatcher, Collection<ConfigAttribute>> requestMap = null;
    requestMap = new LinkedHashMap<RequestMatcher, Collection<ConfigAttribute>>();

    for (Map.Entry<String, String> entry : resourceMap.entrySet()) {
        String key = entry.getKey();
        String value = entry.getValue();
        requestMap.put(new AntPathRequestMatcher(key),
                SecurityConfig.createListFromCommaDelimitedString(value));
    }

    FilterInvocationSecurityMetadataSource source = new DefaultFilterInvocationSecurityMetadataSource(
            requestMap);
    filterSecurityInterceptor.setSecurityMetadataSource(source);
}